[static-analysis] Report - 2026-06-12

[github-actions]

🔍 Static Analysis Report - 2026-06-12

Analysis Summary

• Tools: zizmor, poutine, actionlint, runner-guard v2.6.0
• Total Findings: 1931 — Workflows Scanned: 246 — RG-affected: 17
• Status: ⚠️ Stable, ~identical to 2026-06-11 (+5, all lock-file churn)
• New issues this run: 0 — every High runner-guard finding maps to an already‐closed issue (see Runner-Guard Analysis)

Tool	Total	Crit	High	Med	Low	Info
zizmor	539	0	1	2	31	505
poutine	24	0	0	0	1w	23
actionlint	1052	-	-	-	-	-
runner-guard	316	0	305	11	0	-

Clustered Findings

Zizmor

Type	Sev	Count	Where
template-injection	Info	504	~245 lock files (Copilot CLI step)
obfuscation	Low	28	28 lock files
template-injection	Low	3	few lock files
github-env	High	1	dev-hawk.lock.yml:1718
excessive-permissions	Med	1	dependabot-repair.lock.yml:380
artipacked	Med	1	daily-geo-optimizer.lock.yml:1518
superfluous-actions	Info	1	smoke-codex.lock.yml:2208

Poutine

Type	Sev	Count	Where
untrusted_checkout_exec	error	12	dependabot-worker, smoke-workflow-call(-with-inputs)
unverified_creator_action	note	8	copilot-setup-steps, dataflow-pr-dataset, hippo-embed, link-check, mcp-inspector, smoke-codex, super-linter
unverified_script_exec	note	3	daily-byok-ollama-test, copilot-setup-steps, smoke-codex
pr_runs_on_self_hosted	warn	1	smoke-copilot-arm

Actionlint

Type	Count
shellcheck	506
syntax-check	407
permissions	117
expression	22

Runner-Guard

Rule	Name	Sev	Count	Where
RGS-004	Comment-trigger w/o author auth	High	289	q(118), dev-hawk(87), ai-moderator(84)
RGS-012	Secret exfil via outbound HTTP	High	10	daily-model-inventory, visual-regression-checker, daily-byok-ollama-test, docs-noob-tester, daily-multi-device-docs-tester
RGS-018	Suspicious payload exec	High	6	smoke-codex, smoke-claude, daily-sentrux-report, daily-cli-performance, daily-byok-ollama-test, copilot-setup-steps
RGS-005	(medium)	Med	8	ai-moderator, q, agentic_commands
RGS-019	(medium)	Med	2	error-message-lint, windows-cli-integration
RGS-007	Unpinned mutable tag	Med	1	aoai-endpoint-smoke-test (azure/login@v2)

Top Priority

1. RGS-004 (High, 289) — q/dev-hawk/ai-moderator. The count = one hit per step of the privileged job (118/87/84). These command workflows already gate on a Check team membership step, so likely false positives. Closed previously in bulk [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in 16 workflows #29694.
2. zizmor github-env (High) — dev-hawk.lock.yml:1718, dangerous $GITHUB_ENV use. Confirm value is not attacker-controlled.
3. poutine untrusted_checkout_exec (error, 12) — dependabot-worker / smoke-workflow-call: verify trusted-only execution.

Fix Suggestion — actionlint permissions (117)

Jobs declare toolsets needing a permissions: scope absent from frontmatter (e.g. designer-drift-audit missing pull-requests: read). Findings are in generated .lock.yml; fix the source .md then recompile.

Prompt to Copilot Agent:

Fix actionlint "permissions" errors in gh-aw workflows. A job uses a GitHub toolset/action requiring a token scope (e.g. pull-requests: read) not declared in the source .md frontmatter. For each flagged workflow: open .github/workflows/<name>.md, read the missing-permission message, add the scope under permissions: (or drop the unused toolset), then run gh aw compile.

Before: permissions: {contents: read} + toolset [pull_requests].
After: add pull-requests: read # required by pull_requests.
Start with designer-drift-audit.

Runner-Guard Analysis

316 findings (305 High, 11 Med). High findings cluster into RGS-004/012/018 over the same files as 2026-06-10/11; no new rule+file combos. Every High rule+file maps to an already‐closed static-analysis issue (verified via GitHub search):

• RGS-004 (q, dev-hawk, ai-moderator) → closed bulk [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in 16 workflows #29694 (lists all three) + [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check #29883/[static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check (16 workflows) #30284/[static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check #30077.
• RGS-012 (5 files) → closed [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in daily-byok-ollama-test.lock.yml #35652/[static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in daily-multi-device-docs-tester.lock.yml #33477/[static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in daily-model-inventory #30079/[static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in daily-model-inventory.lock.yml #30776/[static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in visual-regression-checker.lock.yml #30947/[static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in docs/visual workflows #29885.
• RGS-018 (6 files) → closed [static-analysis] RGS-018: Suspicious Payload Execution Pattern in copilot-setup-steps.yml #33476/[static-analysis] RGS-018: Suspicious Payload Execution Pattern in daily-byok-ollama-test.lock.yml #35653/[static-analysis] RGS-018: Suspicious Payload Execution Pattern (34 workflows) #30532/[static-analysis] RGS-018: Suspicious Payload Execution Pattern in multiple workflows #30078/[static-analysis] RGS-018: Suspicious Payload Execution Pattern in multiple workflows #30777 (bulk issues list all six).

Per dedup policy (closed rule+file ⇒ skip), 0 new issues, 0 comments. No matching open finding issues exist to comment on; only open static-analysis issue is yesterday's report #38525.

Historical Trends

Previous 2026-06-11: 1926 → This 2026-06-12: 1931 (+5, +0.3%).

Tool	06-11	06-12	Δ
zizmor	537	539	+2
poutine	24	24	0
actionlint	1049	1052	+3
runner-guard	316	316	0

New issue types: none. Resolved: none. The +5 delta is lock-file churn from one extra workflow scanned (245→246).

Recommendations

1. Immediate: None blocking; High RG findings are reviewed/closed. Confirm zizmor github-env in dev-hawk.
2. Short-term: Fix the 117 actionlint permissions errors in source .md (start: designer-drift-audit).
3. Medium-term: SHA-pin azure/login@v2 (RGS-007); review poutine untrusted_checkout_exec.
4. Long-term: Allowlist recurring RGS-004 / template-injection noise on generated lock files so new findings stand out (3+ days of identical closed-issue churn).

References: §27398233353 · prior report #38525

Generated by 📊 Static Analysis Report · 263.1 AIC · ⌖ 26.1 AIC · ⊞ 10K · ◷

• expires on Jun 18, 2026, 10:25 PM UTC-08:00

[github-actions]

This issue is being closed as outdated. A newer issue has been created: #39025

View newer issue

---

This action was performed automatically by the Static Analysis Report workflow.