[static-analysis] Report - 2026-10-22 #71044

🔍 Static Analysis Report - 2026-10-22

Analysis Summary

• Tools Used: zizmor, poutine, actionlint, runner-guard, syft, grype, yamllint, shellcheck
• Total Findings: 20,292
• Workflows Scanned: 346
• Workflows Affected: 346 (every workflow has at least one low-severity zizmor finding; see breakdown below)

⚠️ Data quality flag: grype's total dropped 2,426 → 973 (-60%) vs yesterday almost entirely because ghcr.io/oraios/serena:1.7.0 reported zero findings today despite syft confirming the same image digest (sha256:6c9459e...730, 1,678 packages) was scanned again. Yesterday that single image contributed 1,472 findings (15 critical). No error or skip message for serena appears anywhere in the compile output. Treat today's grype numbers as undercounted by roughly 1,472 findings — this is a scanner/reporting gap, not remediation.

Findings by Tool

Clustered Findings by Tool and Type

Zizmor Security Findings

🆕 New today: dangerous-triggers fired for the first time in tracked scan history (0→3), pushing zizmor's High count from 2 to 5. See "Fix Suggestion" below.

Poutine Supply Chain Findings

Actionlint Linting Issues

Root cause (unchanged from prior scans): safe-outputs conclusion-job expressions reference needs.<job>.outputs.{missing_tool,noop,report_incomplete,report_failed_jobs} properties that aren't declared on the generated needs-context object type for 34 workflows. report_failed_jobs occurrences fell 32→19 since yesterday (affected workflows rose 33→34) — possibly a partial compiler-template fix landed.

Runner-Guard Taint Analysis Findings

Byte-identical to 2026-10-21. See "Runner-Guard Analysis" section below for dedup details.

Grype Container Vulnerability Findings

Notable High findings (new npm/Go advisories recurring from yesterday): GHSA-ch52-4w7c-c8xp (http-cache-semantics@4.2.0), GHSA-r292-9mhp-454m (tar@7.5.19, fix 7.5.21) across multiple node-based images; GO-2026-6603/6605/6607/6608/6610/6611/6613/6617 (Go stdlib, multiple images); GHSA-2v4p-qf9q-27wj/GHSA-vp52-pcj8-j9qc (google.golang.org/grpc) in gh-aw-mcpg and grafana/mcp-grafana.

Syft SBOM Inventory

Total: 3,947 packages across 12 images — flat vs 2026-10-21, same 12 digests. This confirms serena was scanned; the grype gap for it is a tool/reporting issue, not an image change.

Yamllint YAML Linting Findings

Clean — 0 findings across 346 files, byte-identical to 2026-10-21.

Shellcheck Shell Linting Findings

Byte-identical to 2026-10-21.

Top Priority Issues

1. NEW: zizmor dangerous-triggers on 3 command-bot workflows

• Tool: zizmor
• Count: 3 (first occurrence in tracked scan history — 0 yesterday)
• Severity: High
• Affected: ai-moderator.lock.yml, q.lock.yml, squad.lock.yml
• Description: issue_comment: triggers can be fired by any user via a comment on any issue/PR; zizmor flags the trigger itself as fundamentally insecure regardless of downstream mitigations.
• Impact: All three are command-style bots that already gate privileged work behind a pre_activation job checking actor/author_association (squad.lock.yml also carries the related bot-conditions finding on that same check) — architecturally mitigated, but unsuppressed, so it will keep re-triggering on every scan.
• Reference: (docs.zizmor.sh/redacted)

2. Grype reporting gap for ghcr.io/oraios/serena:1.7.0

• Tool: grype
• Count: ~1,472 findings (15 critical) silently missing today
• Severity: N/A (tooling issue, not a vulnerability)
• Affected: serena MCP image, used across multiple workflows
• Description: syft confirms the same image digest was scanned (1,678 packages, flat), but grype produced zero finding lines for it with no error/skip message.
• Impact: Masks the true container vulnerability picture; the 15 critical CVEs in serena from 2026-10-21 have not actually been fixed.
• Reference: investigate the grype scan step for this image in the compile workflow.

3. secrets-outside-env (bulk, longstanding)

• Tool: zizmor
• Count: 12,498 (+14 vs yesterday)
• Severity: Medium
• Affected: 341 of 346 workflows
• Description: Jobs reference secrets.* without a dedicated GitHub environment: protection.
• Impact: By far the largest cluster (~62% of all zizmor findings); compiler-template-level fix would resolve nearly all at once. See Fix Suggestion (secondary) below and fix-templates/zizmor-secrets-outside-env.md in cache memory for a ready-to-use Copilot prompt.
• Reference: (docs.zizmor.sh/redacted)

4. actionlint needs-context property gaps

• Tool: actionlint
• Count: 151 expression errors (153 total incl. 2 shellcheck)
• Severity: N/A (actionlint has no severity levels)
• Affected: 34 workflows
• Description: Safe-outputs conclusion-job expressions reference needs.<job>.outputs.{missing_tool,noop,report_incomplete,report_failed_jobs} properties not declared on the generated needs-context type.
• Impact: Compile-time type errors on every affected workflow; report_failed_jobs occurrences fell 32→19 since yesterday, suggesting a partial fix is already landing.

Fix Suggestion for zizmor dangerous-triggers (primary pick — newest High-severity cluster)

Issue: issue_comment: trigger flagged as fundamentally insecure
Severity: High
Affected Workflows: 3 (ai-moderator.lock.yml, q.lock.yml, squad.lock.yml)

Prompt to Copilot Agent:

You are fixing a security finding identified by zizmor.

Vulnerability: dangerous-triggers - use of fundamentally insecure workflow trigger
Rule: dangerous-triggers - (docs.zizmor.sh/redacted)

Current Issue:
The workflow declares an `issue_comment:` trigger. This event can be fired
by ANY GitHub user (including first-time contributors and anonymous
drive-by commenters on public repos) simply by posting a comment on any
issue or pull request. zizmor flags this trigger as fundamentally
insecure because, taken in isolation, any job that runs unconditionally
on this event executes attacker-controlled input with whatever
permissions and secrets the workflow grants.

These three workflows are command-style bots that already gate the
actual work behind a `pre_activation` job checking `github.actor` and
`github.event.comment.author_association` before anything privileged
runs. zizmor evaluates the trigger declaration itself, not the downstream
job graph, so it cannot see this mitigation and will keep flagging it.

Required Fix:
1. For each affected workflow, confirm no job reachable from the
   `issue_comment` trigger runs before the actor/permission check gate
   (no write permissions or secrets exposed pre-gate).
2. If gating is confirmed sufficient, add a
   `# zizmor: ignore[dangerous-triggers]` comment above the `on:` block
   with a one-line justification referencing the gating job.
3. Since these are generated `.lock.yml` files, add the ignore comment
   to the shared Go compiler template/source that emits the `on:` block
   for command-triggered workflows (pkg/workflow/*.go), not to the
   generated lock file directly, so it survives recompilation.
4. If gating is NOT sufficient for any workflow, fix job
   ordering/permissions instead of suppressing the finding.
5. Recompile and re-run zizmor to confirm High count drops from 5 back
   to 2 (the pre-existing unpinned-images/bot-conditions findings).

Example:
Before:
  on:
    issue_comment:
      types:
        - created

After:
  on:
    # zizmor: ignore[dangerous-triggers] -- gated by pre_activation actor/author_association check (see pre_activation job)
    issue_comment:
      types:
        - created

Please apply this fix to all affected workflows: ai-moderator.lock.yml, q.lock.yml, squad.lock.yml.

A second, ready-made fix prompt for the longstanding bulk issue (secrets-outside-env, 12,498 occurrences / 341 workflows) is stored at cache-memory/fix-templates/zizmor-secrets-outside-env.md and remains the highest-leverage single fix available (compiler-template level change).

Runner-Guard Analysis

Runner-Guard findings: 23 total (byte-identical to 2026-10-21) — RGS-005 ×19 (medium), RGS-018 ×3 (high), RGS-012 ×1 (high).

Dedup result: 0 new issues created. All 4 Critical/High findings were checked against cache-memory scan history:

• RGS-018 (daily-workflow-security-model.lock.yml, daily-work-queue-formal-verification.lock.yml, credentials-check.yml) — each already covered by a closed issue filed 2026-10-14 ([static-analysis] RGS-018: Suspicious Payload Execution Pattern in daily-workflow-security-model.lock.yml #68606, [static-analysis] RGS-018: Suspicious Payload Execution Pattern in daily-work-queue-formal-verification.lock.yml #68607, [static-analysis] RGS-018: Suspicious Payload Execution Pattern in credentials-check.yml #68608 respectively, confirmed closed as of the 2026-10-19 scan). Per dedup rule, closed issue for same rule+file ⇒ skip.
• RGS-012 (github-remote-mcp-auth-test.lock.yml) — already covered by closed issue [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in github-remote-mcp-auth-test.lock.yml #55652 (reviewed/accepted: pinned api.githubcopilot.com MCP handshake). Skip.
• RGS-005 findings are Medium severity and therefore out of scope for issue creation regardless of dedup status.

GitHub search_issues/issue_read were integrity-policy filtered again this run (consistent with most prior scans), so dedup relied entirely on cache-memory scan history rather than a live re-verification.

Issues created: none

All Findings Details

Historical Trends

• Previous Scan: 2026-10-21
• Total Findings Then: 21,729
• Total Findings Now: 20,292
• Change: -1,437 (-6.6%), ~-1,453 of which is the grype/serena reporting gap above, not real improvement

New Issues

• zizmor dangerous-triggers (High) — first occurrence in 45+ days of tracked scans, 3 workflows
• grype reporting gap for ghcr.io/oraios/serena:1.7.0 — first occurrence of a full image dropout

Resolved Issues

• None confirmed resolved. actionlint report_failed_jobs count fell 32→19 but 19 occurrences remain (possible partial fix, not full resolution).

Recommendations

1. Immediate: Investigate the grype scan gap for ghcr.io/oraios/serena:1.7.0 (data-quality issue hiding 15 critical CVEs) and review/suppress-or-fix the new dangerous-triggers High findings on ai-moderator/q/squad.
2. Short-term: Land the compiler-template fix for secrets-outside-env (12,498 occurrences, 341 workflows) — highest-leverage single change available. Also finish the report_failed_jobs needs-context fix (actionlint, 19 of 34 workflows still affected).
3. Long-term: Establish automated static analysis in CI/CD so these clusters are caught before merge, not just in the daily scan.
4. Prevention: Update the gh-aw compiler's job-template generation to pre-empt secrets-outside-env, self-repository, and undocumented-permissions at the source, since they affect nearly every generated workflow by construction.

Next Steps

• Investigate and fix the grype/serena reporting gap
• Review and suppress-or-fix zizmor dangerous-triggers on ai-moderator.lock.yml, q.lock.yml, squad.lock.yml
• Apply the secrets-outside-env compiler-level fix (see cache-memory fix-templates)
• Review and fix the two longstanding High findings (unpinned-images, bot-conditions — 23+ days open)
• Complete the actionlint report_failed_jobs/noop/report_incomplete/missing_tool needs-context fix
• Consider adding all eight tools to pre-commit hooks

Static analysis performed by the Static Analysis Report Agent using zizmor, poutine, actionlint, runner-guard, syft, grype, yamllint, and shellcheck.
Workflow run: https://github.com/github/gh-aw/actions/runs/39724300274

Generated by 📊 Static Analysis Report · claude · agent · 268.5 AIC · ⌖ 0.892 AIC · ⊞ 7.3K · ◷

• expires on Oct 28, 2026, 9:24 PM UTC-08:00