You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Net change vs 2026-07-19: 0 — totals are identical across all four tools.
Findings by Tool
Tool
Total
Critical
High
Medium
Low/Info
zizmor (security)
0
0
0
0
0
poutine (supply chain)
20
0
10
1
9
actionlint (linting)
114
-
-
-
-
runner-guard (taint analysis)
335
0
324
11
0
⚠️zizmor anomaly: the compile output contains only the Running zizmor security scanner on 258 files banner with no findings or summary before the poutine banner. This is a recurring capture anomaly (historical zizmor counts were ~72, once 919). Treated as 0 captured, not a verified clean result.
Clustered Findings by Tool and Type
Runner-Guard Taint Analysis Findings
Runner-Guard Score: not emitted in this run's output.
Rule ID
Name
Severity
Count
Affected Workflows
RGS-004
Comment-Triggered Workflow Without Author Authorization Check
Issues created: none. All high-severity runner-guard findings are unchanged from 2026-07-19 and each maps to a closed issue for the same rule+file, or is an established framework false-positive (see Runner-Guard Analysis below).
Actionlint Linting Issues (114)
Issue Type
Count
Notes
[expression] undefined secret_verification_result
69
Real codegen regression — if: references an undeclared needs.*.outputs field (69 distinct workflows)
[shellcheck] SC2016 (expressions in single quotes)
Description: Generated .lock.yml jobs contain an if: guard referencing needs.<job>.outputs.secret_verification_result, but the producing job never declares that output. actionlint statically resolves the needs.*.outputs object type and flags the property as undefined.
Impact: A dangling output reference in an if: condition. Because the output is undefined, the expression evaluates to empty — the guard may not behave as intended, and it signals a compiler codegen defect. This is the only high-count finding that is a genuine, fixable bug in this scan.
You are fixing a code generation bug in the gh-aw compiler that produces
invalid GitHub Actions workflows flagged by actionlint:
error: [expression] property "secret_verification_result" is not defined
in object type {...} (in an `if:` condition)
The generated `.lock.yml` job has an `if:` guard referencing
`needs.<job>.outputs.secret_verification_result`, but the producing job never
declares that output. Fix the Go generator in pkg/workflow (search for
"secret_verification_result" and for where the consuming job's `if:` is emitted).
Do EITHER of the following consistently:
1. Declare the output on the producing job:
outputs:
secret_verification_result: ${{ steps.<step>.outputs.result }}
and set it in the step that performs secret verification; OR
2. If secret verification was intentionally removed, delete the dangling
`if:` reference from the consuming job.
Then recompile all workflows and confirm actionlint reports 0 [expression]
errors:
<compile> 2>&1 | grep -c 'secret_verification_result' # must be 0
Do not hand-edit individual .lock.yml files — they are generated. Fix the
generator, regenerate, and add a compiler unit test asserting that any emitted
`needs.*.outputs.secret_verification_result` reference has a matching `outputs:`
declaration.
Runner-Guard Analysis
Runner-guard produced 335 findings (324 high, 11 medium) — identical to 2026-07-19. Per the deduplication policy (skip closed same-rule+file issues; comment on open ones; create only genuinely new findings), 0 issues were created and 0 comments added this run:
These sit next to # poutine:ignore untrusted_checkout_exec suppression comments in the generated smoke-test workflows and are compiler-generated save_base_github_folders.sh steps — expected in these call-target smoke tests.
Historical Trends
Date
zizmor
poutine
actionlint
runner-guard
Total
2026-07-16
n/a
20
112
335
—
2026-07-17
n/a
20
113
335
—
2026-07-18
0
20
113
335
468
2026-07-19
0
20
114
335
469
2026-07-20
0
20
114
335
469
Change vs previous scan: 0 (identical across all tools).
New issue types: none.
Resolved issue types: none.
Actionlint has been slowly creeping up (109 → 114 over the past week), driven by the stable 69 secret_verification_result regression plus incremental shellcheck SC2016 additions.
Recommendations
Immediate: No new Critical/High actionable security issues — all high runner-guard findings are closed-dup or framework false-positives.
Long-term: Suppress/annotate the recurring framework false-positives (RGS-004 pre_activation guard, RGS-018 MCP-scaffolding require) in runner-guard config so real findings aren't buried under ~300 known-benign alerts.
Prevention: Add a compiler unit test asserting every emitted needs.*.outputs.* reference has a matching outputs: declaration.
Next Steps
Fix the secret_verification_result codegen regression in pkg/workflow and recompile (target: 0 [expression] errors).
Consider a runner-guard allowlist for the RGS-004 pre_activation and RGS-018 generate_safe_outputs_tools.cjs framework patterns.
Address remaining shellcheck SC2016/SC2086 in generated templates.
