[static-analysis] Report - 2026-09-07 #59134

Analysis Summary

• Tools Used: zizmor, poutine, actionlint, runner-guard, syft, grype, yamllint, shellcheck
• Total Findings: 15,259 (down from 15,323 on 2026-09-06)
• Workflows Scanned: 299
• Workflows Affected: ~299 (near-universal low-severity zizmor rules dominate; smaller high-severity set below)
• Run: §34084354179

Quietest day in the tracked history: zizmor is exactly flat (13,146 findings, all 13 rules byte-identical to yesterday, same 11 High findings). runner-guard is unchanged. The only material movement is a grype improvement (-94 findings, -4.4%) driven by one floating-tag image (xberg-io/xberg:latest) swapping its critical CVEs, and a tool-attribution correction (see below) that clarifies two findings previously mislabeled as zizmor actually belong to poutine.

Findings by Tool

⚠️ Tool Attribution Correction

Today's scan confirmed (via section-boundary analysis of the raw compile output) that two findings previously reported under zizmor in prior daily reports are actually native to poutine:

• github_action_from_unverified_creator_used (29 occurrences / 28 workflows)
• pr_runs_on_self_hosted (1 occurrence / smoke-copilot-arm.lock.yml)

Both rules appear only inside poutine's output section of the compile log; grepping the isolated zizmor-only slice returns zero hits for either. Prior days' "poutine: 0" readings coincided with this pair being (mis)attributed to zizmor due to interleaved log output. This doesn't change total finding counts, just which tool gets credit — cache memory has been annotated accordingly.

Clustered Findings by Tool and Type

Zizmor Security Findings

All 4 High-severity rule+workflow pairs are unchanged since first appearing on 2026-09-04 (4 consecutive days). None have a dedicated fix issue yet except github-env/dev-hawk, which is a recurring regression — the identical rule+workflow pair has been closed 6 times before (#22249, #22528, #25861, #27219, #37586, #38050), meaning whatever fix lands doesn't survive the next lock-file regeneration.

Poutine Supply Chain Findings

pr_runs_on_self_hosted reappeared today after being absent for 3 consecutive days (2026-09-04 through 2026-09-06), back to its long-running 2026-08-26+ baseline. Likely a false positive: ubuntu-24.04-arm is a GitHub-hosted ARM runner, not a literal self-hosted runner.

Actionlint Linting Issues

None — 0 findings across 299 workflows (unchanged since 2026-08-25).

Syft SBOM Inventory

Runner-Guard Taint Analysis Findings

Runner-Guard Score: not reported in this run's output (no explicit 0-100 score line found).

Issues created: none. RGS-005 is Medium (below the Critical/High issue-creation threshold). RGS-012 is the same pre-existing finding covered by closed issue #55652 (fix PR #55686 didn't survive a later lock-file regeneration — same regression class as dev-hawk's github-env). Re-verified via direct issue_read(#55652) today: confirmed state: closed. Per dedup policy, not re-filed.

Grype Container Vulnerability Findings

Total improved 2,158 → 2,064 (-94, -4.4%) on the same 11-image matrix. Almost entirely explained by ghcr.io/xberg-io/xberg:latest (a floating :latest tag that gets repulled fresh each run): its 2 OpenSSL criticals (CVE-2026-63073, CVE-2026-75803) resolved, but 3 unrelated new criticals appeared instead — CVE-2026-52490 (libtiff6), CVE-2026-58016 (libglib2.0-0t64), CVE-2026-6653 (libxml2), none with an upstream fix available yet. Net critical count for that image: 9 → 3. Every other image's counts are unchanged. The dominant remaining critical, CVE-2026-75803 (openssl/libssl3/libcrypto3), still affects 7 of 11 images with fixes available upstream (e.g. 3.5.8-r0 Alpine, 3.5.7-1~deb13u2 Debian).

Yamllint YAML Linting Findings

None — 0 findings (unchanged since 2026-08-27).

Shellcheck Shell Linting Findings

Unchanged since 2026-08-27 — unquoted variable in mcp-scripts.go/.make/.hippo run steps.

Top Priority Issues

1. zizmor github-app — unscoped GitHub App tokens (High, unresolved 4 days)

• Tool: zizmor
• Count: 8 occurrences / 4 workflows
• Severity: High
• Affected: squad-game-planner.lock.yml, squad-implement-worker.lock.yml, squad-plan.lock.yml, squad.lock.yml
• Description: actions/create-github-app-token is used with no permissions: input, so the minted token inherits the GitHub App's full installation permission set instead of a scoped subset.
• Impact: If any of these jobs is compromised (malicious dependency, prompt injection, supply-chain issue), the attacker gets a token with the app's entire permission surface rather than the minimum needed.
• Reference: (docs.zizmor.sh/redacted)
• Status: No dedicated fix issue filed in 4 days since first appearing (2026-09-04). Selected as this week's Fix Suggestion (below).

