[static-analysis] Report - 2026-09-16

### Analysis Summary

- **Tools Used**: zizmor, poutine, actionlint, runner-guard, syft, grype, yamllint, shellcheck
- **Total Findings**: 15,569 (+39 vs 2026-09-14, +0.25% — no 2026-09-15 scan on record)
- **Workflows Scanned**: 299
- **Workflows Succeeded**: 299 (376 compile warnings)
- **Workflows Affected**: ~296 (secrets-outside-env alone touches 296/299)

#### Findings by Tool

| Tool | Total | Critical | High | Medium | Low |
|------|-------|----------|------|--------|-----|
| zizmor (security) | 13,023 | 0 | 10 | 8,274 | 2,492 |
| poutine (supply chain) | 30 | - | - | - | - |
| actionlint (linting) | 206 | - | - | - | - |
| runner-guard (taint analysis) | 13 | 0 | 1 | 12 | 0 |
| syft (SBOM inventory) | 11 images / 3,860 pkgs | - | - | - | - |
| grype (container CVEs) | 2,085 | 52 | 497 | 568 | 109 (+794 negligible, 65 unknown) |
| yamllint (yaml linting) | 0 | - | - | - | - |
| shellcheck (shell linting) | 212 | - | - | - | - |

### Clustered Findings by Tool and Type

#### Zizmor Security Findings

| Issue Type | Severity | Count | Affected Workflows |
|------------|----------|-------|-------------------|
| secrets-outside-env | Medium | 8,198 | 296 of 299 |
| anonymous-definition | Informational | 2,194 | 299 of 299 |
| undocumented-permissions | Low | 1,854 | 299 of 299 |
| adhoc-packages | Low | 605 | multiple |
| artipacked | Medium | 75 | multiple |
| template-injection | Informational | 52 | multiple |
| obfuscation | Low | 30 | multiple |
| github-app | **High** | 8 | squad-game-planner, squad-implement-worker, squad-plan, squad (4 workflows) |
| template-injection | Low | 3 | multiple |
| secrets-inherit | Medium | 1 | 1 workflow |
| superfluous-actions | Informational | 1 | 1 workflow |
| unpinned-images | **High** | 1 | smoke-service-ports |
| bot-conditions | **High** | 1 | squad |

#### Poutine Supply Chain Findings

| Issue Type | Severity | Count | Affected Workflows |
|------------|----------|-------|-------------------|
| github_action_from_unverified_creator_used | note | 29 | 28 workflows |
| pr_runs_on_self_hosted | warning | 1 | smoke-copilot-arm |

#### Actionlint Linting Issues

| Issue Type | Count | Affected Workflows |
|------------|-------|-------------------|
| shellcheck (SC1003 passthrough) | 206 | 33 workflows |

#### Syft SBOM Inventory

| Image | Packages | Affected Workflows |
|-------|----------|--------------------|
| ghcr.io/oraios/serena:1.7.0 | 1,678 | agentic workflows using Serena MCP |
| ghcr.io/github/gh-aw-firewall/agent:0.28.18 | 567 | firewall-enabled workflows |
| ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.18 | 347 | firewall-enabled workflows |
| ghcr.io/github/gh-aw-mcpg:v0.4.23 | 288 | MCP gateway workflows |
| grafana/mcp-grafana:1.1.0-alpine | 178 | Grafana MCP workflows |
| ghcr.io/github/gh-aw-node | 177 | node-based agent steps |
| ghcr.io/xberg-io/xberg:latest | 169 | xberg-integrated workflows |
| node:lts-alpine | 165 | node-based agent steps |
| ghcr.io/github/gh-aw-firewall/api-proxy:0.28.18 | 187 | firewall-enabled workflows |
| ghcr.io/github/gh-aw-firewall/squid:0.28.18 | 63 | firewall-enabled workflows |
| ghcr.io/github/github-mcp-server:v1.12.1 | 41 | GitHub MCP server workflows |

Total: 11 images, 3,860 packages (flat vs 2026-09-14 despite gh-aw-firewall 0.28.16→0.28.18 and gh-aw-mcpg v0.4.21→v0.4.23 bumps).

