Static Analysis Report - 2026-03-19

[github-actions[bot]]

Analysis Summary

• Tools Used: zizmor, poutine, actionlint
• Workflows Scanned: 175
• Total Raw Findings: 7,728 (across all tools)
• Compiler: 0 errors, 34 warnings
• Scan Date: 2026-03-19

⚠️ CRITICAL REGRESSION: poutine untrusted_checkout_exec has RE-EMERGED in smoke-workflow-call and smoke-workflow-call-with-inputs (6 error-level findings). This issue was resolved on 2026-03-18 after persisting for 3 days (2026-03-15 to 2026-03-17).

Findings by Tool

Tool	Total (raw)	Critical/High	Medium	Low	Info
zizmor (security)	3,839	9	3,807	20	3
poutine (supply chain)	18	6 (error)	1 (warn)	—	11 (note)
actionlint (linting)	3,871	—	—	—	—

---

Clustered Findings by Tool and Type

Zizmor Security Findings

Issue Type	Severity	Count (raw)	Affected Workflows
secrets-outside-env	Medium	3,805	All 175 (virtually)
obfuscation	Low	20	Multiple
github-env	High	8	ci-doctor, dev-hawk
unpinned-uses	High	1	issue-monster
artipacked	Medium	1	daily-copilot-token-report
secrets-inherit	Medium	1	smoke-call-workflow
template-injection	Informational	3	contribution-check

Poutine Supply Chain Findings

Issue Type	Severity	Count	Affected Workflows
untrusted_checkout_exec	Error	6	smoke-workflow-call (3), smoke-workflow-call-with-inputs (3)
pr_runs_on_self_hosted	Warning	1	smoke-copilot-arm
github_action_from_unverified_creator_used	Note	7	link-check (×2), vet, super-linter, copilot-setup-steps, mcp-inspector, daily-copilot-token-report
unverified_script_exec	Note	2	daily-copilot-token-report, copilot-setup-steps
unpinnable_action	Note	2	actions/daily-perf-improver, actions/daily-test-improver

Actionlint Linting Issues

Issue Type	Count	Details
shellcheck SC2086	~3,649	Double-quote to prevent globbing/word splitting
shellcheck SC2129	~169	Use { a; b; } >> file redirection
permissions: copilot-requests unknown	41	Unknown copilot-requests permission scope
expression: undefined vars	12	activation_app_token_minting_failed, activated (not defined)

---

Top Priority Issues

1. ⚠️ CRITICAL REGRESSION: untrusted_checkout_exec Re-Emerged

• Tool: poutine
• Severity: Error
• Count: 6 (3 per workflow)
• Affected: smoke-workflow-call, smoke-workflow-call-with-inputs
• Description: Arbitrary code execution from untrusted PR code changes. Scripts run bash \$\{RUNNER_TEMP}/gh-aw/actions/*.sh after potentially checking out untrusted code.
• Impact: An attacker could modify scripts in a PR to execute arbitrary code in the CI runner context. This was resolved on 2026-03-18 (day 4 of prior incident) but has re-emerged — possibly due to a workflow change that re-introduced the pattern.
• Reference: (docs.poutine.dev/redacted)
• History: First appeared 2026-03-15, persisted 3 days, resolved 2026-03-18, RE-EMERGED today

2. github-env — High Severity (Persistent)

• Tool: zizmor
• Severity: High
• Count: 8
• Affected: ci-doctor, dev-hawk
• Description: Writing untrusted values to $GITHUB_ENV can allow environment variable injection attacks affecting subsequent steps.
• Reference: (docs.zizmor.sh/redacted)

3. unpinned-uses — High Severity (New, Day 3)

• Tool: zizmor
• Severity: High
• Count: 1
• Affected: issue-monster
• Description: An action reference is not pinned to a specific SHA commit, allowing supply chain attacks via tag mutation.
• Reference: (docs.zizmor.sh/redacted)

4. secrets-outside-env — Medium Severity (Dominant / Persistent)

• Tool: zizmor
• Severity: Medium
• Count: 3,805 (raw, affects virtually all workflows)
• Description: Secrets referenced directly in run: steps rather than via environment variables, which may allow secret values to appear in logs or be exposed via expressions.
• Reference: (docs.zizmor.sh/redacted)

---

Fix Suggestion: untrusted_checkout_exec (CRITICAL)

Issue: Arbitrary Code Execution from Untrusted Code Changes
Severity: Error (highest poutine severity)
Affected Workflows: 2 workflows, 6 locations

Prompt to Copilot Agent:

You are fixing a critical security vulnerability identified by poutine: `untrusted_checkout_exec`.

