[static-analysis] Report - 2026-07-28

[github-actions]

🔍 Static Analysis Report - 2026-07-28

Analysis Summary

• Tools Used: zizmor, poutine, actionlint, runner-guard, syft, grype, yamllint
• Workflows Scanned: 264
• Workflows with findings (actionlint/poutine/runner-guard, file-level): 10 (down from 33 on 2026-07-25 — most prior findings already closed/resolved)
• New GitHub issues filed this run: 0 (see Runner-Guard Analysis — every Critical/High finding already maps to a previously closed issue)

Findings by Tool

Tool	Total	Critical	High	Medium	Low
zizmor (security)	0	0	0	0	0
poutine (supply chain)	20	0	10 (error)	1	9 (info)
actionlint (linting)	20	-	-	-	-
runner-guard (taint analysis)	331	0	321	10	0
syft (SBOM inventory)	18 images / 6,853 packages	-	-	-	-
grype (container CVEs)	4,256 raw / 1,043 distinct	218	1,420	1,645	325 (+539 negligible, 109 unknown)
yamllint (yaml linting)	0 rule violations / 7 advisories	-	-	-	-

No overall Runner-Guard score/grade is printed in this log format.

Clustered Findings by Tool and Type

Zizmor Security Findings

None. Zizmor ran clean across all 264 workflows — the 13th consecutive scan with zero findings since 2026-07-16.

Poutine Supply Chain Findings

Issue Type	Severity	Count	Affected Workflows
untrusted_checkout_exec	error	10	smoke-workflow-call.lock.yml, smoke-workflow-call-with-inputs.lock.yml
github_action_from_unverified_creator_used	info	9	dataflow-pr-discussion-dataset, hippo-embed, smoke-codex, mcp-inspector, copilot-setup-steps, daily-elixir-credo-snippet-audit, link-check (×2), super-linter
pr_runs_on_self_hosted	warning	1	smoke-copilot-arm.lock.yml

Poutine finding details

• untrusted_checkout_exec — bash "${RUNNER_TEMP}/gh-aw/actions/*.sh" invocations flagged in smoke-workflow-call.lock.yml (lines 318, 333, 348, 456, 461) and smoke-workflow-call-with-inputs.lock.yml (lines 456, 461, plus 3 more). Several already carry a # poutine:ignore untrusted_checkout_exec comment yet still get flagged — see Fix Suggestion below.
• github_action_from_unverified_creator_used — safedep/pmg@5ac0f27... (dataflow-pr-discussion-dataset:550, hippo-embed:471), actions-ecosystem/action-add-labels@18f1af5... (smoke-codex:2368), astral-sh/setup-uv@11f9893... (mcp-inspector:593) and @eac588a... (copilot-setup-steps.yml:43), erlef/setup-beam@54075bc... (daily-elixir-credo-snippet-audit:472), gaurav-nelson/github-action-markdown-link-check@5c5dfc0... (link-check.yml:36,44), super-linter/super-linter@4ce2083... (super-linter:1754).
• pr_runs_on_self_hosted — smoke-copilot-arm.lock.yml:497 uses runs-on: ubuntu-24.04-arm on a PR-triggered job.

Actionlint Linting Issues

Issue Type	Count	Affected Workflows
SC2086 (unquoted var, word splitting)	7	daily-geo-optimizer, impeccable-skills-reviewer, mattpocock-skills-reviewer, pr-code-quality-reviewer
SC2038 (find|xargs without -print0)	6	repository-quality-improver, spec-extractor, unbloat-docs
SC2034 (unused var i)	2	daily-byok-ollama-test
SC2328 (redirect steals command-substitution output)	1	pr-sous-chef
SC2327 (command substitution empty due to redirect)	1	pr-sous-chef
SC2188 (dangling redirection)	1	unbloat-docs
SC2129 (use { } grouping instead of repeated redirects)	1	daily-astrostylelite-markdown-spellcheck
SC2005 (echo $(cmd) → just cmd)	1	unbloat-docs

All 20 findings are shellcheck issues surfaced through actionlint; 0 pyflakes errors.

