You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Posture is stable vs. yesterday (07-07). No new security regressions; zizmor High = 0 for the 20th+ consecutive day. Net movement is noise (zizmor +4 Low/Info, poutine −3, runner-guard −3).
Per closed-policy issue #31043, when a closed issue already exists for the same rule ID + affected file, the finding is skipped rather than recreated. All of today's High findings meet that condition, so 0 new issues and 0 comments were emitted.
Top Priority Issues
1. RGS-004 — Comment-Triggered Workflow Without Author Authorization Check
Impact: Genuinely actionable — an unquoted expansion can word-split or glob on unexpected input. This is the best candidate for an automated fix (see below).
Fix Suggestion for actionlint SC2086 (unquoted variable expansion)
Issue: Unquoted shell variable/command-substitution used in run: blocks, risking word-splitting and glob expansion. Severity: Warning (real code-quality/correctness risk) Affected Workflows: 4 workflows
Note: the findings are in generated .lock.yml files. The fix must be applied to the source .md workflowrun: steps (or the gh-aw shared script templates), then recompiled with gh aw compile.
Prompt to Copilot Agent:
You are fixing a shell-quoting issue (shellcheck SC2086) flagged by actionlint in
GitHub Actions workflows generated by gh-aw.
Vulnerability: SC2086 — "Double quote to prevent globbing and word splitting"
Reference: https://github.com/rhysd/actionlint/blob/main/docs/checks.md#check-shellcheck-integration
ShellCheck: (www.shellcheck.net/redacted)
Current Issue:
A `run:` block expands a shell variable or command substitution WITHOUT double
quotes. If the value contains spaces, tabs, newlines, or glob characters (* ? [ ]),
the shell will split it into multiple words or expand globs, producing incorrect
behavior or subtle bugs.
Required Fix:
1. Locate the flagged expansion in the SOURCE `.md` workflow (not the compiled
`.lock.yml`). The compiled line/column maps back to a `run:` step in the markdown.
2. Wrap every parameter expansion and command substitution in double quotes:
`$VAR` -> `"$VAR"`, `${VAR}` -> `"${VAR}"`, `$(cmd)` -> `"$(cmd)"`.
3. Do NOT quote where word-splitting is intentional (e.g. building an argument
list); in those cases use a bash array instead and expand with `"${arr[@]}"`.
4. Recompile with `gh aw compile` and confirm actionlint reports 0 SC2086 for the file.
Example:
Before:
run: |
echo Processing $FILE_PATH
rm -rf $BUILD_DIR/output
After:
run: |
echo "Processing $FILE_PATH"
rm -rf "$BUILD_DIR/output"
Apply this fix to the source workflows for these compiled files:
- daily-geo-optimizer.lock.yml:1628
- impeccable-skills-reviewer.lock.yml:560
- mattpocock-skills-reviewer.lock.yml:707
- pr-code-quality-reviewer.lock.yml:594
All Findings Details
Detailed findings by tool
Zizmor (552, all Low/Informational)
template-injection ×264 — ${{ ... }} interpolation in run:/with: of generated jobs. Informational; gh-aw sanitizes untrusted inputs via env-var extraction before shell use.
Long-run stability: zizmor High = 0 for 20+ consecutive days; actionlint has stayed at ~37–40 (down from 1200+ in May after the bundled-actionlint upgrade to 1.7.12).
Recommendations
Immediate: None required — 0 Critical, and all High runner-guard/poutine findings are triaged false positives or poutine:ignore-annotated trusted internal scripts.
Short-term: Apply the SC2086 quoting fix (4 source workflows) — the only genuinely actionable code-quality item.
Prevention: Keep new command-triggered workflows on centralized routing (on.slash_command.strategy: centralized) — the compiler warned 1 of 52 slash-command entries is not yet centralized.
Next Steps
Apply SC2086 quoting fix to the 4 source workflows and recompile.
🔍 Static Analysis Report - 2026-07-08
Analysis Summary
Findings by Tool
Clustered Findings by Tool and Type
Zizmor Security Findings
.lock.ymlfilesAll zizmor findings are Low/Informational. No High or Medium — a clean, stable security surface for the generated workflows.
Poutine Supply Chain Findings
# poutine:ignoreannotated — trusted internal${RUNNER_TEMP}/gh-aw/actions/*.shscripts)ubuntu-24.04-arm)Actionlint Linting Issues
${{...}}/ awk$nin single quotes — false positives-print0 | xargs -0All 39 are
shellcheckcategory; 0 syntax / expression / permissions errors.(a name="runner-guard-analysis")(/a)
Runner-Guard Taint Analysis Findings
Runner-Guard score/grade: not emitted in this run's output.
.lock.yml)Issues created: none. Every Critical/High rule+file combination was previously filed and closed after review:
pre_activation/activationjob andauthor_associationgating that the taint scanner does not model. Prior closed issues: [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in 16 workflows #28156, [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in 16 workflows #29694, [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check (16 workflows) #30284, [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in pr-nitpick-reviewer.lock.yml #30778, [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in brave.lock.yml #30945, fix(rgs-004): add author_association guard to pre_activation jobs for comment-triggered workflows #29481 (fix).Per closed-policy issue #31043, when a closed issue already exists for the same rule ID + affected file, the finding is skipped rather than recreated. All of today's High findings meet that condition, so 0 new issues and 0 comments were emitted.
Top Priority Issues
1. RGS-004 — Comment-Triggered Workflow Without Author Authorization Check
.lock.yml)author_associationchecks that the scanner cannot see. Treated as accepted; not refiled per [deep-report] Static-analysis RGS-* security issues recreated daily after closure (no dedup-by-rule) #31043.2. actionlint SC2086 — Double quote to prevent globbing and word splitting
.lock.yml)Fix Suggestion for actionlint SC2086 (unquoted variable expansion)
Issue: Unquoted shell variable/command-substitution used in
run:blocks, risking word-splitting and glob expansion.Severity: Warning (real code-quality/correctness risk)
Affected Workflows: 4 workflows
Prompt to Copilot Agent:
All Findings Details
Detailed findings by tool
Zizmor (552, all Low/Informational)
template-injection×264 —${{ ... }}interpolation inrun:/with:of generated jobs. Informational; gh-aw sanitizes untrusted inputs via env-var extraction before shell use.adhoc-packages×257 — ad-hocapt-get install/pip install/npm installin setup steps. Low.obfuscation×30 — obfuscated GitHub Actions usage (e.g.${{ ... }}in indices). Low.superfluous-actions×1 — Informational.Poutine (19)
untrusted_checkout_exec×10 (error) — smoke-workflow-call{,-with-inputs}; all lines carry# poutine:ignore untrusted_checkout_exec— running trusted internal${RUNNER_TEMP}/gh-aw/actions/*.shscripts.github_action_from_unverified_creator_used×8 (note) — safedep/pmg, super-linter, astral-sh/setup-uv, actions-ecosystem/action-add-labels, gaurav-nelson/github-action-markdown-link-check — all SHA-pinned.pr_runs_on_self_hosted×1 (warning) — smoke-copilot-arm onubuntu-24.04-arm.Actionlint (39, all shellcheck)
${{...}}/awk$nin single quotes; false positives.-print0 | xargs -0: repository-quality-improver, spec-extractor, unbloat-docs.ivar in daily-byok-ollama-test.Runner-Guard (330) — see Runner-Guard Analysis above.
Historical Trends
unverified_script_exec(was 3) → 0 today; runner-guard RGS-012 6→5 files, RGS-018 6→4 findings.Recommendations
poutine:ignore-annotated trusted internal scripts.on.slash_command.strategy: centralized) — the compiler warned 1 of 52 slash-command entries is not yet centralized.Next Steps
find|xargsand SC2034 unused-var items when touching those workflows.References: