[static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check (16 workflows)

[github-actions]

🚨 Runner-Guard Security Finding

Rule: RGS-004 — Comment-Triggered Workflow Without Author Authorization Check
Severity: High
Affected Workflows: 16
Total Findings: 1,476

Description

A workflow is triggered by issue_comment events and accesses secrets or has write permissions, but does not verify the comment author's authorization level before executing privileged operations. The issue_comment event fires for comments from ANY GitHub user, including those with no affiliation to the repository. Without an explicit check on github.event.comment.author_association (e.g., requiring OWNER, MEMBER, or COLLABORATOR), any external user can trigger the workflow by posting a comment on any open issue or pull request.

Affected Workflows

• ace-editor
• ai-moderator
• archie
• brave
• cloclo
• dev-hawk
• grumpy-reviewer
• mergefest
• pdf-summary
• plan
• pr-nitpick-reviewer
• q
• scout
• security-review
• tidy
• unbloat-docs

Impact

If any of these workflows access secrets, perform deployments, or have write permissions, this effectively grants those privileges to arbitrary external users who can post a comment on any open issue or pull request.

Remediation

Add an authorization check at the start of every job that uses secrets or has write permissions in comment-triggered workflows:

- name: Verify comment author authorization
  run: |
    ASSOC="${{ github.event.comment.author_association }}"
    if [[ "" != "OWNER" && "" != "MEMBER" && "" != "COLLABORATOR" ]]; then
      echo "::error::Unauthorized: comment author association not permitted."
      exit 1
    fi

Alternatively, use a job-level if condition:

jobs:
  run:
    if: |
      github.event.comment.author_association == "OWNER" ||
      github.event.comment.author_association == "MEMBER" ||
      github.event.comment.author_association == "COLLABORATOR"

---

Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/25359631246

Generated by Static Analysis Report · ● 549K · ◷

• expires on May 12, 2026, 5:44 AM UTC

[github-actions]

This issue is being closed as outdated. A newer issue has been created: #30531

View newer issue

---

This action was performed automatically by the Static Analysis Report workflow.