[static-analysis] Report - 2026-10-19 #70164

You are fixing a security vulnerability identified by zizmor.

Vulnerability: secrets-outside-env - secrets referenced without a dedicated environment
Rule: secrets-outside-env - (docs.zizmor.sh/redacted)

Current Issue:
A job references one or more `secrets.*` values (directly, or indirectly via
steps that consume org/repo secrets) but the job has no `environment:` key.
GitHub Environments let you attach protection rules (required reviewers,
wait timers, deployment branch restrictions) and scope which secrets are
even visible to a job. Without a declared environment, any code that runs
in that job -- including anything reachable via prompt injection into an
agentic step -- has ambient access to every secret available to the
job/repo, with no additional approval gate and no scoping.

Note: gh-aw generates these `.lock.yml` files from `.md` workflow sources
via a shared Go compiler template (not hand-written per workflow), and the
finding appears in nearly all 340 workflows on the same job (typically
`activation` or similar). This is a compiler/template-level issue, not a
per-workflow one -- fixing the shared job template that emits secrets
usage is far more effective than editing hundreds of generated lock files
by hand.

Required Fix:
1. Identify the shared Go template/source that emits the job flagged by
   zizmor (check pkg/workflow/*.go or the .md frontmatter compiler for the
   job name shown in the finding, e.g. `activation`).
2. Determine which secrets that job actually needs (e.g. `secrets.GITHUB_TOKEN`,
   an LLM provider API key, a GH App private key).
3. Add an `environment:` key to that job specifying a named GitHub
   Environment (e.g. `environment: agent-runtime`), OR, if per-workflow
   environments aren't desired, document why the risk is accepted and add
   a `# zizmor: ignore[secrets-outside-env]` suppression with a one-line
   justification comment -- only if a security reviewer has confirmed the
   job's blast radius is already minimal (e.g. read-only permissions).
4. If introducing a real environment: create/configure the environment in
   repo settings (required reviewers / branch restrictions as appropriate),
   and confirm the job's secrets access still works in CI.
5. Recompile all workflows (`gh aw compile` or equivalent, per this repo's
   `make recompile` target) and re-run zizmor to confirm the finding count
   drops for every regenerated workflow, not just one.

Example:
Before:
```yaml
jobs:
  activation:
    needs: pre_activation
    if: needs.pre_activation.outputs.activated == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@...
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

### Runner-Guard Analysis

Dedup logic was applied to all 4 Critical/High runner-guard findings before considering new issues:

| Finding | File | Search result | Action |
|---------|------|----------------|--------|
| RGS-018 | `daily-workflow-security-model.lock.yml` | **Closed** issue #68606 found | Skip (already reviewed/closed) |
| RGS-018 | `daily-work-queue-formal-verification.lock.yml` | **Closed** issue #68607 found | Skip (already reviewed/closed) |
| RGS-018 | `credentials-check.yml` | **Closed** issue #68608 found | Skip (already reviewed/closed) |
| RGS-012 | `github-remote-mcp-auth-test.lock.yml` | `search_issues` calls for this file name were blocked by the repo's content-integrity filter (empty result + "30 item(s) removed by integrity policy", for 4 different query phrasings) | Resolved via cache-memory history instead: this finding has recurred unchanged since 2026-08-25 and is covered by **closed** issue #55652 (reviewed/accepted — pinned, non-attacker-controlled `api.githubcopilot.com` MCP handshake). Not re-filed. |

**Result: 0 new issues created this run.**

Notable: the issue numbers for the three 2026-10-14 RGS-018 filings had gone unrecorded in this scan's persistent memory for 5 consecutive days (2026-10-15 through 2026-10-18), each of those runs noting "tracking gap, numbers not recorded" because `search_issues`/`list_issues` were blocked by the same content-integrity filter on every attempt. This run's search succeeded for the RGS-018 + filename query shape (even though the RGS-012 + `github-remote-mcp-auth-test` shape was still filtered), which resolved the gap — #68606/#68607/#68608 are now recorded in cache memory (`fix-templates/runner-guard-RGS-018.md`) for future runs.

RGS-012's source file already contains an inline `# runner-guard:ignore RGS-012 -- pinned request to the official GitHub remote MCP endpoint...` suppression comment, but the scanner still reports the finding — worth investigating whether this runner-guard version/invocation honors that annotation syntax at all.

### Historical Trends

- **Previous Scan**: 2026-10-18 ([issue #69850](https://github.com/github/gh-aw/issues/69850))
- **Total Findings Then**: 20,477
- **Total Findings Now**: 20,528
- **Change**: +51 (+0.25%)

Movers: zizmor +48 (secrets-outside-env +30, self-repository +7, undocumented-permissions +7, adhoc-packages +3, artipacked +1); grype +3 (high/medium/low +1 each, critical flat at 50 — vuln-DB rescoring noise, no image digest changes). poutine, actionlint, runner-guard, yamllint, shellcheck, and syft are all byte-identical to 2026-10-18.

#### New Issues
None — no new rule types appeared this run.

#### Resolved Issues
None this run. For context: the zizmor `github-app` High finding (unscoped GitHub App token in `squad-*.lock.yml`, open ~2026-09-04 through 2026-10-03) was resolved on 2026-10-03 and remains resolved. The actionlint/shellcheck SC1003 regression affecting 33 workflows (introduced 2026-09-12) was resolved by 2026-10-14 — only `sergo.lock.yml` remains.

#### Still-open, long-unaddressed findings (worth escalating)
- zizmor High `unpinned-images` (`smoke-service-ports.lock.yml`) and `bot-conditions` (`squad.lock.yml`) — **17+ consecutive scan days open, no fix issue ever filed** (first seen ~2026-10-02/03 after `github-app` was resolved; the underlying scan history goes back further for the rule set as a whole).
- runner-guard RGS-018 (3 workflows) — recurs daily even though already triaged and closed as false positives on 2026-10-14; will keep recurring until suppression comments are added to the source (see Fix Suggestion pattern in `fix-templates/runner-guard-RGS-018.md`).

### Recommendations

1. **Immediate**: File a dedicated issue for the two long-standing zizmor High findings (`unpinned-images`, `bot-conditions`) — they are the only Critical/High findings in this report with no tracking issue at all.
2. **Immediate**: Fix or formally accept-and-suppress the RGS-018 false-positive cluster (3 workflows) so it stops resurfacing on every scan.
3. **Short-term**: Apply the `secrets-outside-env` fix at the compiler-template level (see Fix Suggestion) — this single change would eliminate ~61% of all findings in this report.
4. **Short-term**: Fix the 132 actionlint `expression` errors (single root cause: safe-outputs conclusion job references nonexistent `needs.*.outputs` properties) and the remaining `sergo.lock.yml` SC1003 shellcheck finding.
5. **Long-term**: Track whether `runner-guard:ignore` inline suppression comments are actually honored by the scanner invocation used in this pipeline — RGS-012's suppression comment appears to be ignored.
6. **Long-term**: Consider pinning/upgrading the `ghcr.io/oraios/serena` and `ghcr.io/xberg-io/xberg` third-party images, which together account for 66% of all grype Critical findings.

### Next Steps

- [ ] File issues for zizmor High `unpinned-images` and `bot-conditions` (currently untracked)
- [ ] Apply the `secrets-outside-env` fix at the shared compiler-template level
- [ ] Add suppression comments (or genuine fixes) for the RGS-018 false-positive cluster
- [ ] Fix the 132 actionlint `expression` errors (single compiler-template root cause)
- [ ] Investigate why the RGS-012 inline suppression comment isn't honored
- [ ] Review grype Critical findings in `serena`/`xberg` third-party images for available upstream fixes

**References:**
- Workflow run: [§39201468383](https://github.com/github/gh-aw/actions/runs/39201468383)