[static-analysis] Report - 2026-07-29

[github-actions]

🔍 Static Analysis Report - 2026-07-29

Analysis Summary

• Tools Used: zizmor, poutine, actionlint, runner-guard, syft, grype, yamllint
• Total Findings: 4,655 (20 actionlint + 20 poutine + 353 runner-guard + 4,256 grype + 0 zizmor + 0 yamllint; syft is inventory-only)
• Workflows Scanned: 265
• Workflows Affected: ~30 (across all tools, excluding grype which is scoped to 18 container images)

Findings by Tool

Tool	Total	Critical	High	Medium	Low
zizmor (security)	0	0	0	0	0
poutine (supply chain)	20	0	10	1	9
actionlint (linting)	20	-	-	-	-
runner-guard (taint analysis)	353	0	342	11	0
syft (SBOM inventory)	18 images	-	-	-	-
grype (container CVEs)	4,256	205	1,290	1,519	305 (+539 negligible, 106 unknown)
yamllint (yaml linting)	0	-	-	-	-

Clustered Findings by Tool and Type

Zizmor Security Findings

None — 13th consecutive clean run since 2026-07-16.

Poutine Supply Chain Findings

Issue Type	Severity	Count	Affected Workflows
untrusted_checkout_exec	High (error)	10	smoke-workflow-call-with-inputs.lock.yml, smoke-workflow-call.lock.yml
github_action_from_unverified_creator_used	Low (note)	9	copilot-setup-steps.yml, daily-elixir-credo-snippet-audit.lock.yml, link-check.yml (x2), dataflow-pr-discussion-dataset.lock.yml, hippo-embed.lock.yml, smoke-codex.lock.yml, mcp-inspector.lock.yml, super-linter.lock.yml
pr_runs_on_self_hosted	Medium (warning)	1	smoke-copilot-arm.lock.yml

All 10 untrusted_checkout_exec hits carry # poutine:ignore untrusted_checkout_exec inline and are on smoke-test lock files that intentionally exercise bash against workflow-generated action scripts — unchanged from prior scans.

Actionlint Linting Issues

Issue Type	Count	Affected Workflows
SC2086 (unquoted var)	7	daily-geo-optimizer, impeccable-skills-reviewer, mattpocock-skills-reviewer, pr-code-quality-reviewer
SC2038 (find without -print0)	6	repository-quality-improver, spec-extractor, unbloat-docs
SC2034 (unused var)	2	daily-byok-ollama-test
SC2328 (redirect masks substitution)	1	pr-sous-chef
SC2327 (empty command substitution)	1	pr-sous-chef
SC2129 (individual redirects)	1	daily-astrostylelite-markdown-spellcheck
SC2005 (useless echo)	1	unbloat-docs

All findings are inside generated run: bash blocks in .lock.yml files — the actual source lives in the Go step-emitter templates under pkg/workflow/, not the lock files.

Syft SBOM Inventory

18 container images scanned

Image	Packages
ghcr.io/github/gh-aw-firewall/agent:0.27.42	532
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.42	193
ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.42	348
ghcr.io/github/gh-aw-firewall/squid:0.27.42	63
ghcr.io/github/gh-aw-mcpg:v0.4.6	632
ghcr.io/github/gh-aw-node	177
ghcr.io/github/github-mcp-server:v1.7.0	40
ghcr.io/github/serena-mcp-server:latest	2,314
node:lts-alpine	165
semgrep/semgrep:latest	191
grafana/mcp-grafana	245
mcp/ast-grep:latest	186
mcp/arxiv-mcp-server	168
mcp/context7	329
mcp/markitdown	375
mcp/memory	253
mcp/notion	604
python:alpine	38

serena-mcp-server (2,314 packages) remains the largest image by far and also the largest source of grype findings (see below).

Runner-Guard Taint Analysis Findings

Runner-Guard Score: not emitted in this run's output (N/A)

Rule ID	Name	Severity	Count	Affected Workflows
RGS-004	Comment-Triggered Workflow Without Author Authorization Check	High	329	q.lock.yml (124), dev-hawk.lock.yml (95), ai-moderator.lock.yml (110)
RGS-012	Secret Exfiltration via Outbound HTTP Request	High	9	daily-model-inventory.lock.yml (4), daily-byok-ollama-test.lock.yml (2), visual-regression-checker.lock.yml (2), docs-noob-tester.lock.yml (1)
RGS-005	Excessive Permissions on Untrusted Trigger	Medium	9	ai-moderator.lock.yml (5), q.lock.yml (3), agentic_commands.yml (1)
RGS-018	Suspicious Payload Execution Pattern	High	4	daily-byok-ollama-test.lock.yml, daily-cli-performance.lock.yml, daily-sentrux-report.lock.yml, smoke-claude.lock.yml (1 each)
RGS-019	Step Output Interpolated in run Block	Medium	2	error-message-lint.yml, windows-cli-integration.yml (1 each)

