[static-analysis] Report - 2026-07-20

[github-actions]

🔍 Static Analysis Report - 2026-07-20

Analysis Summary

• Tools Used: zizmor, poutine, actionlint, runner-guard
• Total Findings: 469
• Workflows Scanned: 258
• Workflows Affected: ~80 (mostly generated .lock.yml files)
• Net change vs 2026-07-19: 0 — totals are identical across all four tools.

Findings by Tool

Tool	Total	Critical	High	Medium	Low/Info
zizmor (security)	0	0	0	0	0
poutine (supply chain)	20	0	10	1	9
actionlint (linting)	114	-	-	-	-
runner-guard (taint analysis)	335	0	324	11	0

⚠️ zizmor anomaly: the compile output contains only the Running zizmor security scanner on 258 files banner with no findings or summary before the poutine banner. This is a recurring capture anomaly (historical zizmor counts were ~72, once 919). Treated as 0 captured, not a verified clean result.

Clustered Findings by Tool and Type

Runner-Guard Taint Analysis Findings

Runner-Guard Score: not emitted in this run's output.

Rule ID	Name	Severity	Count	Affected Workflows
RGS-004	Comment-Triggered Workflow Without Author Authorization Check	high	310	q (124), dev-hawk (94), ai-moderator (92)
RGS-012	Secret Exfiltration via Outbound HTTP Request	high	10	daily-model-inventory (4), visual-regression-checker (2), daily-byok-ollama-test (2), docs-noob-tester (1), daily-multi-device-docs-tester (1)
RGS-018	Suspicious Payload Execution Pattern	high	4	smoke-claude, daily-sentrux-report, daily-cli-performance, daily-byok-ollama-test
RGS-005	Excessive Permissions on Untrusted Trigger	medium	8	ai-moderator (4), q (3), agentic_commands (1)
RGS-019	Step Output Interpolated in run Block	medium	2	windows-cli-integration, error-message-lint
RGS-007	Unpinned Third-Party Action Using Mutable Tag	medium	1	publish-safe-outputs-node

Issues created: none. All high-severity runner-guard findings are unchanged from 2026-07-19 and each maps to a closed issue for the same rule+file, or is an established framework false-positive (see Runner-Guard Analysis below).

Actionlint Linting Issues (114)

Issue Type	Count	Notes
[expression] undefined secret_verification_result	69	Real codegen regression — if: references an undeclared needs.*.outputs field (69 distinct workflows)
[shellcheck] SC2016 (expressions in single quotes)	25
[shellcheck] SC2086 (unquoted variable)	7
[shellcheck] SC2038 (find/xargs)	6
[shellcheck] SC2034 / SC2005 / SC2129 / SC2188 / SC2327 / SC2328	6	2 + 1×4

Poutine Supply Chain Findings (20)

Rule ID	Severity	Count	Affected Workflows
untrusted_checkout_exec	error (high)	10	smoke-workflow-call.lock.yml (5), smoke-workflow-call-with-inputs.lock.yml (5)
github_action_from_unverified_creator_used	note (info)	9	link-check (2), copilot-setup-steps, daily-elixir-credo-snippet-audit, dataflow-pr-discussion-dataset, hippo-embed, mcp-inspector, smoke-codex, super-linter
pr_runs_on_self_hosted	warning (medium)	1	smoke-copilot-arm.lock.yml

Zizmor Security Findings

No findings captured (see anomaly note above).

Top Priority Issues

1. actionlint [expression] — undefined secret_verification_result (real, actionable)

• Tool: actionlint
• Count: 69 workflows
• Severity: error
• Description: Generated .lock.yml jobs contain an if: guard referencing needs.<job>.outputs.secret_verification_result, but the producing job never declares that output. actionlint statically resolves the needs.*.outputs object type and flags the property as undefined.
• Impact: A dangling output reference in an if: condition. Because the output is undefined, the expression evaluates to empty — the guard may not behave as intended, and it signals a compiler codegen defect. This is the only high-count finding that is a genuine, fixable bug in this scan.
• Reference: https://github.com/rhysd/actionlint/blob/main/docs/checks.md#check-syntax-expression
• Note: This is a compiler codegen bug in gh-aw, not a per-workflow authoring error — fix belongs in the generator, then recompile. Tracked previously as [static-analysis] actionlint [expression] regression: undefined secret_verification_result output in 69 workflows #44870 (closed).

