🚨 Runner-Guard Security Finding
Rule: RGS-004 — Comment-Triggered Workflow Without Author Authorization Check
Severity: High
File: .github/workflows/dev-hawk.lock.yml
Line: 123 (and 95 other steps across the same compiled job)
Description
A workflow is triggered by issue_comment, pull_request_review_comment, or workflow_run events and accesses secrets or has write permissions, but does not verify the comment author's authorization level before executing privileged operations. The workflow_run trigger is dangerous when it runs after a workflow that can itself be triggered by forks, because it inherits base-repo context/secrets while depending on an event that may originate from untrusted input.
Impact
dev-hawk.md triggers on workflow_run (workflows: Dev, types: completed, branches: copilot/*) gated further by if: github.event.workflow_run.event == 'workflow_dispatch', and has safe-outputs.add-comment (writes PR comments) plus copilot-requests: write. There is no explicit check on who dispatched the upstream Dev run or on github.actor/author association before the analysis-and-comment steps execute. If the upstream Dev workflow can be workflow_dispatch-triggered by non-maintainers (e.g. any repo collaborator with actions:write, or a workflow_dispatch input abused via a compromised branch), this workflow will run and post a comment without further authorization checks.
Remediation
- Add an explicit authorization check (e.g. verify
github.event.workflow_run.actor.login or the triggering user's association) before the analysis/comment steps run, mirroring the pattern used in other gh-aw workflows (e.g. q.md which restricts via roles: [admin, maintainer, write]).
- Alternatively, add
roles: / skip-author-associations: restrictions to dev-hawk.md's on: frontmatter so the compiler emits the gating job automatically, consistent with ai-moderator.md's pattern.
- Confirm which principals can dispatch the
Dev workflow on copilot/* branches, and restrict if broader than intended.
Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/30881086944
Generated by 📊 Static Analysis Report · agent · 216.2 AIC · ⌖ 39.2 AIC · ⊞ 5.7K · ◷
🚨 Runner-Guard Security Finding
Rule: RGS-004 — Comment-Triggered Workflow Without Author Authorization Check
Severity: High
File:
.github/workflows/dev-hawk.lock.ymlLine: 123 (and 95 other steps across the same compiled job)
Description
A workflow is triggered by
issue_comment,pull_request_review_comment, orworkflow_runevents and accesses secrets or has write permissions, but does not verify the comment author's authorization level before executing privileged operations. Theworkflow_runtrigger is dangerous when it runs after a workflow that can itself be triggered by forks, because it inherits base-repo context/secrets while depending on an event that may originate from untrusted input.Impact
dev-hawk.mdtriggers onworkflow_run(workflows:Dev, types:completed, branches:copilot/*) gated further byif: github.event.workflow_run.event == 'workflow_dispatch', and hassafe-outputs.add-comment(writes PR comments) pluscopilot-requests: write. There is no explicit check on who dispatched the upstreamDevrun or ongithub.actor/author association before the analysis-and-comment steps execute. If the upstreamDevworkflow can beworkflow_dispatch-triggered by non-maintainers (e.g. any repo collaborator with actions:write, or a workflow_dispatch input abused via a compromised branch), this workflow will run and post a comment without further authorization checks.Remediation
github.event.workflow_run.actor.loginor the triggering user's association) before the analysis/comment steps run, mirroring the pattern used in other gh-aw workflows (e.g.q.mdwhich restricts viaroles: [admin, maintainer, write]).roles:/skip-author-associations:restrictions todev-hawk.md'son:frontmatter so the compiler emits the gating job automatically, consistent withai-moderator.md's pattern.Devworkflow oncopilot/*branches, and restrict if broader than intended.Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/30881086944