🔍 Static Analysis Report - 2026-07-20
Analysis Summary
.lock.ymlfiles)Findings by Tool
Clustered Findings by Tool and Type
Runner-Guard Taint Analysis Findings
Runner-Guard Score: not emitted in this run's output.
Issues created: none. All high-severity runner-guard findings are unchanged from 2026-07-19 and each maps to a closed issue for the same rule+file, or is an established framework false-positive (see Runner-Guard Analysis below).
Actionlint Linting Issues (114)
[expression]undefinedsecret_verification_resultif:references an undeclaredneeds.*.outputsfield (69 distinct workflows)[shellcheck]SC2016 (expressions in single quotes)[shellcheck]SC2086 (unquoted variable)[shellcheck]SC2038 (find/xargs)[shellcheck]SC2034 / SC2005 / SC2129 / SC2188 / SC2327 / SC2328Poutine Supply Chain Findings (20)
untrusted_checkout_execgithub_action_from_unverified_creator_usedpr_runs_on_self_hostedZizmor Security Findings
No findings captured (see anomaly note above).
Top Priority Issues
1. actionlint
[expression]— undefinedsecret_verification_result(real, actionable).lock.ymljobs contain anif:guard referencingneeds.<job>.outputs.secret_verification_result, but the producing job never declares that output. actionlint statically resolves theneeds.*.outputsobject type and flags the property as undefined.if:condition. Because the output is undefined, the expression evaluates to empty — the guard may not behave as intended, and it signals a compiler codegen defect. This is the only high-count finding that is a genuine, fixable bug in this scan.secret_verification_resultoutput in 69 workflows #44870 (closed).2. RGS-004 — Comment-Triggered Workflow Without Author Authorization (310, framework FP)
author_associationguard into thepre_activationjob (see closed fix fix(rgs-004): add author_association guard to pre_activation jobs for comment-triggered workflows #29481); runner-guard scans each downstream job's generated block in isolation and cannot see the centralized guard. Covered by closed umbrella issues [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in 16 workflows #28156 / [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in 16 workflows #29694 / [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check (16 workflows) #30284.Fix Suggestion for actionlint
[expression]secret_verification_resultIssue:
if:conditions reference an undeclared job outputsecret_verification_resultSeverity: error (expression)
Affected Workflows: 69 generated
.lock.ymlfilesPrompt to Copilot Agent:
Runner-Guard Analysis
Runner-guard produced 335 findings (324 high, 11 medium) — identical to 2026-07-19. Per the deduplication policy (skip closed same-rule+file issues; comment on open ones; create only genuinely new findings), 0 issues were created and 0 comments added this run:
Per-finding dedup decisions
author_associationguard inpre_activation, fix fix(rgs-004): add author_association guard to pre_activation jobs for comment-triggered workflows #29481). → skiprun:block isrequire('${{ runner.temp }}/gh-aw/actions/generate_safe_outputs_tools.cjs'); await main();(compiler-generated "Write MCP Scripts Config" step), not an obfuscated payload. → skipFramework-level dedup for these recurring RGS-* findings is already tracked by closed issues #31043 and #31254.
All Findings Details
Actionlint — 69 workflows with undefined
secret_verification_result(sample)ab-testing-advisor, agent-performance-analyzer, archie, architecture-guardian, artifacts-summary, auto-triage-issues, brave, breaking-change-checker, ci-coach, cli-consistency-checker, code-scanning-fixer, copilot-centralization-drilldown, ... (69 total, all generated
.lock.yml)Each occurrence is an
if:guard at column ~241 referencingneeds.<job>.outputs.secret_verification_result.Poutine
untrusted_checkout_exec(10, suppressed pattern)smoke-workflow-call.lock.yml: lines 318, 333, 348, 456, 461smoke-workflow-call-with-inputs.lock.yml: lines 315, 330, 345, 456, 461These sit next to
# poutine:ignore untrusted_checkout_execsuppression comments in the generated smoke-test workflows and are compiler-generatedsave_base_github_folders.shsteps — expected in these call-target smoke tests.Historical Trends
secret_verification_resultregression plus incremental shellcheck SC2016 additions.Recommendations
secret_verification_resultcodegen regression in the gh-aw generator (69 workflows). This is the single highest-value real fix and reopens the pattern from closed [static-analysis] actionlint [expression] regression: undefinedsecret_verification_resultoutput in 69 workflows #44870.require) in runner-guard config so real findings aren't buried under ~300 known-benign alerts.needs.*.outputs.*reference has a matchingoutputs:declaration.Next Steps
secret_verification_resultcodegen regression inpkg/workflowand recompile (target: 0[expression]errors).pre_activationand RGS-018generate_safe_outputs_tools.cjsframework patterns.References: