🚨 Runner-Guard Security Finding
Rule: RGS-012 — Secret Exfiltration via Outbound HTTP Request
Severity: High
File: .github/workflows/visual-regression-checker.lock.yml
Line: 846 — step "Execute GitHub Copilot CLI"
Description
Runner-Guard flagged a run:-adjacent block containing an outbound HTTP request targeting a non-GitHub domain in a job context with secrets/publishing access, a pattern generally associated with credential exfiltration.
Impact
If a job triggered by an untrusted event makes an outbound request carrying secrets to an attacker-controlled domain, it can exfiltrate CI credentials.
Investigation notes (manual review before this run)
The flagged line is a comment listing the Copilot CLI's allowed tool invocations, not executable exfiltration code:
# Copilot CLI tool arguments (sorted):
# --allow-tool shell(curl (host.docker.internal/redacted)
# --allow-tool shell(curl (localhost/redacted)
Both targets (host.docker.internal and localhost) are loopback/local-network addresses used to let the agent curl a local dev server (consistent with a visual-regression workflow that screenshots a locally-running app), not an external domain capable of receiving exfiltrated secrets. This looks like a likely false positive: the non-GitHub-domain heuristic doesn't currently special-case loopback/link-local addresses.
Remediation
- If confirmed as a false positive, consider excluding loopback addresses (
localhost, 127.0.0.1, host.docker.internal) from the "non-GitHub domain" exfiltration heuristic, or suppress this specific rule for comment-only lines (# --allow-tool ...) rather than executable run: content.
- Re-verify that no other step in this workflow actually issues an outbound curl to
host.docker.internal/localhost carrying secret values as payload — the allow-list only bounds what the agent may call, not proof of what it does call.
Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/32333348563
Generated by 📊 Static Analysis Report · agent · 197.9 AIC · ⌖ 9.57 AIC · ⊞ 11.5K · ◷
🚨 Runner-Guard Security Finding
Rule: RGS-012 — Secret Exfiltration via Outbound HTTP Request
Severity: High
File:
.github/workflows/visual-regression-checker.lock.ymlLine: 846 — step "Execute GitHub Copilot CLI"
Description
Runner-Guard flagged a
run:-adjacent block containing an outbound HTTP request targeting a non-GitHub domain in a job context with secrets/publishing access, a pattern generally associated with credential exfiltration.Impact
If a job triggered by an untrusted event makes an outbound request carrying secrets to an attacker-controlled domain, it can exfiltrate CI credentials.
Investigation notes (manual review before this run)
The flagged line is a comment listing the Copilot CLI's allowed tool invocations, not executable exfiltration code:
Both targets (
host.docker.internalandlocalhost) are loopback/local-network addresses used to let the agent curl a local dev server (consistent with a visual-regression workflow that screenshots a locally-running app), not an external domain capable of receiving exfiltrated secrets. This looks like a likely false positive: the non-GitHub-domain heuristic doesn't currently special-case loopback/link-local addresses.Remediation
localhost,127.0.0.1,host.docker.internal) from the "non-GitHub domain" exfiltration heuristic, or suppress this specific rule for comment-only lines (# --allow-tool ...) rather than executablerun:content.host.docker.internal/localhostcarrying secret values as payload — the allow-list only bounds what the agent may call, not proof of what it does call.Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/32333348563