[static-analysis] Report - 2026-08-10

[github-actions]

🔍 Static Analysis Report - 2026-08-10

Analysis Summary

• Tools Used: zizmor, poutine, actionlint, runner-guard, syft, grype, yamllint, shellcheck
• Total Findings: 2760 (137 static + 2623 grype container CVEs)
• Workflows Scanned: 284
• Workflows Affected: 193 (mostly from shared grype/serena-mcp-server image findings)

Findings by Tool

Tool	Total	Critical	High	Medium	Low
zizmor (security)	10	0	0	0	0 (9 note, 1 warning)
poutine (supply chain)	0	0	0	0	0
actionlint (linting)	6	-	-	-	-
runner-guard (taint analysis)	121	0	111	10	0
syft (SBOM inventory)	16 images / 5344 packages	-	-	-	-
grype (container CVEs)	2623	115	750	1134	260 (+294 negligible, +70 unknown)
yamllint (yaml linting)	0	-	-	-	-
shellcheck (shell linting)	1	-	-	-	-

Clustered Findings by Tool and Type

Zizmor Security Findings

Issue Type	Severity	Count	Affected Workflows
github_action_from_unverified_creator_used	note (acknowledged via zizmor:ignore)	9	super-linter, smoke-codex, mcp-inspector, dataflow-pr-discussion-dataset, hippo-embed, copilot-setup-steps, daily-elixir-credo-snippet-audit, link-check (x2)
pr_runs_on_self_hosted	warning	1	smoke-copilot-arm

Poutine Supply Chain Findings

None detected. Notable improvement: the untrusted_checkout_exec finding present yesterday (10 occurrences across smoke-workflow-call.lock.yml and smoke-workflow-call-with-inputs.lock.yml) is no longer present in today's scan.

Actionlint Linting Issues

Issue Type	Count	Affected Workflows
SC2016 (shellcheck-integration)	6	daily-arxiv-researcher.lock.yml (x2), daily-code-metrics.lock.yml (x2), smoke-crush.lock.yml (x2) — all generated from .github/workflows/shared/crush.md

Syft SBOM Inventory

16 container images / 5344 total packages

Image	Packages
ghcr.io/github/serena-mcp-server:sha-891c160	2314
ghcr.io/github/gh-aw-firewall/agent:0.27.44	532
ghcr.io/github/gh-aw-mcpg:v0.4.8	286
mcp/context7	329
ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.44	348
mcp/memory	253
grafana/mcp-grafana	252
mcp/ast-grep:latest	186
ghcr.io/github/gh-aw-node	177
mcp/arxiv-mcp-server	168
node:lts-alpine	165
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44	193
ghcr.io/github/gh-aw-firewall/squid:0.27.44	63
ghcr.io/github/github-mcp-server:v1.8.0	40
python:alpine	38
ghcr.io/fabio-rovai/open-ontologies:latest	10

Runner-Guard Taint Analysis Findings

Total: 121 findings (0 Critical, 111 High, 10 Medium, 0 Low). No score/grade line was emitted in this run's output.

Rule ID	Name	Severity	Count	Affected Workflows
RGS-004	Comment-Triggered Workflow Without Author Authorization Check	High	96	dev-hawk.lock.yml
RGS-012	Secret Exfiltration via Outbound HTTP Request	High	10	daily-byok-ollama-test.lock.yml, daily-model-inventory.lock.yml, docs-noob-tester.lock.yml, visual-regression-checker.lock.yml
RGS-018	Suspicious Payload Execution Pattern	High	4	daily-byok-ollama-test.lock.yml, daily-cli-performance.lock.yml, daily-sentrux-report.lock.yml, smoke-claude.lock.yml
RGS-005	Excessive Permissions on Untrusted Trigger	Medium	9	ai-moderator.lock.yml, agentic_commands.yml, q.lock.yml
RGS-019	Step Output Interpolated in run Block	Medium	2	error-message-lint.yml, windows-cli-integration.yml

Issues created: none. All High-severity rule+file combinations were checked against GitHub issue history via gh api search/issues and every one matches a previously closed tracking issue (RGS-004/dev-hawk → #50189; RGS-012 → #35652, #30079/#30776, #50190/#28488, #30947/#28626; RGS-018 → #35653, #47478, #46532, #47477). Per the dedup rule, closed matches are skipped rather than recreated or commented on. Medium findings (RGS-005, RGS-019) remain below the Critical/High issue-creation threshold.

Grype Container Vulnerability Findings

Critical/High findings by image

Image	Critical	High
ghcr.io/github/serena-mcp-server:sha-891c160	65	387
mcp/arxiv-mcp-server	16	115
mcp/context7	10	78
mcp/memory	8	60
grafana/mcp-grafana	7	19
mcp/ast-grep:latest	6	38
ghcr.io/github/gh-aw-firewall/squid:0.27.44	0	14
ghcr.io/github/gh-aw-mcpg:v0.4.8	0	6
ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.44	0	6
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44	0	6
ghcr.io/github/gh-aw-firewall/agent:0.27.44	0	6
node:lts-alpine	1	6
ghcr.io/github/github-mcp-server:v1.8.0	1	3
python:alpine	0	3
ghcr.io/fabio-rovai/open-ontologies:latest	1	2
ghcr.io/github/gh-aw-node	0	1

Notable: google.golang.org/grpc@v1.80.0 in grafana/mcp-grafana has a fixed version available (1.82.1) for GHSA-hrxh-6v49-42gf.

Yamllint YAML Linting Findings

None.

Shellcheck Shell Linting Findings

Code	Count	Affected Workflows
SC2015	1	daily-vulnhunter-scan.lock.yml (step: Prepare VulnHunter bundle)

Top Priority Issues

1. RGS-004: Comment-Triggered Workflow Without Author Authorization Check

• Tool: runner-guard
• Count: 96 (single file, repeated pattern)
• Severity: High
• Affected: dev-hawk.lock.yml
• Description: A comment-triggered workflow path lacks an explicit author-association check before acting on untrusted input.
• Impact: Could allow an unauthorized commenter to trigger privileged automation.
• Status: Matches closed issue [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in dev-hawk.lock.yml #50189 — per the 2026-08-09 scan notes, this workflow already gates on an explicit actor allowlist rather than author_association, which is a likely detection gap in the rule rather than a missing control. No new issue created (dedup: skip).

2. RGS-012: Secret Exfiltration via Outbound HTTP Request

• Tool: runner-guard
• Count: 10 across 4 workflows
• Severity: High
• Affected: daily-byok-ollama-test.lock.yml, daily-model-inventory.lock.yml, docs-noob-tester.lock.yml, visual-regression-checker.lock.yml
• Description: run: blocks make outbound HTTP requests to non-GitHub domains in a secrets-accessible job context.
• Impact: Generic pattern for credential exfiltration; several instances here are known false positives (localhost dev-server readiness checks, public model-catalog API reads with no secret payload) per prior triage.
• Reference: matches closed issues [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in daily-byok-ollama-test.lock.yml #35652, [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in daily-model-inventory #30079/[static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in daily-model-inventory.lock.yml #30776, [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in docs-noob-tester.lock.yml #50190/[static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in docs-noob-tester #28488, [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in visual-regression-checker.lock.yml #30947/[static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in visual-regression-checker #28626.

3. Poutine untrusted_checkout_exec — RESOLVED

• Tool: poutine
• Count: 0 (was 10 on 2026-08-09)
• Affected: previously smoke-workflow-call.lock.yml, smoke-workflow-call-with-inputs.lock.yml
• Note: This finding recurred across many prior scans (Fix untrusted_checkout_exec poutine finding in smoke-workflow-call workflows #22608, [plan] Fix untrusted_checkout_exec in smoke-workflow-call workflows (Day 8 unresolved) #22248, Generate poutine untrusted_checkout_exec suppression for workflow_call save-base steps #26552, fix: add poutine:ignore untrusted_checkout_exec to all compiler bash run steps #48717, Clear recurring poutine untrusted_checkout_exec findings via .poutine.yml skip #51177) but is absent today. Worth confirming in a future scan that this is a durable fix and not scan flakiness.

Fix Suggestion for Actionlint SC2016 (shellcheck-integration)

Issue: run: blocks generated from .github/workflows/shared/crush.md build a JSON config via a single-quoted BASE_CONFIG='{ "$schema": ... }' string. Shellcheck's SC2016 flags this because $schema looks like an unexpanded shell variable, even though the literal (non-expanding) behavior is intentional here.
Severity: Low (code quality)
Affected Workflows: 3 source templates generating 6 lock-file occurrences (daily-arxiv-researcher.lock.yml, daily-code-metrics.lock.yml, smoke-crush.lock.yml)

Prompt to Copilot Agent:

You are fixing an actionlint/shellcheck SC2016 finding in a GitHub Actions workflow template.

Rule: SC2016 - (www.shellcheck.net/redacted)
File: .github/workflows/shared/crush.md

Current Issue:
The step body assigns a single-quoted string containing `$schema`:

    BASE_CONFIG='{
      "$schema": "(charm.land/redacted),
      "options": { ... }
    }'

Shellcheck warns $schema won't expand inside single quotes -- that's intentional (it's a
literal JSON key, not a shell variable), so the warning is noise that should be silenced
explicitly.

Required Fix:
Add a targeted shellcheck disable directive immediately above the assignment:

    # shellcheck disable=SC2016
    BASE_CONFIG='{
      "$schema": "(charm.land/redacted),
      ...
    }'

Apply this fix to .github/workflows/shared/crush.md, then recompile all workflows so it
propagates to daily-arxiv-researcher.lock.yml, daily-code-metrics.lock.yml, and
smoke-crush.lock.yml.

