🚨 Runner-Guard Security Finding
Rule: RGS-004 — Comment-Triggered Workflow Without Author Authorization Check
Severity: High
File: .github/workflows/q.lock.yml
Line: 139 (first of 124 flagged steps in the privileged job)
Description
The q workflow is triggered by a comment/slash-command event (issue_comment family) and its job accesses secrets / holds write permissions, but runner-guard does not detect an explicit github.event.comment.author_association authorization gate before the privileged steps run. The issue_comment event fires for comments from any GitHub user, including those with no affiliation to the repository. Without an explicit OWNER/MEMBER/COLLABORATOR check, an external user could trigger privileged execution by commenting. Runner-guard flags all 124 steps in the privileged job (lines 139–1000+) under this rule.
Impact
If no author-association guard is enforced at activation, arbitrary external users could invoke a workflow that has access to secrets (COPILOT_GITHUB_TOKEN, GH_AW_GITHUB_TOKEN, OTEL/Grafana/Sentry credentials per the lock manifest) and write permissions — escalating from information disclosure to potential repository compromise if combined with any injection vector.
Remediation
This is the same known RGS-004 pattern previously triaged for other gh-aw generated lock files (closed #30284, #29694, #28156, #29481). Verify that the gh-aw compiler emits an author_association guard on the pre_activation/activation job for q (defined in .github/workflows/q.md), or add roles: / command-trigger authorization to the source workflow so the generated lock enforces it before secrets are exposed. If the activation gate already exists and this is a runner-guard false positive on generated lock files, close with that rationale (consistent with prior RGS-004 closures).
Note: q.lock.yml is the only RGS-004 target this scan not already covered by an existing open or closed [static-analysis] issue (ai-moderator and dev-hawk are covered by closed #30284/#29694/#28156). Filed to close the dedup gap.
Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/30069897366
Generated by 📊 Static Analysis Report · age00 · 245.9 AIC · ⌖ 12.4 AIC · ⊞ 4.4K · ◷
🚨 Runner-Guard Security Finding
Rule: RGS-004 — Comment-Triggered Workflow Without Author Authorization Check
Severity: High
File:
.github/workflows/q.lock.ymlLine: 139 (first of 124 flagged steps in the privileged job)
Description
The
qworkflow is triggered by a comment/slash-command event (issue_commentfamily) and its job accesses secrets / holds write permissions, but runner-guard does not detect an explicitgithub.event.comment.author_associationauthorization gate before the privileged steps run. Theissue_commentevent fires for comments from any GitHub user, including those with no affiliation to the repository. Without an explicit OWNER/MEMBER/COLLABORATOR check, an external user could trigger privileged execution by commenting. Runner-guard flags all 124 steps in the privileged job (lines 139–1000+) under this rule.Impact
If no author-association guard is enforced at activation, arbitrary external users could invoke a workflow that has access to secrets (
COPILOT_GITHUB_TOKEN,GH_AW_GITHUB_TOKEN, OTEL/Grafana/Sentry credentials per the lock manifest) and write permissions — escalating from information disclosure to potential repository compromise if combined with any injection vector.Remediation
This is the same known RGS-004 pattern previously triaged for other gh-aw generated lock files (closed #30284, #29694, #28156, #29481). Verify that the gh-aw compiler emits an
author_associationguard on thepre_activation/activation job forq(defined in.github/workflows/q.md), or addroles:/ command-trigger authorization to the source workflow so the generated lock enforces it before secrets are exposed. If the activation gate already exists and this is a runner-guard false positive on generated lock files, close with that rationale (consistent with prior RGS-004 closures).Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/30069897366