Syft SBOM Inventory

18 container images / 6,853 total packages

Image	Packages
ghcr.io/github/serena-mcp-server:latest	2314
mcp/notion	604
ghcr.io/github/gh-aw-mcpg:v0.4.6	632
mcp/markitdown	375
ghcr.io/github/gh-aw-firewall/agent:0.27.42	532
ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.42	348
mcp/context7	329
mcp/memory	253
grafana/mcp-grafana	245
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.42	193
semgrep/semgrep:latest	191
mcp/ast-grep:latest	186
ghcr.io/github/gh-aw-node	177
mcp/arxiv-mcp-server	168
node:lts-alpine	165
ghcr.io/github/gh-aw-firewall/squid:0.27.42	63
ghcr.io/github/github-mcp-server:v1.7.0	40
python:alpine	38

Mixed Debian/apt, Alpine/apk, npm, Go module, and Python/pip ecosystems given the mix of Debian- and Alpine-based images. No syft errors.

Runner-Guard Taint Analysis Findings

No Runner-Guard Score/grade is printed in this compiler's output format.

Rule ID	Name	Severity	Count	Affected Workflows
RGS-004	Comment-Triggered Workflow Without Author Authorization Check	High	308	q.lock.yml, dev-hawk.lock.yml, ai-moderator.lock.yml
RGS-012	Secret Exfiltration via Outbound HTTP Request	High	9	daily-model-inventory.lock.yml, visual-regression-checker.lock.yml, daily-byok-ollama-test.lock.yml, docs-noob-tester.lock.yml
RGS-018	Suspicious Payload Execution Pattern	High	4	daily-cli-performance.lock.yml, daily-sentrux-report.lock.yml, smoke-claude.lock.yml, daily-byok-ollama-test.lock.yml
RGS-005	Excessive Permissions on Untrusted Trigger	Medium	8	agentic_commands.yml, ai-moderator.lock.yml, q.lock.yml
RGS-019	Step Output Interpolated in run Block	Medium	2	windows-cli-integration.yml, error-message-lint.yml

Issues created this run: none. Every Critical/High finding above was individually verified (via gh api search/issues) against prior [static-analysis] issue history:

Rule	File	Status
RGS-004	q.lock.yml	Closed #47726
RGS-004	dev-hawk.lock.yml, ai-moderator.lock.yml	Covered by closed aggregate issues #30284 / #29694 / #28156
RGS-012	daily-model-inventory.lock.yml	Closed #30079 / #30776
RGS-012	visual-regression-checker.lock.yml, docs-noob-tester.lock.yml	Closed #30947 / #28626 / #29462 / #29178
RGS-012	daily-byok-ollama-test.lock.yml	Closed #35652
RGS-018	daily-cli-performance.lock.yml	Closed #47478
RGS-018	smoke-claude.lock.yml	Closed #47477
RGS-018	daily-sentrux-report.lock.yml	Closed #46532
RGS-018	daily-byok-ollama-test.lock.yml	Closed #35653

Per the dedup rule (closed issue for same rule+file → skip, don't recreate), no new issues were filed. RGS-005/RGS-019 are Medium severity and excluded from issue creation by policy regardless.

RGS-004 detail (verbatim rule text)

"A workflow is triggered by issue_comment, pull_request_review_comment, or workflow_run events and accesses secrets or has write permissions, but does not verify the comment author's authorization level before executing privileged operations... any external user can trigger the workflow by posting a comment on any open issue or pull request."

Runner-guard emits one hit per privileged step, so 308 instances = 3 root-cause workflows (q.lock.yml 124 steps, dev-hawk.lock.yml 94 steps, ai-moderator.lock.yml 90 steps), not 308 distinct vulnerabilities.

Grype Container Vulnerability Findings

Severity breakdown and top images

Severity	Raw finding count
Critical	218
High	1,420
Medium	1,645
Low	325
Negligible	539
Unknown	109

Top images by finding volume: serena-mcp-server:latest (1,059, 63 critical), mcp/markitdown (893, 45 critical), mcp/arxiv-mcp-server (404, 16 critical), gh-aw-firewall/agent:0.27.42 (344), mcp/notion (335, 12 critical), semgrep/semgrep:latest (250, 22 critical), grafana/mcp-grafana (231, 11 critical), gh-aw-mcpg:v0.4.6 (168, 16 critical).

Notable Critical CVEs with fixes already available: CVE-2025-55130 (node/libnode → 20.19.2+deb13u1 / node 20.20.0+), CVE-2025-15467 (openssl/libssl3 → 3.0.18-1~deb12u2 / 3.3.6-r0 / 3.5.5-r0), CVE-2026-27699 (node-agent-base/http-proxy-agent family → +deb13u1), GHSA-p77j-4mvh-x3m3/GO-2026-4337 (google.golang.org/grpc in gh-aw-mcpg:v0.4.6 → 1.79.3), and a cluster of golang.org/x/crypto@v0.40.0 advisories in gh-aw-mcpg:v0.4.6 (fix: 0.52.0). No-fix-yet criticals include CVE-2026-31789 (libcrypto3), CVE-2026-12087/CVE-2026-13221 (perl), CVE-2026-5450 (libc6 in github-mcp-server:v1.7.0), CVE-2026-4800 (lodash), CVE-2026-33937 (handlebars).

