Skip to content

[static-analysis] Report - 2026-08-04 #50191

Closed
#50386
Closed
[static-analysis] Report - 2026-08-04#50191
#50386
Assignees
pelikhancopilot-swe-agent
Labels
automationcookieIssue Monster Loves Cookies!securitystatic-analysis

Description

@github-actions
github-actions
bot
opened on Aug 4, 2026

Analysis Summary

  • Tools Used: zizmor, poutine, actionlint, runner-guard, syft, grype, yamllint, shellcheck
  • Total Findings (all tools): 2,713
  • Workflows Scanned: 271
  • Workflows with warnings/findings: 154 (per compiler summary)

Findings by Tool

Tool Total Critical High Medium Low
zizmor (security) 9 0 0 0 0 (9 info)
poutine (supply chain) 11 0 10 (error) 0 1 (warning)
actionlint (linting) 7 - - - -
runner-guard (taint analysis) 358 0 347 11 0
syft (SBOM inventory) 15 images / 5,259 packages - - - -
grype (container CVEs) 2,310 106 635 976 223 (+282 Negligible, 88 Unknown)
yamllint (yaml linting) 0 - - - -
shellcheck (shell linting) 7 notes (2 unique scripts) - - - -

The compiler also emitted 154 non-tool compilation warnings (missing permissions, /tmp/ path usage, template-separator formatting, schedule jitter suggestions, etc.) across the 271 source .md files — these are separate from the 8 static-analysis tools above.

Clustered Findings by Tool and Type

Zizmor Security Findings

Issue Type Severity Count Affected Workflows
github_action_from_unverified_creator_used Info 9 mcp-inspector, copilot-setup-steps, daily-elixir-credo-snippet-audit, link-check (×2), smoke-codex, super-linter, dataflow-pr-discussion-dataset, hippo-embed

All 9 occurrences already carry an explicit # zizmor: ignore[github_action_from_unverified_creator_used] comment in source — these are acknowledged/accepted risks (pinned-by-SHA third-party actions from unverified publishers: astral-sh/setup-uv, erlef/setup-beam, gaurav-nelson/github-action-markdown-link-check, safedep/pmg, super-linter/super-linter, actions-ecosystem/action-add-labels), not unaddressed findings.

Poutine Supply Chain Findings

Issue Type Severity Count Affected Workflows
untrusted_checkout_exec Error 10 smoke-workflow-call.lock.yml (5), smoke-workflow-call-with-inputs.lock.yml (5)
pr_runs_on_self_hosted Warning 1 smoke-copilot-arm.lock.yml (runs on ubuntu-24.04-arm)

The 10 untrusted_checkout_exec hits are all on internal bash "${RUNNER_TEMP}/gh-aw/actions/*.sh" helper invocations already marked # poutine:ignore untrusted_checkout_exec in source — pre-reviewed and suppressed, surfaced here only because suppression comments don't currently silence the compiler's console output.

Actionlint Linting Issues

Issue Type Count Affected Workflows
shellcheck-integration (SC2086, SC2129) 7 smoke-goose.lock.yml (6), daily-astrostylelite-markdown-spellcheck.lock.yml (1)

Syft SBOM Inventory

15 container images / 5,259 packages total
Image Packages Affected Workflows
ghcr.io/github/serena-mcp-server:sha-2491b68 2,229 archie, cloclo, go-fan, mcp-inspector, sergo, smoke-codex, smoke-copilot* (5 variants), typist, and 13 more
ghcr.io/github/gh-aw-firewall/agent:0.27.43 532 firewall/network-enabled workflows (shared firewall proxy image)
ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.43 348 same
ghcr.io/github/gh-aw-mcpg:v0.4.7 286 ~230+ workflows (safe-outputs MCP gateway, near-universal)
grafana/mcp-grafana 252 daily-token-consumption-report, portfolio-analyst, smoke-otel-backends
mcp/memory 253 mcp-inspector
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43 193 firewall-enabled workflows
ghcr.io/github/gh-aw-node 177 ~230+ workflows (near-universal)
node:lts-alpine 165 base image
mcp/ast-grep:latest 186 go-pattern-detector, mcp-inspector
mcp/arxiv-mcp-server 168 mcp-inspector, scout
mcp/context7 329 mcp-inspector
ghcr.io/github/github-mcp-server:v1.8.0 40 ~230+ workflows (near-universal)
ghcr.io/github/gh-aw-firewall/squid:0.27.43 63 firewall-enabled workflows
python:alpine 38 base image