**Vulnerability**: Arbitrary Code Execution from Untrusted Code Changes
**Rule**: untrusted_checkout_exec - (docs.poutine.dev/redacted)

**Current Issue**:
The workflows `smoke-workflow-call.lock.yml` and `smoke-workflow-call-with-inputs.lock.yml`
check out untrusted PR code and then run shell scripts using `bash`. When a PR modifies
scripts in `\$\{RUNNER_TEMP}/gh-aw/actions/`, an attacker could execute arbitrary code in
the CI runner context.

**Affected files and locations**:
- `.github/workflows/smoke-workflow-call.md`: Lines ~175, ~277, ~281
- `.github/workflows/smoke-workflow-call-with-inputs.md`: Lines ~172, ~277, ~281

**Required Fix**:
1. Move the checkout step to occur BEFORE any bash script execution, OR
2. Pin the checkout to a trusted ref (e.g. `ref: $\{\{ github.event.pull_request.base.sha }}`)
   so untrusted code is never checked out before scripts run, OR
3. Move sensitive script execution steps to run BEFORE the PR checkout step, OR
4. Use a separate job for untrusted code that has read-only permissions and no
   access to secrets, keeping privileged operations in a separate trusted job.

**Example of the issue**:
```yaml
# BEFORE (vulnerable): runs scripts after potentially untrusted checkout
- uses: actions/checkout@v4
  with:
    ref: $\{\{ github.event.pull_request.head.sha }}  # untrusted ref
- run: bash \$\{RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh  # vulnerable

# AFTER (safe): run scripts before checkout, or use trusted ref
- run: bash \$\{RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh  # safe: before checkout
- uses: actions/checkout@v4
  with:
    ref: $\{\{ github.event.pull_request.head.sha }}
```

Please review and fix `.github/workflows/smoke-workflow-call.md` and
`.github/workflows/smoke-workflow-call-with-inputs.md` to eliminate the
untrusted_checkout_exec vulnerability. This issue was previously resolved on
2026-03-18 and has re-emerged — identify what change caused the regression.

---

Detailed Poutine Findings

smoke-workflow-call-with-inputs

• Line 172: untrusted_checkout_exec — bash \$\{RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh
• Line 277: untrusted_checkout_exec — bash \$\{RUNNER_TEMP}/gh-aw/actions/validate_prompt_placeholders.sh
• Line 281: untrusted_checkout_exec — bash \$\{RUNNER_TEMP}/gh-aw/actions/print_prompt_summary.sh

smoke-workflow-call

• Line 175: untrusted_checkout_exec — bash \$\{RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh
• Line 277: untrusted_checkout_exec — bash \$\{RUNNER_TEMP}/gh-aw/actions/validate_prompt_placeholders.sh
• Line 281: untrusted_checkout_exec — bash \$\{RUNNER_TEMP}/gh-aw/actions/print_prompt_summary.sh

smoke-copilot-arm

• Line 321: pr_runs_on_self_hosted — runs-on: ubuntu-24.04-arm (self-hosted runner, persistent from 2026-03-18)

link-check

• Line 35: github_action_from_unverified_creator_used — gaurav-nelson/github-action-markdown-link-check@5c5dfc0ac2e225883c0e5f03a85311ec2830d368
• Line 43: github_action_from_unverified_creator_used — gaurav-nelson/github-action-markdown-link-check@5c5dfc0ac2e225883c0e5f03a85311ec2830d368

vet

• Line 25: github_action_from_unverified_creator_used — safedep/vet-action@v1 (also unpinned!)

super-linter

• Line 1113: github_action_from_unverified_creator_used — super-linter/super-linter@61abc07d755095a68f4987d1c2c3d1d64408f1f9

copilot-setup-steps

• Line 17: unverified_script_exec — curl -fsSL .../install-gh-aw.sh | bash
• Line 42: github_action_from_unverified_creator_used — astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b

daily-copilot-token-report

• Line 333: unverified_script_exec — curl -fsSL .../install-gh-aw.sh | bash
• Line 345: github_action_from_unverified_creator_used — astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b

mcp-inspector

• Line 399: github_action_from_unverified_creator_used — astral-sh/setup-uv@e06108dd0aef18192324c70427afc47652e63a82

actions/daily-perf-improver, actions/daily-test-improver

• unpinnable_action — composite action descriptors (not pinnable by nature)

Zizmor High Severity Details

github-env (High) — ci-doctor, dev-hawk

Workflow steps write to $GITHUB_ENV with potentially tainted values. This allows a compromised step to inject environment variables that affect all subsequent steps, potentially leaking secrets or altering behavior.

Reference: (docs.zizmor.sh/redacted)

unpinned-uses (High) — issue-monster

An action is referenced by a mutable tag (e.g. @v1) rather than an immutable SHA. If the tag is moved (or the action account is compromised), a different version of the action runs.

Reference: (docs.zizmor.sh/redacted)

---

Historical Trends

Date	Workflows	Compiler Warns	Actionlint	Zizmor	Poutine	Key Events
2026-03-15	173	40	43*	3,744	18	FIRST: untrusted_checkout_exec
2026-03-16	172	38	42*	3,724	18	Persisting (day 2)
2026-03-17	172	41	42*	3,756	18	unpinned-uses new; day 3
2026-03-18	175	55	3,838	3,814	1	RESOLVED untrusted_checkout_exec ✅
2026-03-19	175	34	3,871	3,839	18	RE-EMERGED untrusted_checkout_exec ⚠️

*Note: pre-2026-03-18 actionlint counts were unique issues, not raw lines. Methodology changed.

Improvements vs yesterday:

• Compiler warnings: 55 → 34 (-38%, significant improvement)

Regressions vs yesterday:

• Poutine: 1 → 18 (+1,700%, untrusted_checkout_exec re-emergence)
• Actionlint raw: 3,838 → 3,871 (+33)
• Zizmor raw: 3,814 → 3,839 (+25)

---

Recommendations

1. Immediate: Investigate and fix untrusted_checkout_exec regression in smoke-workflow-call and smoke-workflow-call-with-inputs — identify the commit that re-introduced it
2. Short-term: Fix github-env (High) findings in ci-doctor and dev-hawk
3. Short-term: Pin the unpinned action in issue-monster to a SHA
4. Ongoing: Address pr_runs_on_self_hosted in smoke-copilot-arm (persistent warning)
5. Long-term: Implement systematic fix for secrets-outside-env (affects all 175 workflows)
6. Monitoring: The untrusted_checkout_exec has now appeared twice — consider adding a CI gate to block merges that introduce it

Next Steps

• Investigate which commit on 2026-03-19 re-introduced untrusted_checkout_exec
• Apply the Copilot agent fix prompt above to smoke-workflow-call.md and smoke-workflow-call-with-inputs.md
• Review github-env usage in ci-doctor and dev-hawk
• Pin issue-monster unpinned action to a SHA
• Track if vet.yml safedep/vet-action@v1 can be pinned to a SHA

References:

• §23282876992 — Current workflow run
• §23232288789 — 2026-03-18 (untrusted_checkout_exec resolved)
• §23105049532 — 2026-03-15 (first appearance)

AI generated by Static Analysis Report · history

• expires on Mar 20, 2026, 6:40 AM UTC

[github-actions[bot]]

This discussion has been marked as outdated by Static Analysis Report.

A newer discussion is available at Discussion #21922.