2. RGS-004 — Comment-Triggered Workflow Without Author Authorization (310, framework FP)

• Tool: runner-guard | Severity: high | Affected: q, dev-hawk, ai-moderator
• Assessment: Known framework false-positive. gh-aw compiles a centralized author_association guard into the pre_activation job (see closed fix fix(rgs-004): add author_association guard to pre_activation jobs for comment-triggered workflows #29481); runner-guard scans each downstream job's generated block in isolation and cannot see the centralized guard. Covered by closed umbrella issues [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in 16 workflows #28156 / [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in 16 workflows #29694 / [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check (16 workflows) #30284.

Fix Suggestion for actionlint [expression] secret_verification_result

Issue: if: conditions reference an undeclared job output secret_verification_result
Severity: error (expression)
Affected Workflows: 69 generated .lock.yml files

Prompt to Copilot Agent:

You are fixing a code generation bug in the gh-aw compiler that produces
invalid GitHub Actions workflows flagged by actionlint:

  error: [expression] property "secret_verification_result" is not defined
  in object type {...}   (in an `if:` condition)

The generated `.lock.yml` job has an `if:` guard referencing
`needs.<job>.outputs.secret_verification_result`, but the producing job never
declares that output. Fix the Go generator in pkg/workflow (search for
"secret_verification_result" and for where the consuming job's `if:` is emitted).

Do EITHER of the following consistently:
  1. Declare the output on the producing job:
       outputs:
         secret_verification_result: ${{ steps.<step>.outputs.result }}
     and set it in the step that performs secret verification; OR
  2. If secret verification was intentionally removed, delete the dangling
     `if:` reference from the consuming job.

Then recompile all workflows and confirm actionlint reports 0 [expression]
errors:
  <compile> 2>&1 | grep -c 'secret_verification_result'   # must be 0

Do not hand-edit individual .lock.yml files — they are generated. Fix the
generator, regenerate, and add a compiler unit test asserting that any emitted
`needs.*.outputs.secret_verification_result` reference has a matching `outputs:`
declaration.

Runner-Guard Analysis

Runner-guard produced 335 findings (324 high, 11 medium) — identical to 2026-07-19. Per the deduplication policy (skip closed same-rule+file issues; comment on open ones; create only genuinely new findings), 0 issues were created and 0 comments added this run:

Per-finding dedup decisions

• RGS-004 (q / dev-hawk / ai-moderator): closed umbrella issues [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in 16 workflows #28156, [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in 16 workflows #29694, [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check (16 workflows) #30284 + known framework false-positive (centralized author_association guard in pre_activation, fix fix(rgs-004): add author_association guard to pre_activation jobs for comment-triggered workflows #29481). → skip
• RGS-012 (all 5 files): closed issues [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in daily-model-inventory #30079/[static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in daily-model-inventory.lock.yml #30776 (daily-model-inventory), [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in visual-regression-checker.lock.yml #30947/[static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in visual-regression-checker #28626 (visual-regression-checker), [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in daily-byok-ollama-test.lock.yml #35652 (daily-byok-ollama-test), [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in docs-noob-tester #28488 (docs-noob-tester), [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in daily-multi-device-docs-tester.lock.yml #33477 (daily-multi-device-docs-tester). → skip
• RGS-018 / daily-sentrux-report: closed [static-analysis] RGS-018: Suspicious Payload Execution Pattern in daily-sentrux-report.lock.yml #46532 (created 2026-07-19) + fix PR fix: pin SHA-256 checksum for sentrux binary install (RGS-018) #46555. → skip
• RGS-018 / daily-byok-ollama-test: closed [static-analysis] RGS-018: Suspicious Payload Execution Pattern in daily-byok-ollama-test.lock.yml #35653. → skip
• RGS-018 / smoke-claude & daily-cli-performance: framework MCP-scaffolding false-positive — the flagged run: block is require('${{ runner.temp }}/gh-aw/actions/generate_safe_outputs_tools.cjs'); await main(); (compiler-generated "Write MCP Scripts Config" step), not an obfuscated payload. → skip
• No open RGS file-specific issues exist, so no comments were warranted.

