[static-analysis] Report - 2026-06-30

[github-actions]

🔍 Static Analysis Report - 2026-06-30

Analysis Summary

• Tools Used: zizmor, poutine, actionlint, runner-guard
• Total Findings: 1387
• Workflows Scanned: 257
• Workflows Affected: ~200 (mostly by-design gh-aw patterns)
• Compilation: ✅ 257 workflow(s) compiled, 0 errors, 182 warnings

Findings by Tool

Tool	Total	Critical	High	Medium	Low	Info
zizmor (security)	553	0	0	1	288	264
poutine (supply chain)	22	0	0	10 err	1	11 note
actionlint (linting)	482	—	—	—	—	—
runner-guard (taint)	330	0	319	11	—	—

No new GitHub issues created. All 319 high-severity runner-guard findings are flat vs. yesterday with an identical rule+file mix, and every (rule + file) combination already has a closed static-analysis issue. Per the dedup policy (closed issue for same rule+file ⇒ skip), 0 new issues / 0 comments. zizmor High = 0 for the 13th+ consecutive day.

Clustered Findings by Tool and Type

Zizmor Security Findings (553)

Issue Type	Severity	Count	Notes
template-injection	Informational	263	Step-name ${{ }} expansion in generated steps (by design)
adhoc-packages	Low	258	CLI installs (npm install, AWF/SDK binaries) — by design
obfuscation	Low	30	${{ '' }} empty-string placeholders in emitted env
excessive-permissions	Medium	1	Single workflow (long-standing, dependabot-repair)
superfluous-actions	Informational	1	—

Poutine Supply Chain Findings (22)

Issue Type	Severity	Count	Affected
untrusted_checkout_exec	error	10	smoke-workflow-call(-with-inputs) — all carry poutine:ignore
github_action_from_unverified_creator_used	note	8	hippo-embed (safedep/pmg), smoke-codex, etc.
unverified_script_exec	note	3	ollama/trufflehog `curl
pr_runs_on_self_hosted	warning	1	—

Actionlint Linting Issues (482)

Issue Type	Count	Notes
syntax-check	426	unexpected key "queue" for "concurrency" — bundled actionlint doesn't know gh-aw queue extension (known FP)
shellcheck	37	SC2016 single-quote expansion in emitted scripts
expression	18	Genuine: needs.*.outputs.* references undefined properties (see fix below)
permissions	1	—

📉 actionlint dropped −755 (1237 → 482): the SC2086/SC2016 shellcheck spike from 2026-06-29 (792 → 37) was reverted/fixed. Big improvement.

Runner-Guard Taint Analysis Findings (330)

Rule ID	Name	Severity	Count	Affected Workflows
RGS-004	Comment-Triggered Workflow Without Author Authorization Check	high	302	q (121), dev-hawk (92), ai-moderator (89)
RGS-012	Secret Exfiltration via Outbound HTTP Request	high	11	daily-model-inventory (4), daily-byok-ollama-test (3), visual-regression-checker (2), docs-noob-tester (1), daily-multi-device-docs-tester (1)
RGS-018	Suspicious Payload Execution Pattern	high	6	smoke-codex, smoke-claude, daily-sentrux-report, daily-cli-performance, daily-byok-ollama-test, copilot-setup-steps.yml
RGS-005	Excessive Permissions on Untrusted Trigger	medium	8	ai-moderator (4), q (3), agentic_commands.yml (1)
RGS-019	Step Output Interpolated in run Block	medium	2	windows-cli-integration.yml, error-message-lint.yml
RGS-007	Unpinned Third-Party Action Using Mutable Tag	medium	1	publish-safe-outputs-node.yml

Issues created this run: none. Dedup search confirmed closed issues already exist for every high rule+file: RGS-004 (#30077, #30284, #29694, #29460...), RGS-012 (#35652, #30776, #30079, #33477, #28488, #30947...), RGS-018 (#35653, #33476, #30532, #29461, #28154...). All are framework-level FPs: the comment-triggered agentic workflows (q/dev-hawk/ai-moderator) do gate on author association via the gh-aw pre_activation/membership check; RGS-012/018 fire on legitimate CLI installers and docs servers.

Top Priority Issue

1. actionlint [expression] — undefined needs.*.outputs.* properties

• Tool: actionlint
• Count: 18 (across 8 lock files)
• Severity: error (the only genuinely fixable, non-FP cluster this scan)
• Affected: approach-validator (3), skillet (3), ace-editor, daily-cache-strategy-analyzer, daily-caveman-optimizer, daily-doc-healer, smoke-workflow-call (4), smoke-workflow-call-with-inputs (4)
• Description: The emitter produces ${{ needs.<job>.outputs.<prop> }} referencing a job id / output key that isn't declared — activation vs pre_activation name mismatch (9), and undeclared workflow_* outputs on reusable workflow_call lock files (8).
• Impact: actionlint flags these as undefined-property errors; in CI they could surface as empty interpolations rather than the intended job output.

Fix Suggestion for actionlint [expression] undefined property

Issue: needs.<job>.outputs.<prop> references a job id/output that doesn't type-check
Severity: error
Affected Workflows: 8 lock files (18 occurrences)

Prompt to Copilot Agent:

You are fixing actionlint `[expression]` errors emitted by the gh-aw compiler.

