🔍 Static Analysis Report - 2026-07-06

Analysis Summary

• Tools Used: zizmor, poutine, actionlint, runner-guard
• Total Findings: 940 (zizmor 548 · poutine 22 · actionlint 37 · runner-guard 333)
• Workflows Scanned: 258 — compiled 0 error(s), 185 warning(s)
• Workflows Affected: ~197 (dominated by informational/low zizmor advisories)

Findings by Tool

No new issues today. All Critical/High runner-guard findings map to rule+file combinations already filed and closed in prior runs; per policy issue #31043, refiling closed RGS-* classes is the duplicate anti-pattern.

Clustered Findings by Tool and Type

Zizmor Security Findings

Poutine Supply Chain Findings

Actionlint Linting Issues (37, all shellcheck)

29 lock files affected (agent-performance-analyzer, audit-workflows, ci-coach, daily-*, portfolio-analyst, pr-triage-agent, etc.).

Runner-Guard Taint Analysis Findings

Issues created: none (dedup — see Runner-Guard Analysis below).

Runner-Guard Analysis

All Critical/High runner-guard findings are stable, recurring, and already tracked:

• RGS-004 (305×, 3 files) — flags gh-aw's comment/workflow_run-triggered workflows. gh-aw performs author-association authorization centrally in the generated activation job; runner-guard inspects each downstream step in isolation and cannot see that upstream gate, so these are effectively false positives. Closed issues: [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in 16 workflows #28156, [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in scout.lock.yml #29158, [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check #29460, [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in 16 workflows #29694, [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check #30077, [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in pr-nitpick-reviewer.lock.yml #30778, [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in brave.lock.yml #30945.
• RGS-012 (11×, 5 files) — outbound HTTP in workflows that legitimately POST telemetry to OTLP/Grafana/Sentry observability endpoints (headers masked via mask_otlp_headers.sh). Closed issues: [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in daily-byok-ollama-test.lock.yml #35652, [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in daily-multi-device-docs-tester.lock.yml #33477, [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in daily-model-inventory.lock.yml #30776, [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in visual-regression-checker.lock.yml #30947, [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in docs-noob-tester, visual-regression-checker #29462, [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in docs-noob-tester #28488, [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in visual-regression-checker #28626, [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in daily-fact #28328.
• RGS-018 (6×, 6 files) — curl ... | sh installer patterns for legitimate tooling (ollama, trufflehog, gh-aw extension) plus known-good execution. Closed issues: [static-analysis] RGS-018: Suspicious Payload Execution Pattern in daily-byok-ollama-test.lock.yml #35653 (daily-byok-ollama-test), [static-analysis] RGS-018: Suspicious Payload Execution Pattern in copilot-setup-steps.yml #33476 (copilot-setup-steps), and bulk class issues [static-analysis] RGS-018: Suspicious Payload Execution Pattern in multiple workflows #30777/[static-analysis] RGS-018: Suspicious Payload Execution Pattern in 36 workflows #29461/[static-analysis] RGS-018: Suspicious Payload Execution Pattern in go-logger and 36 other workflows #28154 covering the smoke-* and daily-* set.

Per #31043, refiling these closed rule+file combinations daily is the exact duplicate anti-pattern to avoid. Every current high-severity finding has a matching closed issue for its rule class + file → skipped. No open duplicates existed to comment on. 0 new issues created (limit 3).

Fix Suggestion for RGS-018 (Suspicious Payload Execution — curl | sh installers)

Issue: Piping a remotely fetched script directly into a shell (curl -fsSL ... | sh) gives an upstream host, or anyone who can MITM the download, arbitrary code execution on the runner with access to job secrets.
Severity: High · Affected: 6 workflows (all pre-existing/tracked)

Prompt to Copilot Agent:

You are fixing a security finding (runner-guard RGS-018: Suspicious Payload Execution Pattern).

Vulnerability: A workflow `run:` step pipes a network-fetched script straight into a
shell interpreter (curl ... | sh / | bash). This is unpinned remote code execution on a
runner that holds secrets.

Required Fix (apply the strongest option that works for each tool):
1. Pin to an integrity-verified artifact: download to a file, verify a known SHA-256
   checksum (or minisign/cosign signature), then execute only on match.
2. Prefer a version-pinned GitHub Action from a verified publisher over the installer script.
3. If a vendor installer must be used, pin it to an immutable tag/commit and download +
   inspect + checksum before running — never pipe the raw stream into a shell.

Example — Before:
    - name: Install Ollama
      run: curl -fsSL (ollama.com/redacted) | sh

Example — After:
    - name: Install Ollama
      run: |
        curl -fsSL (ollama.com/redacted) -o /tmp/ollama-install.sh
        echo "<known-sha256>  /tmp/ollama-install.sh" | sha256sum -c -
        sh /tmp/ollama-install.sh

Apply to: daily-byok-ollama-test, smoke-codex (trufflehog), copilot-setup-steps (gh-aw
installer), and review daily-cli-performance / daily-sentrux-report / smoke-claude.
Note: several of these are source .md workflows whose .lock.yml is generated — fix the
source and recompile, do not edit lock files directly.

Historical Trends

• zizmor: 552 → 548 (−4) — minor drop in template-injection/adhoc-packages advisories.
• actionlint: 40 → 37 (−3) — the 3 expression errors present yesterday are resolved; only shellcheck remains.
• poutine / runner-guard: unchanged.
• New issue types: none. Resolved: actionlint expression (undefined-property) errors.

Recommendations

1. Immediate: No unaddressed Critical/High. Every high-severity runner-guard finding is a tracked false-positive or accepted-risk with a closed issue.
2. Short-term: If RGS-018/RGS-012 noise is unwanted, add scoped # runner-guard:ignore annotations (as already done for poutine untrusted_checkout_exec) at the known installer/telemetry sites so they stop surfacing.
3. Structural: Consider teaching runner-guard about gh-aw's centralized activation auth gate to eliminate the 305 RGS-004 false positives, or suppress RGS-004 for gh-aw-generated lock files.
4. Long-term: Keep static analysis in CI (already active); address the low-value shellcheck SC2038/SC2086 items opportunistically in source .md templates.

Next Steps

• (Optional) Add # runner-guard:ignore RGS-018/RGS-012 at accepted installer/telemetry sites to reduce recurring noise.
• Suppress or contextualize RGS-004 for centrally-gated gh-aw workflows.
• Fix SC2038 (find ... -print0 | xargs -0) and SC2086 (quote vars) in the ~29 affected source templates and recompile.
• No new runner-guard issues filed (all high-severity findings map to closed issues per [deep-report] Static-analysis RGS-* security issues recreated daily after closure (no dedup-by-rule) #31043).

References:

• §28771456238
• Policy: [deep-report] Static-analysis RGS-* security issues recreated daily after closure (no dedup-by-rule) #31043 · Prior report: [static-analysis] Report - 2026-07-05 #43477

Generated by 📊 Static Analysis Report · 193.6 AIC · ⌖ 11 AIC · ⊞ 10K · ◷

• expires on Jul 12, 2026, 10:21 PM UTC-08:00