Issues created: none. Every Critical/High finding (RGS-004, RGS-012, RGS-018) was re-verified via gh api search/issues against the same rule + affected file and maps to an already-closed static-analysis issue (e.g. #47726, #30284/#29694/#28156 for RGS-004; #30776/#30947/#35652/#28488 family for RGS-012; #35653/#47478/#46532/#47477 for RGS-018). Per the dedup rule, closed matches are skipped rather than recreated. RGS-005/RGS-019 are Medium severity and out of scope for issue creation.

Notable count changes vs. 2026-07-28: RGS-004 rose on ai-moderator.lock.yml (90→110) and dev-hawk.lock.yml (94→95); q.lock.yml unchanged (124). RGS-005 rose by 1 on ai-moderator.lock.yml (4→5). RGS-012/RGS-018/RGS-019 unchanged. Per meta-issue #31043, the RGS-004 recurrence is an accepted characteristic of the auto-generated comment-trigger activation scaffolding in these 3 workflows, not a new vulnerability class.

Grype Container Vulnerability Findings

Findings by image (4,256 raw / 979 distinct CVE-IDs)

Image	Findings
ghcr.io/github/serena-mcp-server:latest	1,059
mcp/markitdown	893
mcp/arxiv-mcp-server	404
ghcr.io/github/gh-aw-firewall/agent:0.27.42	344
mcp/notion	335
semgrep/semgrep:latest	250
grafana/mcp-grafana	231
ghcr.io/github/gh-aw-mcpg:v0.4.6	168
mcp/context7	164
mcp/memory	118
mcp/ast-grep:latest	95
python:alpine	77
node:lts-alpine	61
ghcr.io/github/gh-aw-firewall/squid:0.27.42	22
ghcr.io/github/github-mcp-server:v1.7.0	13
ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.42	9
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.42	7
ghcr.io/github/gh-aw-node	6

205 Critical-severity findings this run (down from 218 on 2026-07-28). Top recurring critical packages: tar (GHSA-23hp-3jrh-7fpw, 7 hits across versions 6.2.1/7.4.3), perl-base@5.36.0-7+deb12u3 (multiple CVEs), libc6/libc-bin@2.36-9+deb12u13 (CVE-2026-5450), libgnutls30@3.7.9-2+deb12u6, libssl3/libcrypto3@3.5.5-r0, and golang.org/x/crypto (multiple GHSA advisories across v0.40.0 and v0.48.0). Most of these are base-image OS packages (Debian/Alpine) rather than gh-aw's own code — remediation is base-image bumps/rebuilds rather than source changes.

Yamllint YAML Linting Findings

None — 0 errors across all 265 files.

Top Priority Issues

1. RGS-004: Comment-Triggered Workflow Without Author Authorization Check

• Tool: runner-guard
• Count: 329 (highest of any single finding type)
• Severity: High
• Affected: q.lock.yml, dev-hawk.lock.yml, ai-moderator.lock.yml
• Description: issue_comment/workflow_run-triggered jobs with secrets/write access lack an explicit author_association gate, so any external commenter could in principle trigger privileged execution.
• Impact: Highest blast radius of any recurring finding, but already tracked and closed multiple times as an accepted characteristic of the generated comment-trigger scaffolding (meta-issue [deep-report] Static-analysis RGS-* security issues recreated daily after closure (no dedup-by-rule) #31043). No action needed this run beyond continued monitoring for count growth.
• Reference: https://github.com/Vigilant-LLC/runner-guard

2. Grype Critical CVEs in container images

• Tool: grype
• Count: 205 Critical findings across 17 of 18 images
• Severity: Critical
• Affected: serena-mcp-server (largest surface), plus base-OS packages (tar, perl-base, libc6, libgnutls30, openssl, golang.org/x/crypto) across several MCP server images
• Description: Third-party/base-image CVEs, not gh-aw source code.
• Impact: Supply-chain risk from stale base images in MCP server containers gh-aw depends on.
• Reference: https://github.com/anchore/grype

3. Poutine untrusted_checkout_exec on smoke workflows

• Tool: poutine
• Count: 10
• Severity: High (error)
• Affected: smoke-workflow-call.lock.yml, smoke-workflow-call-with-inputs.lock.yml
• Description: bash invocation of gh-aw action scripts flagged by poutine despite inline # poutine:ignore annotations.
• Impact: Low real-world risk (smoke-test scaffolding, already suppressed), but worth confirming the ignore comment is actually being honored by the poutine version in use.
• Reference: https://github.com/boostsecurityio/poutine