Runner-Guard Taint Analysis Findings

Runner-Guard flagged 358 findings across 271 workflows (no aggregate Score/Grade line was emitted in this run's output).

Rule ID Name Severity Count Affected Workflows
RGS-004 Comment-Triggered Workflow Without Author Authorization Check High 334 (across every flagged step) ai-moderator.lock.yml (113), dev-hawk.lock.yml (96), q.lock.yml (125, pre-existing)
RGS-005 Excessive Permissions on Untrusted Trigger Medium 9 agentic_commands.yml (1), ai-moderator.lock.yml (5), q.lock.yml (3)
RGS-012 Secret Exfiltration via Outbound HTTP Request High 9 daily-byok-ollama-test.lock.yml (2), daily-model-inventory.lock.yml (4), docs-noob-tester.lock.yml (1, new), visual-regression-checker.lock.yml (2)
RGS-018 Suspicious Payload Execution Pattern High 4 daily-byok-ollama-test.lock.yml, daily-cli-performance.lock.yml, daily-sentrux-report.lock.yml, smoke-claude.lock.yml
RGS-019 Step Output Interpolated in run Block Medium 2 error-message-lint.yml, windows-cli-integration.yml

Note on RGS-004 counts: this rule fires once per step in a job lacking a recognized author-authorization gate, so 334 "findings" really correspond to only 3 distinct workflows. For ai-moderator.lock.yml, the source .md already declares roles: all + skip-author-associations + skip-roles, which is gh-aw's own framework-level gating mechanism — runner-guard's scanner doesn't appear to recognize this pattern in the compiled lock file, so this is likely (at least partly) a false positive pending verification. dev-hawk.lock.yml has no equivalent roles:/skip-author-associations: config and does post PR comments via safe-outputs.add-comment, so it's a more plausible real gap. See the linked issues below for full detail.

Issues created: 3 new (see below); 8 findings matched already-closed prior issues and were skipped (not recreated), consistent with the max-3-new-issues-per-run limit.

New issues created this run
  • RGS-004 in ai-moderator.lock.yml (likely false positive — framework-level gate present, needs confirmation)
  • RGS-004 in dev-hawk.lock.yml (plausible real gap — no author check before add-comment)
  • RGS-012 in docs-noob-tester.lock.yml (likely false positive — target is localhost, not external)
Findings matched to already-closed prior issues (skipped, not recreated)

Grype Container Vulnerability Findings

Package/Image Severity Count Affected Workflows
ghcr.io/github/serena-mcp-server:sha-2491b68 mixed 906 (57 Critical, 299 High) 22 workflows using this image
mcp/arxiv-mcp-server mixed 404 (16 Critical, 114 High) mcp-inspector, scout
ghcr.io/github/gh-aw-firewall/agent:0.27.43 mixed 361 (0 Critical, 3 High, mostly Medium/Low) firewall-enabled workflows
mcp/context7 mixed 164 (10 Critical, 73 High) mcp-inspector
grafana/mcp-grafana mixed 160 (7 Critical, 19 High) daily-token-consumption-report, portfolio-analyst, smoke-otel-backends
mcp/memory mixed 118 (8 Critical, 55 High) mcp-inspector
mcp/ast-grep:latest mixed 95 (6 Critical, 38 High) go-pattern-detector, mcp-inspector

Notable Critical/High-severity, fix-available items: golang.org/x/text@v0.38.0 (GO-2026-5970, fix 0.39.0) in gh-aw-firewall/agent; multiple libcurl3t64-gnutls@8.14.1 CVEs in serena-mcp-server; node-lodash@4.17.21 (CVE-2026-4800) and handlebars@4.7.7 (CVE-2026-33937) in the same image.

