[static-analysis] Report - 2026-04-19 #27218

Analysis Summary

Daily static analysis scan of all agentic workflow files in github/gh-aw.

• Tools Used: zizmor, poutine, actionlint, runner-guard
• Total Findings: ~242 (110 actionlint + 108 zizmor + 24 poutine + 0 runner-guard)
• Workflows Scanned: 196
• Workflows Affected: ~58
• Workflow Run: §24637453783

Findings by Tool

Clustered Findings by Tool and Type

Zizmor Security Findings

Poutine Supply Chain Findings

Actionlint Linting Issues

Runner-Guard Taint Analysis Findings

Runner-guard ran successfully and produced no findings in this scan (2nd consecutive clean scan).

Issues created: none (no Critical/High runner-guard findings)

Top Priority Issues

1. github-env — Dangerous Environment File Usage

• Tool: zizmor
• Count: 1
• Severity: High
• Affected: dev-hawk.md (compiled line 1387, step id ghes-host-config)
• Description: A run: step writes to $GITHUB_ENV, deriving GH_HOST from GITHUB_SERVER_URL. If attacker-controlled input can influence values written to $GITHUB_ENV, this enables environment variable injection persisting across all subsequent steps.
• Impact: Potential environment variable poisoning affecting all subsequent steps in the job
• Reference: (docs.zizmor.sh/redacted)

2. untrusted_checkout_exec — Arbitrary Code Execution (Poutine)

• Tool: poutine
• Count: 8 occurrences across 2 workflows
• Severity: error
• Affected: smoke-workflow-call.md, smoke-workflow-call-with-inputs.md
• Description: Bash scripts executed after checkout of potentially untrusted code. Note: all instances have # poutine:ignore untrusted_checkout_exec suppressions — risk is acknowledged.

3. permissions:copilot-requests — Unknown Permission Scope (Actionlint)

• Tool: actionlint
• Count: 99
• Severity: error
• Affected: ~50 workflows
• Description: actionlint 1.7.12 does not recognize copilot-requests as a valid permission scope. Likely false positives — copilot-requests is a newer permission not yet in actionlint's schema.

Fix Suggestion for github-env (Highest Real Severity)

Issue: Dangerous use of $GITHUB_ENV in dev-hawk.md
Severity: High
Affected Workflows: 1

Prompt to Copilot Agent:

You are fixing a security vulnerability identified by zizmor in .github/workflows/dev-hawk.md.

**Vulnerability**: Dangerous use of GITHUB_ENV environment file
**Rule**: github-env — (docs.zizmor.sh/redacted)
**Severity**: High

**Current Issue**:
The step with id `ghes-host-config` (around compiled line 1387) writes to $GITHUB_ENV,
setting GH_HOST derived from GITHUB_SERVER_URL. Writing to $GITHUB_ENV can be exploited
if attacker-controlled input reaches the written value.

**Required Fix (Option A — preferred)**:
Replace $GITHUB_ENV writes with $GITHUB_OUTPUT and reference via step outputs.

Before:
  - id: ghes-host-config
    shell: bash
    run: |
      GH_HOST=$(echo "$GITHUB_SERVER_URL" | sed 's|https://||')
      echo "GH_HOST=$GH_HOST" >> $GITHUB_ENV

After:
  - id: ghes-host-config
    shell: bash
    run: |
      GH_HOST=$(echo "$GITHUB_SERVER_URL" | sed 's|https://||')
      echo "gh_host=$GH_HOST" >> $GITHUB_OUTPUT

Then update downstream steps to use:
  env:
    GH_HOST: $\{\{ steps.ghes-host-config.outputs.gh_host }}

**Alternative Fix (Option B)**:
Add a suppression if value is guaranteed to come only from trusted GITHUB_SERVER_URL:
  # zizmor: ignore[github-env] — value derived exclusively from trusted GITHUB_SERVER_URL

Please apply Option A (preferred) to .github/workflows/dev-hawk.md.

All Findings Details

Historical Trends

• Previous Scan: 2026-04-17 (§24583641830, issue #26933)
• Previous Total Findings: ~240 (194 workflows)
• Current Total Findings: ~242 (196 workflows, +2 new workflows)
• Change: +2 findings (+0.8%) — attributable to 2 new workflows added

Recurring Issues (seen in both scans)

• github-env in dev-hawk (zizmor High) — not yet fixed (2nd consecutive scan)
• untrusted_checkout_exec in smoke-workflow-call workflows (poutine error) — not yet fixed
• permissions:copilot-requests across ~50 workflows (actionlint) — not yet fixed
• secrets-inherit in smoke-call-workflow (zizmor Medium) — not yet fixed

New Issues

None identified beyond the 2 additional workflows added.

Resolved Issues

None since previous scan.

Recommendations

1. Immediate: Fix github-env High severity finding in dev-hawk.md — refactor to use $GITHUB_OUTPUT instead of $GITHUB_ENV
2. Short-term: Add actionlint configuration to allowlist copilot-requests permission scope — eliminates 99 false-positive errors
3. Short-term: Fix expression errors for undefined output properties in ace-editor, smoke-claude, and smoke-workflow-call workflows
4. Medium-term: Address secrets-inherit in smoke-call-workflow — consider explicit secret passing instead of unconditional inheritance
5. Long-term: Replace curl | bash install patterns with pinned releases to reduce poutine supply chain notes
6. Prevention: Update workflow templates to avoid $\{\{ '' }} obfuscation patterns (21 workflows affected)

Next Steps

• Fix github-env High severity in dev-hawk.md (see fix prompt above)
• Add actionlint config to ignore copilot-requests permission scope
• Fix expression errors for undefined output properties
• Review secrets-inherit in smoke-call-workflow.md
• Consider pinning astral-sh/setup-uv and other third-party actions

References:

• §24637453783
• §24583641830 (previous scan)

Generated by Static Analysis Report · ● 237K · ◷

• expires on Apr 26, 2026, 7:46 PM UTC