2. runner-guard RGS-012 — recurring regression pattern (High)

• Tool: runner-guard
• Count: 1 (github-remote-mcp-auth-test.lock.yml)
• Severity: High
• Description: Outbound HTTP request in a run: block, flagged as a potential secret-exfiltration pattern (loopback/self-test call).
• Status: Covered by closed issue [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in github-remote-mcp-auth-test.lock.yml #55652; the suppression fix (Suppress RGS-012 finding for pinned GitHub remote MCP handshake curl #55686) did not survive a subsequent lock-file regeneration. This is the same regression class as the dev-hawk github-env finding below — worth a systemic look at why suppression annotations don't survive workflow regeneration.

3. zizmor github-env on dev-hawk.lock.yml — closed & reopened 6 times (High)

• Tool: zizmor
• Count: 1
• Severity: High
• Description: A run: block seeded from an env: var writes to $GITHUB_ENV.
• Impact: Potential for environment-variable injection if the seeding value is attacker-influenced.
• Status: This exact rule+workflow pair has been fixed and closed 6 times ([plan] Fix github-env HIGH vulnerability in ci-doctor and dev-hawk workflows #22249, Fix github-env HIGH vulnerability in ci-doctor and dev-hawk workflows #22528, [plan] Fix dangerous GITHUB_ENV write in dev-hawk workflow (High severity) #25861, Mitigate github-env injection risk in dev-hawk by switching GH_HOST propagation to step outputs #27219, Resolve dev-hawk github-env highs by tightening env-file usage in generated workflow steps #37586, Eliminate persistent zizmor github-env finding in dev-hawk safe-outputs path #38050) — each fix appears to not survive a later regeneration of dev-hawk's compiled workflow. This is a systemic regeneration/template issue, not a one-off code fix.

Fix Suggestion for zizmor github-app

Issue: GitHub App token minted via actions/create-github-app-token with no permissions: input
Severity: High
Affected Workflows: 4 workflows (8 occurrences), unresolved since 2026-09-04

Prompt to Copilot Agent:

You are fixing a security vulnerability identified by zizmor.

Vulnerability: github-app - dangerous use of GitHub App tokens
Rule: github-app - (docs.zizmor.sh/redacted)

Current Issue:
A workflow step uses actions/create-github-app-token to mint an installation
access token but does not pass a `permissions:` input. Without it, the minted
token inherits ALL permissions granted to the GitHub App installation, not
just the subset the job actually needs. If the job's environment is later
compromised (e.g. via a malicious dependency, prompt injection into an agent
step, or a supply-chain issue in another step), the attacker gets a token
scoped to the app's full installation permissions instead of a minimal set.

Required Fix:
1. Locate the `uses: actions/create-github-app-token@...` step.
2. Add a `permissions:` map under `with:` that lists only the scopes the
   token is actually used for downstream (e.g. `contents: write`,
   `issues: write`, `pull-requests: write`) -- check every place
   `steps.<id>.outputs.token` is consumed to determine the real minimum set.
3. Re-run zizmor to confirm the finding clears.

Note: since these workflows are compiled `.lock.yml` files generated from
`.md` source, the fix must be applied in the source (not the generated lock
file) so it survives the next `gh-aw compile` run. Search for the shared
source/template that emits the "Mint Squad GitHub App token" step (all 4
affected workflows share the identical step, so there is likely one shared
Go template or `.md` include to fix instead of 4 separate files).