Yamllint YAML Linting Findings

None — 0 findings across all 271 files.

Shellcheck Shell Linting Findings

Code Count Affected Workflows
SC2086 (unquoted variable) 6 smoke-goose.lock.yml (2 separate "Write Goose harness script" steps, 3 locations each)
SC2129 (use { } >> grouping) 1 daily-astrostylelite-markdown-spellcheck.lock.yml

Top Priority Issues

1. Grype Critical/High CVEs in MCP tool container images

  • Tool: grype
  • Count: 741 (106 Critical + 635 High)
  • Severity: Critical/High
  • Affected: serena-mcp-server, mcp/arxiv-mcp-server, mcp/context7, mcp/memory, mcp/ast-grep, grafana/mcp-grafana, and others
  • Description: Third-party MCP server container images carry a large number of known CVEs in their OS/language package layers.
  • Impact: These images run as MCP tool servers inside agentic workflows; a compromised dependency could be leveraged for code execution within the sandboxed tool container. Most images are third-party (not gh-aw-authored), limiting direct remediation to version bumps/upstream fixes.
  • Reference: https://github.com/anchore/grype

2. Runner-Guard RGS-004 (Comment-Triggered Workflow Without Author Authorization Check)

  • Tool: runner-guard
  • Count: 334 (3 distinct workflows)
  • Severity: High
  • Affected: ai-moderator.lock.yml, dev-hawk.lock.yml, q.lock.yml (pre-existing, closed issue)
  • Description: Workflows triggered by comment/workflow_run events without a recognized in-step authorization check.
  • Impact: Potential for untrusted users to trigger privileged workflow actions; needs manual confirmation per-workflow since gh-aw's frontmatter-level roles/skip-author-associations gating may already cover some cases that runner-guard's static scanner doesn't recognize.
  • Reference: https://github.com/Vigilant-LLC/runner-guard

3. Poutine untrusted_checkout_exec (suppressed)

  • Tool: poutine
  • Count: 10
  • Severity: Error (suppressed via inline comment)
  • Affected: smoke-workflow-call.lock.yml, smoke-workflow-call-with-inputs.lock.yml
  • Description: bash execution of gh-aw internal helper scripts flagged as "arbitrary code execution from untrusted code changes."
  • Impact: Low — these are internal compiler-generated helper scripts (save_base_github_folders.sh, create_prompt_first.sh, etc.), not user-controlled code; already suppressed with # poutine:ignore untrusted_checkout_exec.
  • Reference: https://github.com/boostsecurityio/poutine

Fix Suggestion for Grype Critical/High CVEs in Third-Party MCP Images

Issue: Outdated OS/language packages in third-party MCP tool container images carry known CVEs.
Severity: Critical/High
Affected Workflows: ~10 workflows referencing serena-mcp-server, mcp/arxiv-mcp-server, mcp/context7, mcp/memory, mcp/ast-grep, grafana/mcp-grafana directly by tag/digest.

Prompt to Copilot Agent:

You are triaging container CVE findings reported by grype for MCP tool server images referenced in gh-aw workflow frontmatter (`mcp-servers:` / `container:` fields in .github/workflows/*.md).

**Vulnerability**: Grype identified Critical/High severity CVEs in third-party container images pinned by tag or digest in workflow frontmatter, e.g.:
  - ghcr.io/github/serena-mcp-server:sha-2491b68 (57 Critical, 299 High)
  - mcp/context7 (10 Critical, 73 High)
  - mcp/memory (8 Critical, 55 High)
  - mcp/ast-grep:latest (6 Critical, 38 High)

**Why it matters**: These images execute as MCP tool servers with access to repository context inside the agent sandbox. Known, unpatched CVEs in their base OS or language runtime widen the attack surface if the MCP server itself is ever exposed to untrusted input.

