[static-analysis] Report - 2026-10-20 #70437

🔍 Static Analysis Report - 2026-10-20

Analysis Summary

• Tools Used: zizmor, poutine, actionlint, runner-guard, syft, grype, yamllint, shellcheck
• Total Findings: 20,377 (-151 / -0.74% vs 2026-10-19)
• Workflows Scanned: 344 (-1 vs 2026-10-19; one workflow was removed/merged, which fully explains the zizmor delta below — not a security regression)
• Workflows Affected: 344 (every workflow still carries at least one zizmor low/info finding)

Findings by Tool

Clustered Findings by Tool and Type

Zizmor Security Findings

Note on secrets-outside-env: this is by far the largest cluster (12,431 findings / 339 workflows) but it is a known, deliberately-accepted finding — pkg/cli/compile_development_report.go explicitly excludes secrets-outside-env from the strict compile gate ("low-severity findings and zizmor secrets-outside-env are excluded from the gate"). A fix template for it already exists in cache memory (fix-templates/zizmor-secrets-outside-env.md). No action requested here.

Poutine Supply Chain Findings

Actionlint Linting Issues

All 132 expression errors share one root cause: generated conclusion-job expressions reference needs.<job>.outputs.{report_incomplete,noop,missing_tool} properties that actionlint's static type-checker doesn't see on the synthesized needs object type for that job (the properties are populated dynamically at runtime via fromJSON/matrix outputs, which actionlint can't model statically).

Syft SBOM Inventory

Total: 3,944 packages across 12 images — byte-identical to 2026-10-19 (no digest changes).

Runner-Guard Taint Analysis Findings

Runner-Guard Score: not reported in this run's output.

Issues created: none — all 4 Critical/High findings are duplicates of previously-filed, already-closed issues. See Runner-Guard Analysis below.

Grype Container Vulnerability Findings

Byte-identical to 2026-10-19 across every image and severity bucket — no new CVEs, no digest changes. ghcr.io/oraios/serena and ghcr.io/xberg-io/xberg (third-party MCP server images) together account for 33 of the 50 Critical findings.

Yamllint YAML Linting Findings

Clean — 0 findings, byte-identical to 2026-10-19.

Shellcheck Shell Linting Findings

Top Priority Issues

Fix Suggestion for unpinned-images

Issue: Mutable Docker tag used for a services: container image instead of a pinned digest
Severity: High
Affected Workflows: 1 workflow (smoke-service-ports.lock.yml), but the pattern applies to any workflow adding a services: block

Prompt to Copilot Agent:

You are fixing a security vulnerability identified by zizmor.

Vulnerability: unpinned-images - (docs.zizmor.sh/redacted)

Current Issue:
A GitHub Actions `services:` (or `container:`) block references a Docker image by a
mutable tag (e.g. `redis:7`) instead of an immutable content digest. Mutable tags can
be repointed by the upstream maintainer or a compromised registry at any time, so the
exact bytes pulled into the CI runner are not reviewable and can change between runs
without any diff showing up in version control.

Required Fix:
1. Resolve the current digest for the tag you depend on, e.g.:
     docker pull redis:7
     docker inspect --format '{{index .RepoDigests 0}}' redis:7
   (or use `skopeo inspect (redis/redacted) --format '{{.Digest}}'` without pulling).
2. Replace the tag reference with `image@sha256:<digest>` in the workflow's SOURCE
   markdown frontmatter (the `.md` file, not the generated `.lock.yml` — the lock
   file is regenerated by `gh aw compile` / `make recompile` and must not be hand-edited).
3. Keep a trailing comment with the human-readable tag so future readers know what
   version the digest corresponds to, and add a periodic (e.g. monthly/quarterly)
   reminder to refresh the pin when the upstream image receives security patches.
4. Recompile with `make recompile` and verify the generated `.lock.yml` reflects the
   pinned digest.

Example:
Before:
    services:
      redis:
        image: redis:7
        options: --health-cmd "redis-cli ping" --health-interval 10s --health-timeout 5s --health-retries 5
        ports:
          - 6379:6379

After:
    services:
      redis:
        image: redis:7@sha256:<resolved-digest>  # redis:7, refresh periodically
        options: --health-cmd "redis-cli ping" --health-interval 10s --health-timeout 5s --health-retries 5
        ports:
          - 6379:6379

Please apply this fix to the affected workflow source: .github/workflows/smoke-service-ports.md
(the `services.redis.image` key), then run `make recompile` to regenerate
.github/workflows/smoke-service-ports.lock.yml.

Runner-Guard Analysis

Runner-guard reported 17 raw findings (9 unique rule+file combinations), identical to 2026-10-19:

Issues created this run: none (0 new, 4 duplicates skipped, consistent with 2026-10-19).

Historical Trends

• Previous Scan: 2026-10-19
• Total Findings Then: 20,528
• Total Findings Now: 20,377
• Change: -151 (-0.74%)

The entire delta is attributable to the scanned-workflow count dropping from 345 to 344 (one workflow removed/merged since yesterday), not to any genuine security improvement or regression:

• secrets-outside-env: -142 (12,573 → 12,431; affected workflows 340 → 339)
• self-repository: -5 (2,384 → 2,379)
• undocumented-permissions: -3 (2,103 → 2,100)
• adhoc-packages: -1 (559 → 558)
• All other zizmor rules, poutine, actionlint, runner-guard, grype, yamllint, and shellcheck: byte-identical to 2026-10-19.

New Issues

None.

Resolved Issues

None (zizmor High findings unpinned-images and bot-conditions remain open with no change in 18+ consecutive daily scans).

Recommendations

1. Immediate: File a dedicated fix for the two outstanding zizmor High findings (unpinned-images in smoke-service-ports.lock.yml, bot-conditions in squad.lock.yml) — both have been open 18+ consecutive days with no tracking issue.
2. Short-term: Investigate the 132 actionlint expression errors (33 workflows) — these stem from the compiler's conclusion-job template referencing dynamically-populated needs.<job>.outputs.* properties that actionlint's static checker can't resolve; consider adding explicit outputs: declarations on the producing jobs to eliminate the false-positive noise.
3. Long-term: Track the Critical/High grype findings in ghcr.io/oraios/serena (15 critical) and ghcr.io/xberg-io/xberg (18 critical) — both third-party MCP server images — for upstream patches or pinning to patched digests.
4. Prevention: File an upstream issue with runner-guard about the runner-guard:ignore suppression comment not being honored for RGS-012, to stop this finding recurring daily in scan output.

Next Steps

• Pin redis:7 to a digest in smoke-service-ports.md and recompile (unpinned-images)
• Review and harden the pre_activation bot-actor check in squad.lock.yml (bot-conditions)
• Review RGS-005 excessive-permission findings in the 5 affected workflows against the existing fix template (fix-templates/runner-guard-RGS-005.md)
• Investigate root cause of the 132 actionlint expression errors in the safe-outputs conclusion job template
• Follow up with runner-guard maintainers on the unhonored runner-guard:ignore RGS-012 suppression comment
• No action needed on secrets-outside-env (deliberately excluded from the compile gate) or byte-identical grype/syft/poutine findings

Generated by 📊 Static Analysis Report · claude · agent · 282.6 AIC · ⌖ 0.99 AIC · ⊞ 7.1K · ◷

• expires on Oct 26, 2026, 9:27 PM UTC-08:00