Example:
Before:
```yaml
      - name: Mint Squad GitHub App token
        id: squad-app-token
        if: ${{ steps.squad-installation.outputs.installed != 'true' && vars.SQUAD_GITHUB_APP_ID != '' }}
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ vars.SQUAD_GITHUB_APP_ID }}
          owner: ${{ vars.SQUAD_GITHUB_APP_OWNER }}
          private-key: ${{ secrets.SQUAD_GITHUB_APP_PRIVATE_KEY }}

After:

      - name: Mint Squad GitHub App token
        id: squad-app-token
        if: ${{ steps.squad-installation.outputs.installed != 'true' && vars.SQUAD_GITHUB_APP_ID != '' }}
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ vars.SQUAD_GITHUB_APP_ID }}
          owner: ${{ vars.SQUAD_GITHUB_APP_OWNER }}
          private-key: ${{ secrets.SQUAD_GITHUB_APP_PRIVATE_KEY }}
          permissions: >-
            {"contents": "write", "issues": "write", "pull-requests": "write"}

(replace the scope map with whatever this token is actually used for in
each workflow -- check downstream gh / GitHub API calls made using
steps.squad-app-token.outputs.token.)

Please apply this fix to all affected workflows (via their shared source):
squad-game-planner.lock.yml, squad-implement-worker.lock.yml,
squad-plan.lock.yml, squad.lock.yml

### Historical Trends

- **Previous Scan**: 2026-09-06
- **Total Findings Then**: 15,323
- **Total Findings Now**: 15,259
- **Change**: -64 (-0.4%)

#### New Issues
None — no new rule types appeared today.

#### Resolved Issues
None at the rule level. `pr_runs_on_self_hosted` (poutine) reappeared after a 3-day absence — not a resolution, a recurrence.

<details>
<summary><b>Detailed Findings by Workflow (High/Critical only)</b></summary>

#### squad-game-planner.lock.yml, squad-implement-worker.lock.yml, squad-plan.lock.yml, squad.lock.yml
##### zizmor `github-app` (High)
- Unscoped GitHub App token minting — see Fix Suggestion above.

#### squad.lock.yml
##### zizmor `bot-conditions` (High)
- Spoofable `github.actor == 'github-actions[bot]'` bypass check in the `pre_activation` job.

#### smoke-service-ports.lock.yml
##### zizmor `unpinned-images` (High)
- `services.redis.image: redis:7` uses a floating tag with no digest pin.

#### dev-hawk.lock.yml
##### zizmor `github-env` (High)
- A `run:` block seeded from an `env:` var writes to `$GITHUB_ENV`. Recurring pattern, closed 6x previously.

#### github-remote-mcp-auth-test.lock.yml
##### runner-guard RGS-012 (High)
- Outbound HTTP request pattern at line 1740, pre-existing, covered by closed issue #55652.

</details>

### Recommendations

1. **Immediate**: File a fix issue for zizmor `github-app` (4 workflows, unfixed 4 days) — fix template ready above.
2. **Immediate**: Investigate why suppressions/fixes for `RGS-012` (github-remote-mcp-auth-test) and `github-env` (dev-hawk) don't survive lock-file regeneration — this is a systemic tooling gap, not a one-off code issue, and has now cost 7 total issue-close cycles across both patterns.
3. **Short-term**: Address the remaining zizmor High findings (`unpinned-images` on smoke-service-ports, `bot-conditions` on squad).
4. **Short-term**: Track down upstream fixes for `ghcr.io/xberg-io/xberg:latest`'s new criticals (libtiff6, libglib2.0, libxml2) — none have fixed versions published yet, worth a watch item.
5. **Long-term**: Pin `ghcr.io/xberg-io/xberg:latest` to a specific tag/digest instead of `:latest` to make grype deltas reproducible and avoid surprise CVE churn day-to-day.
6. **Prevention**: Continue using syft/grype SBOM data to catch container drift; consider excluding purely-informational zizmor rules (anonymous-definition, undocumented-permissions) from the build-gate threshold if they're not actionable at this volume.

### Next Steps

- [ ] File fix issue for zizmor `github-app` using the prompt above
- [ ] Root-cause why RGS-012/github-env fixes don't survive regeneration
- [ ] Review and fix remaining zizmor High findings (unpinned-images, bot-conditions)
- [ ] Pin `xberg-io/xberg` to a fixed tag/digest
- [ ] Consider adding all eight tools to pre-commit hooks

**References:**
- [§34084354179](https://github.com/github/gh-aw/actions/runs/34084354179)

> [!WARNING]
> <details>
> <summary>Firewall blocked 1 domain</summary>
>
> The following domain was blocked by the firewall during workflow execution:
>
> - `api.anthropic.com`
>
> To allow these domains, add them to the `network.allowed` list in your workflow frontmatter:
>
> ```yaml
> network:
>   allowed:
>     - defaults
>     - "api.anthropic.com"
> ```
>
> See [Network Configuration](https://github.github.com/gh-aw/reference/network/) for more information.
>
> </details>

> Generated by [📊 Static Analysis Report](https://github.com/github/gh-aw/actions/runs/34084354179) · claude · agent · 298.7 AIC · ⌖ 10.9 AIC · ⊞ 12.3K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fstatic-analysis-report%22&type=issues)
> - [x] expires <!-- gh-aw-expires: 2026-09-14T05:23:54.953Z --> on Sep 13, 2026, 9:23 PM UTC-08:00

<!-- gh-aw-agentic-workflow: Static Analysis Report, engine: claude, model: agent, id: 34084354179, workflow_id: static-analysis-report, run: https://github.com/github/gh-aw/actions/runs/34084354179 -->

<!-- gh-aw-workflow-id: static-analysis-report -->
<!-- gh-aw-workflow-call-id: github/gh-aw/static-analysis-report -->