All Findings Details

Detailed Findings by Workflow

dev-hawk.lock.yml

• RGS-004 (High) x96 — matches closed [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in dev-hawk.lock.yml #50189

daily-byok-ollama-test.lock.yml

• RGS-012 (High) — matches closed [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in daily-byok-ollama-test.lock.yml #35652
• RGS-018 (High) — matches closed [static-analysis] RGS-018: Suspicious Payload Execution Pattern in daily-byok-ollama-test.lock.yml #35653

daily-model-inventory.lock.yml

• RGS-012 (High) x3 — matches closed [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in daily-model-inventory #30079/[static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in daily-model-inventory.lock.yml #30776

docs-noob-tester.lock.yml

• RGS-012 (High) — matches closed [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in docs-noob-tester.lock.yml #50190/[static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in docs-noob-tester #28488

visual-regression-checker.lock.yml

• RGS-012 (High) x2 — matches closed [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in visual-regression-checker.lock.yml #30947/[static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in visual-regression-checker #28626

daily-cli-performance.lock.yml

• RGS-018 (High) — matches closed [static-analysis] RGS-018: Suspicious Payload Execution Pattern in daily-cli-performance.lock.yml #47478

daily-sentrux-report.lock.yml

• RGS-018 (High) — matches closed [static-analysis] RGS-018: Suspicious Payload Execution Pattern in daily-sentrux-report.lock.yml #46532

smoke-claude.lock.yml

• RGS-018 (High) — matches closed [static-analysis] RGS-018: Suspicious Payload Execution Pattern in smoke-claude.lock.yml #47477

ai-moderator.lock.yml, agentic_commands.yml, q.lock.yml

• RGS-005 (Medium) x9 total — new, below issue-creation threshold

error-message-lint.yml, windows-cli-integration.yml

• RGS-019 (Medium) x2 — new, below issue-creation threshold

daily-arxiv-researcher.lock.yml, daily-code-metrics.lock.yml, smoke-crush.lock.yml

• actionlint SC2016 x2 each — see fix suggestion above

daily-vulnhunter-scan.lock.yml

• shellcheck SC2015 (step: Prepare VulnHunter bundle)

smoke-copilot-arm.lock.yml

• zizmor pr_runs_on_self_hosted (warning)

super-linter.lock.yml, smoke-codex.lock.yml, mcp-inspector.lock.yml, dataflow-pr-discussion-dataset.lock.yml, hippo-embed.lock.yml, copilot-setup-steps.yml, daily-elixir-credo-snippet-audit.lock.yml, link-check.yml (x2)

• zizmor github_action_from_unverified_creator_used (note, already acknowledged via zizmor:ignore comments)

Historical Trends

• Previous Scan: 2026-08-09
• Total Findings Then: 121 static + 2497 grype = 2618
• Total Findings Now: 121 static + 2623 grype = 2744
• Change: +126 (+4.8%), entirely from grype (new upstream CVEs against unchanged image digests)

New Issues

None. RGS-005 and RGS-019 were already flagged as "new" yesterday and remain unchanged in count today.

Resolved Issues

• poutine untrusted_checkout_exec: fully resolved (10 → 0). Previously recurring since at least Fix untrusted_checkout_exec poutine finding in smoke-workflow-call workflows #22608. Affected smoke-workflow-call.lock.yml and smoke-workflow-call-with-inputs.lock.yml.

Recommendations

1. Immediate: No new Critical/High security issues to action — all runner-guard High findings match already-triaged closed issues. Confirm the poutine fix is durable on the next scan.
2. Short-term: Apply the SC2016 shellcheck-disable fix to .github/workflows/shared/crush.md (6 occurrences, low effort). Consider upgrading google.golang.org/grpc in the grafana/mcp-grafana image (fix available: 1.82.1) to close GHSA-hrxh-6v49-42gf.
3. Long-term: Runner-guard has no inline ignore-comment mechanism (unlike zizmor/poutine), so closed tracking issues don't stop re-detection. Consider a persistent .runnerguard-ignore allowlist or extending the dedup logic to suppress re-alerting when code is unchanged since issue close (see cache-memory vulnerabilities/trends.json).
4. Prevention: Continue reviewing new MCP server container images (e.g. serena-mcp-server) for CVE exposure before adoption — it accounts for 65 of 115 total critical grype findings across the fleet.

Next Steps

• Apply SC2016 shellcheck-disable fix to .github/workflows/shared/crush.md
• Verify poutine untrusted_checkout_exec resolution holds on next scan
• Evaluate grpc upgrade for grafana/mcp-grafana (GHSA-hrxh-6v49-42gf, fix: 1.82.1)
• Consider a persistent runner-guard ignore/allowlist mechanism to stop recurring alerts on closed-and-accepted findings
• Review RGS-005/RGS-019 medium findings for validity (currently below auto-issue threshold)

References:

• §31357638046
• §31295669837

Generated by 📊 Static Analysis Report · agent · 127.2 AIC · ⌖ 36.7 AIC · ⊞ 11K · ◷

• expires on Aug 16, 2026, 9:44 PM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I have identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 4.4 AIC · ⌖ 4.21 AIC · ⊞ 10.9K · ◷