Description
The Daily Secrets Analysis Report (2026-08-25, discussion #55838 — first-ever run of this report, no historical baseline) flagged 4,946 lines containing github.event.* references outside env: blocks via a heuristic grep, explicitly noting a "high false-positive rate" since most are inside safely-quoted env: variable assignments rather than raw shell interpolation. The report itself recommends "a precise AST-based check would be needed to confirm safety per occurrence."
Expected Impact
Turns a noisy, unreliable heuristic (4,946 hits, mostly false positives) into a trustworthy signal that can actually gate template-injection risk in CI, instead of requiring manual eyeballing every time this report runs.
Suggested Agent
New agent / general-purpose — extend the existing workflow-compiler's YAML/expression parsing (it already parses ${{ }} expressions to compile lock files) to walk each workflow's parsed AST and flag github.event.* references that reach an unquoted shell/run: context, rather than grepping raw text.
Estimated Effort
Medium (1-4 hours) — reuses existing expression-parsing infrastructure in the compiler rather than building a new parser from scratch.
Data Source
DeepReport Intelligence analysis, 2026-08-25 cycle (~18:28Z), source discussion #55838.
Generated by 🔬 Deep Report · claude · agent · 130.7 AIC · ⌖ 9.46 AIC · ⊞ 12.4K · ◷
Description
The Daily Secrets Analysis Report (2026-08-25, discussion #55838 — first-ever run of this report, no historical baseline) flagged 4,946 lines containing
github.event.*references outsideenv:blocks via a heuristic grep, explicitly noting a "high false-positive rate" since most are inside safely-quotedenv:variable assignments rather than raw shell interpolation. The report itself recommends "a precise AST-based check would be needed to confirm safety per occurrence."Expected Impact
Turns a noisy, unreliable heuristic (4,946 hits, mostly false positives) into a trustworthy signal that can actually gate template-injection risk in CI, instead of requiring manual eyeballing every time this report runs.
Suggested Agent
New agent / general-purpose — extend the existing workflow-compiler's YAML/expression parsing (it already parses
${{ }}expressions to compile lock files) to walk each workflow's parsed AST and flaggithub.event.*references that reach an unquoted shell/run:context, rather than grepping raw text.Estimated Effort
Medium (1-4 hours) — reuses existing expression-parsing infrastructure in the compiler rather than building a new parser from scratch.
Data Source
DeepReport Intelligence analysis, 2026-08-25 cycle (~18:28Z), source discussion #55838.