Rule: actionlint expression — "property <x> is not defined in object type {...}"

These appear in GENERATED .lock.yml files, so the fix belongs in the Go emitter that
produces the `${{ needs.*.outputs.* }}` expressions, NOT in the .lock.yml itself.

Two clusters to fix:
1. activation name mismatch: consuming steps reference `needs.activation.outputs.activated`
   (or `.pre_activation`) but the producing job is named `pre_activation` and/or the
   referenced output key isn't in that job's `outputs:` map. Make the `needs.<id>` job id
   and the output key match the producing job exactly, and ensure the producing job
   declares every referenced output.
   Affected: approach-validator, ace-editor, daily-cache-strategy-analyzer,
   daily-caveman-optimizer, daily-doc-healer, skillet.
2. reusable workflow_call: smoke-workflow-call(.with-inputs) reference
   `needs.*.outputs.workflow_file_path|workflow_ref|workflow_repository|workflow_sha`
   that are never declared as job outputs. Declare these keys in the producing job's
   `outputs:` block before any downstream reference.

Before:
```yaml
needs: [pre_activation]
steps:
  - run: echo "${{ needs.activation.outputs.activated }}"   # undefined job + key

After:

needs: [pre_activation]
steps:
  - run: echo "${{ needs.pre_activation.outputs.activated }}"
# and the producing job declares:
pre_activation:
  outputs:
    activated: ${{ steps.x.outputs.activated }}

Verify by recompiling and confirming actionlint reports 0 [expression] errors for the
affected lock files.

<details>
<summary>All findings detail (by tool)</summary>

**zizmor** (553): template-injection 263 · adhoc-packages 258 · obfuscation 30 · excessive-permissions 1 (Medium) · superfluous-actions 1. High = 0.

**poutine** (22): untrusted_checkout_exec 10 (all `poutine:ignore`-annotated) · github_action_from_unverified_creator_used 8 · unverified_script_exec 3 · pr_runs_on_self_hosted 1.

**actionlint** (482): syntax-check 426 (`queue` concurrency FP) · shellcheck 37 (SC2016) · expression 18 (genuine) · permissions 1.

**runner-guard** (330): high 319 (RGS-004 302, RGS-012 11, RGS-018 6) · medium 11 (RGS-005 8, RGS-019 2, RGS-007 1).

</details>

### Historical Trends

| Date | zizmor | poutine | actionlint | runner-guard | Total |
|------|--------|---------|------------|--------------|-------|
| 2026-06-27 | 541 | 22 | 778 | 330 | 1671 |
| 2026-06-28 | 552 | 22 | 787 | 330 | 1691 |
| 2026-06-29 | 552 | 22 | 1237 | 330 | 2141 |
| **2026-06-30** | **553** | **22** | **482** | **330** | **1387** |

- **Total: 2141 → 1387 (−754, −35%)** — driven entirely by actionlint shellcheck normalizing (792 → 37).
- **zizmor**: +1 (adhoc-packages 257 → 258, one workflow added a CLI install). High = 0, 13th+ consecutive clean day.
- **poutine / runner-guard**: completely flat, identical rule+file mix.

#### New Issues
None — no new rule types appeared.

#### Resolved Issues
The actionlint SC2086/SC2016 shellcheck regression (792 findings on 2026-06-29) is resolved (−755).

### Recommendations

1. **Immediate**: None — 0 unaddressed Critical/High security findings; all high runner-guard findings are reviewed framework FPs with closed issues.
2. **Short-term**: Fix the 18 actionlint `[expression]` undefined-property errors in the emitter (see fix prompt) — the only genuine, fixable cluster.
3. **Long-term**: Teach the bundled actionlint about the gh-aw `queue` concurrency extension to clear the 426 syntax-check FPs (the single largest noise source).
4. **Prevention**: Keep monitoring the shellcheck emitter to prevent another SC2086/SC2016 spike like 2026-06-29.

### Next Steps

- [ ] Apply the emitter fix for actionlint `[expression]` undefined `needs.*.outputs.*` (8 lock files)
- [ ] Suppress/teach actionlint the `queue` concurrency key (426 FPs)
- [ ] No action needed on runner-guard high findings (all reviewed, closed, framework FPs)
- [ ] Continue daily trend tracking

**References:**
- [§28423720204](https://github.com/github/gh-aw/actions/runs/28423720204)




> Generated by [📊 Static Analysis Report](https://github.com/github/gh-aw/actions/runs/28423720204) · 223.2 AIC · ⌖ 33.6 AIC · ⊞ 10K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fstatic-analysis-report%22&type=issues)
> - [x] expires <!-- gh-aw-expires: 2026-07-07T06:13:27.784Z --> on Jul 6, 2026, 10:13 PM UTC-08:00

<!-- gh-aw-agentic-workflow: Static Analysis Report, engine: claude, model: agent, id: 28423720204, workflow_id: static-analysis-report, run: https://github.com/github/gh-aw/actions/runs/28423720204 -->

<!-- gh-aw-workflow-id: static-analysis-report -->
<!-- gh-aw-workflow-call-id: github/gh-aw/static-analysis-report -->

[github-actions]

This issue is being closed as outdated. A newer issue has been created: #42670

View newer issue

---

This action was performed automatically by the Static Analysis Report workflow.