Fix Suggestion for actionlint SC2086 (unquoted shell variable expansion)

Issue: run: bash blocks in generated .lock.yml files reference variables without double-quoting them, risking globbing/word-splitting bugs.
Severity: Info/Style (shellcheck)
Affected Workflows: 4 workflows this run (daily-geo-optimizer, impeccable-skills-reviewer, mattpocock-skills-reviewer, pr-code-quality-reviewer) — down from a historical high of ~485 occurrences repo-wide.

Prompt to Copilot Agent:

You are fixing actionlint shellcheck SC2086 warnings ("Double quote to prevent
globbing and word splitting") reported across generated .github/workflows/*.lock.yml files.

These lock files are GENERATED by the gh-aw compiler — do NOT edit them directly.
Locate the Go template / step-emitter code in pkg/workflow/*.go that produces the
offending `run:` bash, and quote the variable expansions there.

Steps:
1. Run the repo's compile command and capture actionlint output to find the exact
   SC2086 lines and the bash snippets they map to.
2. Trace each snippet back to its source in pkg/workflow/*.go.
3. Wrap the flagged expansions in double quotes:
   Before:  run: echo $GH_HOST >> $GITHUB_ENV
   After:   run: echo "$GH_HOST" >> "$GITHUB_ENV"
   Apply to all variable and command-substitution expansions on the flagged line.
4. Recompile and confirm the SC2086 count drops with no new shellcheck regressions.
5. Do not add `# shellcheck disable=SC2086`; quote properly instead.

Verify: actionlint shellcheck total for SC2086 should trend toward 0.

Affected workflows this run: daily-geo-optimizer.md, impeccable-skills-reviewer.md,
mattpocock-skills-reviewer.md, pr-code-quality-reviewer.md

Historical Trends

• Previous Scan: 2026-07-28 (§30384863012)
• Total Findings Then: 4,627 (20 actionlint + 20 poutine + 331 runner-guard + 4,256 grype)
• Total Findings Now: 4,655
• Change: +28 (+0.6%), driven entirely by runner-guard RGS-004/RGS-005 count growth on already-tracked files; grype/poutine/actionlint/zizmor/yamllint totals essentially flat or improved (grype Critical 218→205)

New Issues

None — no new finding types appeared this run.

Resolved Issues

None newly resolved this run; grype Critical severity count improved (218 → 205, -13).

Recommendations

1. Immediate: No new Critical/High issues require filing — all current runner-guard High findings map to closed issues per meta-issue [deep-report] Static-analysis RGS-* security issues recreated daily after closure (no dedup-by-rule) #31043's guidance; re-verify grype Critical CVEs (tar, perl-base, libssl3, golang.org/x/crypto) are on the roadmap for base-image updates.
2. Short-term: Apply the SC2086/SC2038 quoting fixes in pkg/workflow/*.go to shrink the actionlint shellcheck backlog further (20 → 0).
3. Long-term: Track grype Critical-CVE trend per image over time (serena-mcp-server and mcp/markitdown dominate volume) and schedule periodic base-image bumps for third-party MCP server containers.
4. Prevention: Consider adding an explicit runner-guard suppression/allowlist entry for the known-accepted RGS-004 comment-trigger pattern so it stops surfacing as a fresh "High" count each day once genuinely reviewed (see meta-issue [deep-report] Static-analysis RGS-* security issues recreated daily after closure (no dedup-by-rule) #31043).

Next Steps

• Apply SC2086/SC2038 quoting fixes in the Go step-emitter templates
• Review grype Critical findings for base-image update opportunities (serena-mcp-server, mcp/markitdown, gh-aw-firewall/agent)
• Confirm poutine # poutine:ignore untrusted_checkout_exec annotations are honored by the current poutine version
• Revisit meta-issue [deep-report] Static-analysis RGS-* security issues recreated daily after closure (no dedup-by-rule) #31043 to decide whether to formally allowlist the RGS-004 comment-trigger pattern
• Continue monitoring RGS-004/RGS-005 count growth on ai-moderator.lock.yml and dev-hawk.lock.yml

References:

• §30425633760
• §30384863012

Generated by 📊 Static Analysis Report · age00 · 206.9 AIC · ⌖ 7.04 AIC · ⊞ 5.7K · ◷

• expires on Aug 4, 2026, 10:15 PM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 1.38 AIC · ⌖ 6.54 AIC · ⊞ 7K · ◷