Given the volume (4,256 raw / 1,043 distinct CVEs across shared base/MCP images, not individual workflow files), this is reported as a clustered summary; the full per-image CVE list is in the compiler log if a detailed spreadsheet is needed.

Yamllint YAML Linting Findings

No standard YAML lint rule violations (0 line-length/indentation/trailing-spaces hits). The yamllint section instead surfaced 7 gh-aw compiler configuration advisories:

Compiler advisories

Detected 53 slash_command entries in this repository; 1 are not using centralized routing.
Schedule uses hourly interval with fixed minute offset (11) — consider fuzzy 'every 6h'.
Schedule uses fixed daily time (23:05 UTC) — consider fuzzy 'daily'.
Schedule uses fixed daily time (21:47 UTC) — consider fuzzy 'daily'.
Schedule uses fixed weekly time (Monday 16:00 UTC) — consider fuzzy 'weekly on monday'.
Schedule uses fixed daily time (2:17 UTC) — consider fuzzy 'daily'.
Schedule uses fixed daily time (0:18 UTC) — consider fuzzy 'daily'.

Top Priority Issues

1. RGS-004 — Comment-Triggered Workflow Without Author Authorization Check

• Tool: runner-guard
• Count: 308 (3 workflows)
• Severity: High
• Affected: q.lock.yml, dev-hawk.lock.yml, ai-moderator.lock.yml
• Description: Comment/workflow_run-triggered workflows with secrets/write access lack an explicit author_association gate detectable by static analysis.
• Impact: If no compiler-level guard exists, any external commenter could trigger privileged execution.
• Status: All 3 already covered by closed issues; likely a known false-positive pattern on gh-aw's generated activation gating (not visible to the static scanner) — see fix suggestion below for the permanent resolution path.

2. Poutine untrusted_checkout_exec

• Tool: poutine
• Count: 10
• Severity: error
• Affected: smoke-workflow-call.lock.yml, smoke-workflow-call-with-inputs.lock.yml
• Description: bash execution of bundled first-party scripts flagged as arbitrary-code-execution risk; some occurrences already have a # poutine:ignore comment that isn't being honored.
• Impact: Noise reduction — real risk is low (bundled scripts, not untrusted checkout content) but the inconsistent suppression means real findings could get lost in the noise.

3. Grype Critical CVEs in serena-mcp-server:latest

• Tool: grype
• Count: 63 critical (1,059 total)
• Severity: Critical
• Affected: any workflow pulling ghcr.io/github/serena-mcp-server:latest
• Description: Largest critical-CVE surface of any MCP image in the fleet.
• Impact: Highest concentration of unpatched critical vulnerabilities; worth a base-image refresh/rebuild cadence review.

Fix Suggestion for Poutine untrusted_checkout_exec

Issue: Inconsistent # poutine:ignore untrusted_checkout_exec suppression on generated first-party script steps
Severity: error (poutine) / low actual risk
Affected Workflows: 2 workflows (smoke-workflow-call.lock.yml, smoke-workflow-call-with-inputs.lock.yml), 10 findings — but the underlying template bug affects any workflow using these compiler-emitted steps

Prompt to Copilot Agent:

You are fixing a supply-chain security lint finding identified by poutine.

Vulnerability: untrusted_checkout_exec — Arbitrary Code Execution from Untrusted Code
Changes (Detected usage of `bash`)
Rule: https://github.com/boostsecurityio/poutine/blob/main/docs/rules/untrusted_checkout_exec.md

Current Issue:
poutine flags `run: bash "${RUNNER_TEMP}/gh-aw/actions/<script>.sh"` steps in generated
workflow lock files as a potential arbitrary-code-execution risk. Several of these
steps already carry a `# poutine:ignore untrusted_checkout_exec` comment (they run
trusted first-party scripts bundled with the gh-aw compiler, not attacker-controlled
checkout content), but poutine still reports 10 occurrences across
smoke-workflow-call.lock.yml and smoke-workflow-call-with-inputs.lock.yml — e.g. the
"Log runtime features" step has no suppression comment above it while the sibling
"Save base github folders" step does.