**Required Fix**:
1. For each affected workflow's `.md` frontmatter, locate the pinned image reference (tag or `@sha256:...` digest).
2. Check the upstream image repository/registry for a newer tag that resolves the flagged CVEs (grype output includes "fix:" versions where available, e.g. `golang.org/x/text` fix 0.39.0).
3. Update the pinned digest/tag to the newer, patched image build.
4. Re-run `gh aw compile` (or the repo's compile workflow) and confirm grype no longer reports the same CVE IDs for that image.
5. If no upstream fix exists yet, note the CVE IDs as accepted/tracked risk in the workflow's frontmatter comments and re-check on the next scheduled scan.

**Example**:
Before:
```yaml
mcp-servers:
  context7:
    container: "mcp/context7@sha256:1174e6a29634a83b2be93ac1fefabf63265f498c02c72201fe3464e687dd8836"

After (illustrative — use the actual newer digest from the registry):

mcp-servers:
  context7:
    container: "mcp/context7@sha256:<newer-patched-digest>"

Please apply this fix to all affected workflows referencing: serena-mcp-server, mcp/arxiv-mcp-server, mcp/context7, mcp/memory, mcp/ast-grep, grafana/mcp-grafana.


### Historical Trends

No prior scan data was found in `/tmp/gh-aw/cache-memory/security-scans/` — this run establishes the baseline (2026-08-04). Future scans will compare against this baseline.

### Recommendations

1. **Immediate**: Confirm the RGS-004 finding on `ai-moderator.lock.yml` against its `roles`/`skip-author-associations` gating (likely a scanner false-positive); confirm/patch the gap on `dev-hawk.lock.yml`.
2. **Short-term**: Evaluate updating third-party MCP container image pins (serena-mcp-server, context7, memory, ast-grep, arxiv-mcp-server, mcp-grafana) to newer builds to clear Critical/High grype CVEs.
3. **Short-term**: Fix the 2 shellcheck SC2086 unquoted-variable instances in `smoke-goose.lock.yml` and the SC2129 redirect-grouping suggestion in `daily-astrostylelite-markdown-spellcheck.lock.yml`.
4. **Long-term**: Consider whether poutine/zizmor inline-ignore comments should also suppress the compiler's console/CI output, since 19 of 20 zizmor+poutine findings in this run were already reviewed and suppressed in source but still print as noise.
5. **Prevention**: Track container image freshness (via syft/grype) on a recurring cadence, since MCP server image CVE counts are large and will grow between manual review cycles.

### Next Steps

- [ ] Verify RGS-004 gating on `ai-moderator.lock.yml` and close/annotate if confirmed a false positive
- [ ] Add explicit author-authorization check to `dev-hawk.md`
- [ ] Bind `docs-noob-tester.lock.yml`'s preview server to `127.0.0.1` instead of `0.0.0.0`
- [ ] Evaluate updated digests for high-CVE MCP container images
- [ ] Fix SC2086/SC2129 shellcheck findings
- [ ] Consider silencing zizmor/poutine console output for inline-suppressed findings




> Generated by [📊 Static Analysis Report](https://github.com/github/gh-aw/actions/runs/30881086944) · agent · 216.2 AIC · ⌖ 39.2 AIC · ⊞ 5.7K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fstatic-analysis-report%22&type=issues)
> - [x] expires <!-- gh-aw-expires: 2026-08-11T06:11:23.458Z --> on Aug 10, 2026, 10:11 PM UTC-08:00

<!-- gh-aw-agentic-workflow: Static Analysis Report, engine: claude, model: agent, id: 30881086944, workflow_id: static-analysis-report, run: https://github.com/github/gh-aw/actions/runs/30881086944 -->

<!-- gh-aw-workflow-id: static-analysis-report -->
<!-- gh-aw-workflow-call-id: github/gh-aw/static-analysis-report -->

Metadata

Metadata

Assignees

Labels

automationcookieIssue Monster Loves Cookies!securitystatic-analysis

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions