[static-analysis] Report - 2026-08-09

### Analysis Summary

- **Tools Used**: zizmor, poutine, actionlint, runner-guard, syft, grype, yamllint, shellcheck
- **Workflows Scanned**: 284 (284 compiled successfully, 193 with warnings)
- **Static Findings** (zizmor+poutine+actionlint+runner-guard+yamllint+shellcheck): 138
- **Container Vulnerability Findings** (grype): 2,497 across 16 images
- **New GitHub Issues Created Today**: 0 (see [Runner-Guard Analysis](#runner-guard-analysis))

#### Findings by Tool

| Tool | Total | Critical | High | Medium | Low |
|------|-------|----------|------|--------|-----|
| zizmor (security) | 10 | 0 | 0 | 0 | 0 (9 note, 1 warning) |
| poutine (supply chain) | 10 | 0 | 10 (error) | 0 | 0 |
| actionlint (linting) | 6 | - | - | - | - |
| runner-guard (taint analysis) | 121 | 0 | 111 | 10 | 0 |
| syft (SBOM inventory) | 16 images / 5,344 packages | - | - | - | - |
| grype (container CVEs) | 2,497 | 112 | 705 | 1,070 | 247 (+294 negligible, 69 unknown) |
| yamllint (yaml linting) | 0 | - | - | - | - |
| shellcheck (shell linting) | 1 | - | - | - | - |

### Clustered Findings by Tool and Type

#### Zizmor Security Findings

| Issue Type | Severity | Count | Affected Workflows |
|------------|----------|-------|-------------------|
| `github_action_from_unverified_creator_used` | note (info) | 9 | smoke-codex, daily-elixir-credo-snippet-audit, hippo-embed, super-linter, mcp-inspector, copilot-setup-steps.yml, link-check.yml (×2), dataflow-pr-discussion-dataset |
| `pr_runs_on_self_hosted` | warning | 1 | smoke-copilot-arm |

All 9 unverified-creator findings already carry a `# zizmor: ignore[...]` comment in source — these are acknowledged/accepted, shown for visibility only.

#### Poutine Supply Chain Findings

| Issue Type | Severity | Count | Affected Workflows |
|------------|----------|-------|-------------------|
| `untrusted_checkout_exec` | error | 10 | smoke-workflow-call.lock.yml (5), smoke-workflow-call-with-inputs.lock.yml (5) |

Unlike every other lock file that runs the same shared scripts (`save_base_github_folders.sh`, `create_prompt_first.sh`, etc.), these two files are **missing** the `# poutine:ignore untrusted_checkout_exec` comment that suppresses the finding elsewhere. See [Fix Suggestion](#fix-suggestion) below.

#### Actionlint Linting Issues

| Issue Type | Count | Affected Workflows |
|------------|-------|-------------------|
| SC2016 (shellcheck-integration: expressions don't expand in single quotes) | 6 | daily-arxiv-researcher.lock.yml (×2), daily-code-metrics.lock.yml (×2), smoke-crush.lock.yml (×2) |

#### Syft SBOM Inventory

<details>
<summary><b>16 container images / 5,344 packages</b></summary>

| Image | Packages |
|-------|----------|
| serena-mcp-server:sha-891c160 | 2,314 |
| gh-aw-firewall/agent:0.27.44 | 532 |
| gh-aw-firewall/cli-proxy:0.27.44 | 348 |
| mcp/context7 | 329 |
| gh-aw-mcpg:v0.4.8 | 286 |
| grafana/mcp-grafana | 252 |
| mcp/memory | 253 |
| gh-aw-firewall/api-proxy:0.27.44 | 193 |
| gh-aw-node | 177 |
| mcp/ast-grep:latest | 186 |
| mcp/arxiv-mcp-server | 168 |
| node:lts-alpine | 165 |
| gh-aw-firewall/squid:0.27.44 | 63 |
| github-mcp-server:v1.8.0 | 40 |
| python:alpine | 38 |
| open-ontologies:latest | 10 |

</details>

#### Runner-Guard Taint Analysis Findings

No aggregate Runner-Guard Score/Grade was emitted in this run's output.

| Rule ID | Name | Severity | Count | Affected Workflows |
|---------|------|----------|-------|--------------------|
| RGS-004 | Comment-Triggered Workflow Without Author Authorization Check | High | 96* | dev-hawk.lock.yml |
| RGS-012 | Secret Exfiltration via Outbound HTTP Request | High | 10 | daily-byok-ollama-test, daily-model-inventory (×3), docs-noob-tester, visual-regression-checker (×2) |
| RGS-018 | Suspicious Payload Execution Pattern | High | 4 | daily-byok-ollama-test, daily-cli-performance, daily-sentrux-report, smoke-claude |
| RGS-005 | Excessive Permissions on Untrusted Trigger | Medium | 9 | ai-moderator.lock.yml, agentic_commands.yml, q.lock.yml |
| RGS-019 | Step Output Interpolated in run Block | Medium | 2 | error-message-lint.yml, windows-cli-integration.yml |

\* RGS-004's 96 hits are one systemic finding — the scanner flags every step in dev-hawk.lock.yml's `workflow_run`-triggered job, not 96 distinct issues.

Issues created: **none** — see [Runner-Guard Analysis](#runner-guard-analysis).

#### Grype Container Vulnerability Findings

<details>
<summary><b>Critical/High findings by image</b></summary>

| Image | Critical | High | Packages |
|-------|----------|------|----------|
| serena-mcp-server:sha-891c160 | 65 | 387 | 2,314 |
| mcp/arxiv-mcp-server | 16 | 115 | 168 |
| mcp/context7 | 10 | 78 | 329 |
| mcp/memory | 8 | 60 | 253 |
| grafana/mcp-grafana | 7 | 19 | 252 |
| mcp/ast-grep:latest | 6 | 38 | 186 |
| gh-aw-firewall/squid:0.27.44 | 0 | 14 | 63 |
| github-mcp-server:v1.8.0 | 1 | 3 | 40 |
| node:lts-alpine | 1 | 6 | 165 |
| open-ontologies:latest | 1 | 2 | 10 |
| gh-aw-mcpg / cli-proxy / api-proxy / agent / gh-aw-node / python:alpine | 0 | ≤6 each | — |

</details>

`serena-mcp-server:sha-891c160` alone accounts for 58% of all Critical findings and 55% of all High findings, driven by an outdated Debian/Node base layer (libc6, openssl, perl, node-undici, handlebars, golang runtime, etc. — sample CVEs: CVE-2026-5450, CVE-2025-55130, CVE-2026-31789, CVE-2026-33937). It is referenced by 24 workflows (see cache memory `vulnerabilities/by-workflow.json`).

#### Yamllint YAML Linting Findings

None — 0 findings across 284 files.

#### Shellcheck Shell Linting Findings

| Code | Count | Affected Workflows |
|------|-------|---------------------|
| SC2015 (`A && B \|\| C` is not if-then-else) | 1 | daily-vulnhunter-scan.lock.yml |

### Top Priority Issues

#### 1. serena-mcp-server container image is critically out of date
- **Tool**: grype
- **Count**: 65 Critical + 387 High (452 of 2,497 total findings from one image)
- **Severity**: Critical
- **Affected**: 24 workflows referencing `ghcr.io/github/serena-mcp-server:sha-891c160`
- **Description**: The pinned digest carries a Debian/Node base with dozens of unpatched CVEs (openssl, perl, libgnutls, node-undici, handlebars, golang toolchain).
- **Impact**: Any workflow using this MCP server inherits its full vulnerable surface; a compromised dependency here has broad blast radius given how widely the image is reused.
- **Reference**: https://github.com/oras-project/oras — track upstream `serena-mcp-server` releases and re-pin to a newer digest.

#### 2. Poutine `untrusted_checkout_exec` unresolved in 2 smoke workflows
- **Tool**: poutine
- **Count**: 10 (across smoke-workflow-call.lock.yml, smoke-workflow-call-with-inputs.lock.yml)
- **Severity**: Error
- **Affected**: smoke-workflow-call.lock.yml, smoke-workflow-call-with-inputs.lock.yml
- **Description**: These generated files are missing the `# poutine:ignore untrusted_checkout_exec` annotation that every sibling lock file carries for the same shared scripts.
- **Impact**: Noise/signal degradation — same finding has been opened and closed at least 5 times (#22608, #22248, #26552, #48717, #51177) without a durable fix in the generator.
- **Reference**: https://github.com/boostsecurityio/poutine/blob/main/docs/rules/untrusted_checkout_exec.md

#### 3. Runner-Guard findings recur despite closed tracking issues
- **Tool**: runner-guard
- **Count**: 111 High findings (RGS-004 ×96 in one job, RGS-012 ×10, RGS-018 ×4)
- **Severity**: High
- **Affected**: dev-hawk.lock.yml, daily-byok-ollama-test, daily-model-inventory, docs-noob-tester, visual-regression-checker, daily-cli-performance, daily-sentrux-report, smoke-claude
- **Description**: Every one of these rule+file combinations matches a **previously closed** GitHub issue — closing the issue did not stop the finding from resurfacing, because runner-guard (unlike zizmor/poutine) has no inline ignore-comment mechanism.
- **Impact**: Alert fatigue; genuine new findings risk being lost in a sea of re-flagged, already-triaged ones. Several appear to be false positives (see below).
- **Reference**: https://github.com/Vigilant-LLC/runner-guard

### Fix Suggestion for poutine `untrusted_checkout_exec`

**Issue**: Two generated smoke-test lock files execute shared gh-aw action scripts via bare `bash` without the `# poutine:ignore untrusted_checkout_exec` annotation used everywhere else.
**Severity**: Error
**Affected Workflows**: 2 workflows, 10 findings

**Prompt to Copilot Agent**:
```
You are fixing a recurring security lint finding from poutine.

**Vulnerability**: untrusted_checkout_exec — poutine flags `run: bash "$RUNNER_TEMP/gh-aw/actions/<script>.sh"`
steps that could theoretically execute code from an untrusted checkout.
**Rule**: untrusted_checkout_exec - https://github.com/boostsecurityio/poutine/blob/main/docs/rules/untrusted_checkout_exec.md

**Current Issue**:
`.github/workflows/smoke-workflow-call.lock.yml` and `.github/workflows/smoke-workflow-call-with-inputs.lock.yml`
each have 5 steps invoking shared scripts (save_base_github_folders.sh, log_runtime_features_summary.sh,
create_prompt_first.sh, validate_prompt_placeholders.sh, print_prompt_summary.sh) without the
`# poutine:ignore untrusted_checkout_exec` comment that every other generated lock file uses for the
identical scripts. This exact finding has been closed and reopened at least 5 times (#22608, #22248,
#26552, #48717, #51177) because the fix was never applied to the workflow_call code generation path.

**Required Fix**:
1. Locate the compiler code path that generates steps for the `workflow_call` trigger (search for the
   step names "Log runtime features", "Create prompt with built-in context", "Validate prompt
   placeholders", "Print prompt summary", or the literal "save_base_github_folders.sh").
2. Add the missing `# poutine:ignore untrusted_checkout_exec` comment line immediately before each
   `bash "${RUNNER_TEMP}/gh-aw/actions/*.sh"` invocation, matching the pattern already used by every
   other trigger path.

**Example**:
Before:
```yaml
      - name: Create prompt with built-in context
        env:
          GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
        run: |
          bash "${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh"
```

After:
```yaml
      - name: Create prompt with built-in context
        env:
          GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
        run: |
          # poutine:ignore untrusted_checkout_exec
          bash "${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh"
```

3. Recompile all workflows and confirm both smoke-workflow-call lock files regenerate with the ignore
   comment on all 5 flagged steps.
4. Do not hand-edit the `.lock.yml` files — fix the generator/template so this survives future compiles.

Please apply this fix to: smoke-workflow-call.lock.yml, smoke-workflow-call-with-inputs.lock.yml.
```

### Runner-Guard Analysis

Dedup check performed for every High/Critical runner-guard finding (rule ID + affected file), searching both open and closed issues:

| Rule + File | Existing Issue | Action Taken |
|---|---|---|
| RGS-004 — dev-hawk.lock.yml | #50189 (closed) | Skipped (per policy: closed issue → no recreate) |
| RGS-012 — daily-byok-ollama-test.lock.yml | #35652 (closed) | Skipped |
| RGS-012 — daily-model-inventory.lock.yml | #30079, #30776 (closed) | Skipped |
| RGS-012 — docs-noob-tester.lock.yml | #50190, #28488, #29462 (closed) | Skipped |
| RGS-012 — visual-regression-checker.lock.yml | #30947, #28626, #29462 (closed) | Skipped |
| RGS-018 — daily-byok-ollama-test.lock.yml | #35653 (closed) | Skipped |
| RGS-018 — daily-cli-performance.lock.yml | #47478 (closed) | Skipped |
| RGS-018 — daily-sentrux-report.lock.yml | #46532 (closed) | Skipped |
| RGS-018 — smoke-claude.lock.yml | #47477 (closed) | Skipped |

**No new issues created.** RGS-005 and RGS-019 findings are new (no prior issue found) but are Medium severity, below this workflow's Critical/High issue-creation threshold, so they're reported here only.

Notable likely false positives worth re-reviewing on the closed issues rather than reopening blind:
- **RGS-012** on docs-noob-tester, visual-regression-checker, and 2 of 3 daily-byok-ollama-test hits: the flagged `curl`/readiness-wait commands target `(localhost/redacted) (waiting for a locally-started dev server), not an external exfiltration endpoint.
- **RGS-012** on daily-model-inventory.lock.yml (×3): the flagged commands are unauthenticated GET requests to public model-catalog APIs (models.dev, Anthropic, Gemini) fetching pricing/catalog data, not posting secrets.
- **RGS-004** on dev-hawk.lock.yml: the `workflow_run` trigger is already gated by an explicit actor allowlist (`contains(fromJSON([...]), github.event.workflow_run.actor.login)`) rather than `author_association` — the control exists, just not in the exact shape the rule checks for.

### Historical Trends

No prior daily snapshot existed in `/tmp/gh-aw/cache-memory/security-scans/` before today, so no numeric day-over-day delta is available in cache. However, GitHub issue history confirms this report has run daily since at least 2026-06-30, and the same RGS-004/012/018 rule+file combinations have been opened and closed repeatedly over that period (e.g. RGS-018 in daily-byok-ollama-test.lock.yml: #35653; poutine untrusted_checkout_exec in smoke-workflow-call*: #22608 → #22248 → #26552 → #48717 → #51177) — none of the "fixes" durably suppressed the finding at the source.

#### New Issues
- RGS-005 (Excessive Permissions on Untrusted Trigger) in ai-moderator.lock.yml, agentic_commands.yml, q.lock.yml — first time this rule/file combination has appeared in title search of issue history.
- RGS-019 (Step Output Interpolated in run Block) in error-message-lint.yml, windows-cli-integration.yml — first appearance.

#### Resolved Issues
None confirmed resolved at the code level — all recurring findings above were "closed" as tracking issues but the underlying pattern persists in today's scan.

### Recommendations

1. **Immediate**: Re-pin or upgrade the `serena-mcp-server` image (65 Critical / 387 High CVEs) — it is the single largest source of container vulnerabilities across 24 workflows.
2. **Immediate**: Land the poutine `untrusted_checkout_exec` ignore-comment fix in the workflow_call code-generation path so it stops recurring after its 5th closure.
3. **Short-term**: Give runner-guard an inline suppression mechanism (comment or config allowlist) analogous to `zizmor: ignore[...]` / `# poutine:ignore ...`, so accepted-risk/false-positive findings don't resurface every day after their tracking issue is closed.
4. **Short-term**: Review the three RGS-012 "localhost curl" and "public API GET" flags for a scanner-side tuning opportunity (exclude loopback targets and known-public read-only API domains from the exfiltration heuristic).
5. **Long-term**: Fix the 6 SC2016 actionlint findings (single-quoted `$VAR` in heredocs) in daily-arxiv-researcher, daily-code-metrics, and smoke-crush.
6. **Long-term**: Consider tracking the 193 compiler warnings (template-separator-mid-line, missing GitHub-toolset permissions, `/tmp/` path references) in a lighter-weight lint pass separate from this security report.

### Next Steps

- [ ] Apply the poutine `untrusted_checkout_exec` fix to the workflow_call generator (see Fix Suggestion)
- [ ] Re-pin `serena-mcp-server` to a patched digest
- [ ] Evaluate RGS-012/RGS-004 false-positive candidates called out above and, if confirmed, suppress at the scanner-config level rather than by closing the tracking issue
- [ ] Fix the 6 actionlint SC2016 findings
- [ ] Fix the 1 shellcheck SC2015 finding in daily-vulnhunter-scan.lock.yml
- [ ] Consider adding a runner-guard inline-ignore mechanism to stop issue churn

> Generated by [📊 Static Analysis Report](https://github.com/github/gh-aw/actions/runs/31295669837) · agent · 180.5 AIC · ⌖ 39.3 AIC · ⊞ 5.8K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fstatic-analysis-report%22&type=issues)
> - [x] expires  on Aug 15, 2026, 9:31 PM UTC-08:00

Navigation Menu

Uh oh!

[static-analysis] Report - 2026-08-09 #51520

Analysis Summary

Findings by Tool

Clustered Findings by Tool and Type

Zizmor Security Findings

Poutine Supply Chain Findings

Actionlint Linting Issues

Syft SBOM Inventory

Runner-Guard Taint Analysis Findings

Grype Container Vulnerability Findings

Yamllint YAML Linting Findings

Shellcheck Shell Linting Findings

Top Priority Issues

1. serena-mcp-server container image is critically out of date

2. Poutine `untrusted_checkout_exec` unresolved in 2 smoke workflows

3. Runner-Guard findings recur despite closed tracking issues

Fix Suggestion for poutine `untrusted_checkout_exec`

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Tool	Total	Critical	High	Medium	Low
zizmor (security)	10	0	0	0	0 (9 note, 1 warning)
poutine (supply chain)	10	0	10 (error)	0	0
actionlint (linting)	6	-	-	-	-
runner-guard (taint analysis)	121	0	111	10	0
syft (SBOM inventory)	16 images / 5,344 packages	-	-	-	-
grype (container CVEs)	2,497	112	705	1,070	247 (+294 negligible, 69 unknown)
yamllint (yaml linting)	0	-	-	-	-
shellcheck (shell linting)	1	-	-	-	-

Issue Type	Severity	Count	Affected Workflows
`github_action_from_unverified_creator_used`	note (info)	9	smoke-codex, daily-elixir-credo-snippet-audit, hippo-embed, super-linter, mcp-inspector, copilot-setup-steps.yml, link-check.yml (×2), dataflow-pr-discussion-dataset
`pr_runs_on_self_hosted`	warning	1	smoke-copilot-arm

Image	Packages
serena-mcp-server:sha-891c160	2,314
gh-aw-firewall/agent:0.27.44	532
gh-aw-firewall/cli-proxy:0.27.44	348
mcp/context7	329
gh-aw-mcpg:v0.4.8	286
grafana/mcp-grafana	252
mcp/memory	253
gh-aw-firewall/api-proxy:0.27.44	193
gh-aw-node	177
mcp/ast-grep:latest	186
mcp/arxiv-mcp-server	168
node:lts-alpine	165
gh-aw-firewall/squid:0.27.44	63
github-mcp-server:v1.8.0	40
python:alpine	38
open-ontologies:latest	10

Rule ID	Name	Severity	Count	Affected Workflows
RGS-004	Comment-Triggered Workflow Without Author Authorization Check	High	96*	dev-hawk.lock.yml
RGS-012	Secret Exfiltration via Outbound HTTP Request	High	10	daily-byok-ollama-test, daily-model-inventory (×3), docs-noob-tester, visual-regression-checker (×2)
RGS-018	Suspicious Payload Execution Pattern	High	4	daily-byok-ollama-test, daily-cli-performance, daily-sentrux-report, smoke-claude
RGS-005	Excessive Permissions on Untrusted Trigger	Medium	9	ai-moderator.lock.yml, agentic_commands.yml, q.lock.yml
RGS-019	Step Output Interpolated in run Block	Medium	2	error-message-lint.yml, windows-cli-integration.yml

Uh oh!

[static-analysis] Report - 2026-08-09 #51520

Description

Analysis Summary

Findings by Tool

Clustered Findings by Tool and Type

Zizmor Security Findings

Poutine Supply Chain Findings

Actionlint Linting Issues

Syft SBOM Inventory

Runner-Guard Taint Analysis Findings

Grype Container Vulnerability Findings

Yamllint YAML Linting Findings

Shellcheck Shell Linting Findings

Top Priority Issues

1. serena-mcp-server container image is critically out of date

2. Poutine untrusted_checkout_exec unresolved in 2 smoke workflows

3. Runner-Guard findings recur despite closed tracking issues

Fix Suggestion for poutine untrusted_checkout_exec

Activity

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

2. Poutine `untrusted_checkout_exec` unresolved in 2 smoke workflows

Fix Suggestion for poutine `untrusted_checkout_exec`