NOTE: These findings are on auto-generated `.lock.yml` files. The fix belongs in the
gh-aw compiler's Go step-template code that emits these steps, NOT in the lock file.

Required Fix:
1. Search the compiler source (pkg/workflow or equivalent) for every template that
   emits `run: bash "${RUNNER_TEMP}/gh-aw/actions/*.sh"` and confirm each emits a
   `# poutine:ignore untrusted_checkout_exec` comment immediately above the `run:` line.
2. Recompile smoke-workflow-call.md and smoke-workflow-call-with-inputs.md and re-run
   poutine to confirm the suppression is now honored for every occurrence.
3. If poutine still flags a step despite the comment, check whether poutine requires
   the comment on the same line as `run:` rather than the line above, and adjust
   comment placement to match poutine's documented suppression syntax.

Example (before, missing suppression comment):
  - name: Log runtime features
    if: ${{ contains(toJSON(vars), '"GH_AW_RUNTIME_FEATURES":') }}
    run: bash "${RUNNER_TEMP}/gh-aw/actions/log_runtime_features_summary.sh"

Example (after):
  - name: Log runtime features
    if: ${{ contains(toJSON(vars), '"GH_AW_RUNTIME_FEATURES":') }}
    # poutine:ignore untrusted_checkout_exec
    run: bash "${RUNNER_TEMP}/gh-aw/actions/log_runtime_features_summary.sh"

Apply the compiler template fix once; it propagates to all generated lock files on the
next `gh-aw compile`, including the two workflows above.

Historical Trends

• Previous Scan: 2026-07-25 (§30145915070)
• Workflows scanned then: 261 → now 264 (+3)

Metric	2026-07-24	2026-07-25	2026-07-28 (now)
zizmor	0	0	0
poutine	20	20	20
actionlint	125	55	20 (↓63%)
runner-guard	332	332	331
grype (raw)	4,354	4,212	4,256

New Issues

None. No new rule types appeared versus 2026-07-25.

Resolved Issues

• Actionlint dropped from 55 → 20 findings (-64%), continuing a steady downward trend from 125 on 2026-07-24.
• daily-squid-image-scan.lock.yml RGS-018 (present 2026-07-25) no longer appears — resolved or workflow changed.
• Workflow-level finding coverage narrowed from 33 files (2026-07-25) to 10 files this run, though this partly reflects that most of those findings already had closed tracking issues rather than new remediation.

Recommendations

1. Immediate: None outstanding — all Critical/High runner-guard and poutine error-level findings already have (closed) tracking issues; verify the closures reflect real fixes rather than just issue expiry.
2. Short-term: Fix the remaining 20 actionlint/shellcheck issues (SC2086 quoting, SC2038 find/xargs -print0) — small, mechanical, and shrinking already.
3. Medium-term: Resolve the poutine untrusted_checkout_exec suppression-comment gap (Fix Suggestion above) to keep the poutine signal clean.
4. Long-term: Track grype critical CVEs per image over time (serena-mcp-server:latest and mcp/markitdown are the largest critical-CVE surfaces) and schedule periodic base-image rebuilds.
5. Prevention: Continue the per-rule+file dedup process for runner-guard/poutine issue filing (implemented per closed meta-issue [deep-report] Static-analysis RGS-* security issues recreated daily after closure (no dedup-by-rule) #31043) — it is working correctly this run (0 duplicate issues filed).

Next Steps

• Apply the poutine untrusted_checkout_exec suppression-comment fix in the compiler
• Fix the 20 remaining actionlint/shellcheck findings (SC2086, SC2038 primarily)
• Spot-check that closed RGS-004/RGS-012/RGS-018 issues correspond to actual compiler-level fixes, not just issue expiry
• Review grype critical CVEs for serena-mcp-server:latest and mcp/markitdown for a base-image refresh
• Continue monitoring zizmor (currently clean for 13 consecutive runs)

References:

• §30384863012 (this run)
• §30145915070 (2026-07-25 scan)
• §30069897366 (2026-07-24 scan)

Generated by 📊 Static Analysis Report · age00 · 313.2 AIC · ⌖ 18.7 AIC · ⊞ 5.7K · ◷

• expires on Aug 4, 2026, 11:38 AM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I have identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 3.1 AIC · ⌖ 7.23 AIC · ⊞ 7.3K · ◷

[github-actions]

This issue is being closed as outdated. A newer issue has been created: #48779

View newer issue

---

This action was performed automatically by the Static Analysis Report workflow.