Framework-level dedup for these recurring RGS-* findings is already tracked by closed issues #31043 and #31254.

All Findings Details

Actionlint — 69 workflows with undefined secret_verification_result (sample)

ab-testing-advisor, agent-performance-analyzer, archie, architecture-guardian, artifacts-summary, auto-triage-issues, brave, breaking-change-checker, ci-coach, cli-consistency-checker, code-scanning-fixer, copilot-centralization-drilldown, ... (69 total, all generated .lock.yml)

Each occurrence is an if: guard at column ~241 referencing needs.<job>.outputs.secret_verification_result.

Poutine untrusted_checkout_exec (10, suppressed pattern)

• smoke-workflow-call.lock.yml: lines 318, 333, 348, 456, 461
• smoke-workflow-call-with-inputs.lock.yml: lines 315, 330, 345, 456, 461

These sit next to # poutine:ignore untrusted_checkout_exec suppression comments in the generated smoke-test workflows and are compiler-generated save_base_github_folders.sh steps — expected in these call-target smoke tests.

Historical Trends

Date	zizmor	poutine	actionlint	runner-guard	Total
2026-07-16	n/a	20	112	335	—
2026-07-17	n/a	20	113	335	—
2026-07-18	0	20	113	335	468
2026-07-19	0	20	114	335	469
2026-07-20	0	20	114	335	469

• Change vs previous scan: 0 (identical across all tools).
• New issue types: none.
• Resolved issue types: none.
• Actionlint has been slowly creeping up (109 → 114 over the past week), driven by the stable 69 secret_verification_result regression plus incremental shellcheck SC2016 additions.

Recommendations

1. Immediate: No new Critical/High actionable security issues — all high runner-guard findings are closed-dup or framework false-positives.
2. Short-term: Fix the actionlint secret_verification_result codegen regression in the gh-aw generator (69 workflows). This is the single highest-value real fix and reopens the pattern from closed [static-analysis] actionlint [expression] regression: undefined secret_verification_result output in 69 workflows #44870.
3. Long-term: Suppress/annotate the recurring framework false-positives (RGS-004 pre_activation guard, RGS-018 MCP-scaffolding require) in runner-guard config so real findings aren't buried under ~300 known-benign alerts.
4. Prevention: Add a compiler unit test asserting every emitted needs.*.outputs.* reference has a matching outputs: declaration.

Next Steps

• Fix the secret_verification_result codegen regression in pkg/workflow and recompile (target: 0 [expression] errors).
• Consider a runner-guard allowlist for the RGS-004 pre_activation and RGS-018 generate_safe_outputs_tools.cjs framework patterns.
• Address remaining shellcheck SC2016/SC2086 in generated templates.
• Continue daily dedup-by-rule+file to avoid recreating closed RGS-* issues ([deep-report] Static-analysis RGS-* security issues recreated daily after closure (no dedup-by-rule) #31043 / fix(static-analysis): stop recreating closed RGS-* issues daily — dedup by rule+file across open and closed states #31254).

References:

• §29720019343

Generated by 📊 Static Analysis Report · 318 AIC · ⌖ 35.3 AIC · ⊞ 10K · ◷

• expires on Jul 26, 2026, 10:03 PM UTC-08:00

[github-actions]

This issue is being closed as outdated. A newer issue has been created: #46985

View newer issue

---

This action was performed automatically by the Static Analysis Report workflow.