#### Runner-Guard Taint Analysis Findings

Runner-Guard Score: unchanged vs prior days (no explicit 0-100 score emitted in this run's output; qualitative grade: stable, 1 High finding fully mitigated via closed issue).

| Rule ID | Name | Severity | Affected Workflows |
|---------|------|----------|--------------------|
| RGS-005 | Excessive Permissions on Untrusted Trigger | Medium | agentic_commands.yml, ai-moderator, q, squad (4 workflows, 12 occurrences) |
| RGS-012 | Secret Exfiltration via Outbound HTTP Request | High | github-remote-mcp-auth-test (1 occurrence) — **covered by closed issue [#55652](https://github.com/github/gh-aw/issues/55652)**, re-verified today, not re-filed |

Issues created: none (RGS-012 already covered by a closed issue; RGS-005 is Medium, below the Critical/High issue-creation threshold).

#### Grype Container Vulnerability Findings

| Package | Severity | Count | Affected Workflows/Images |
|---------|----------|-------|--------------------|
| curl / libcurl (CVE-2026-18924, CVE-2026-19931) | Critical | ~24 | api-proxy, cli-proxy, squid, gh-aw-node, serena, xberg |
| openssl / libssl / libcrypto (CVE-2026-63073, CVE-2026-75803) | Critical | ~24 | squid, gh-aw-mcpg, serena, grafana, node, github-mcp-server |
| libtiff6 / libglib2.0 / libxml2 | Critical | 3 | ghcr.io/xberg-io/xberg (no upstream fix yet) |
| bind9-libs and various | Medium/High | 1,065 | firewall + MCP images (see full detail below) |

### Top Priority Issues

#### 1. zizmor `secrets-outside-env` (Medium, 8,198 occurrences, 296/299 workflows)
- **Tool**: zizmor
- **Severity**: Medium
- **Affected**: 296 of 299 workflows — near-universal, generated by a shared compiler job template
- **Description**: Jobs reference `secrets.*` without a dedicated GitHub `environment:` key, so there's no approval gate or scoping on secret access.
- **Impact**: Any code executing in the job — including anything reachable via prompt injection into an agentic step — has ambient access to every secret available to that job/repo with no additional review gate.
- **Reference**: (docs.zizmor.sh/redacted)

#### 2. zizmor `github-app` (High, 8 occurrences, 4 workflows)
- **Tool**: zizmor
- **Severity**: High
- **Affected**: squad-game-planner, squad-implement-worker, squad-plan, squad
- **Description**: `actions/create-github-app-token` is used with no `permissions:` input, so the minted token inherits the full permission set of the GitHub App installation instead of being scoped down.
- **Impact**: A compromised or injected step in these workflows would have far broader repo/org access than necessary.
- **Reference**: (docs.zizmor.sh/redacted)

#### 3. grype critical CVEs (curl/openssl family, 52 total across 10/11 images)
- **Tool**: grype
- **Severity**: Critical
- **Affected**: api-proxy, cli-proxy, squid, gh-aw-mcpg, gh-aw-node, github-mcp-server, serena, xberg, grafana/mcp-grafana, node — stable distribution unchanged since 2026-09-10
- **Description**: Container base images carry unpatched curl (CVE-2026-18924, CVE-2026-19931) and OpenSSL (CVE-2026-63073, CVE-2026-75803) CVEs.
- **Impact**: These are widely-used base-image packages; while risk is somewhat mitigated by sandboxing, unpatched criticals in agent-execution containers increase blast radius if combined with any code-execution vector.
- **Reference**: See grype output for fixed-version guidance per image.

### Fix Suggestion for zizmor `secrets-outside-env`

**Issue**: Secrets referenced in jobs with no dedicated `environment:` protection
**Severity**: Medium
**Affected Workflows**: 296 of 299 (8,198 occurrences) — by far the largest single cluster in this repo, generated by a shared Go compiler template rather than per-workflow

**Prompt to Copilot Agent**:
```
You are fixing a security vulnerability identified by zizmor.

Vulnerability: secrets-outside-env - secrets referenced without a dedicated environment
Rule: secrets-outside-env - (docs.zizmor.sh/redacted)

Current Issue:
A job references one or more `secrets.*` values (directly, or indirectly via
steps that consume org/repo secrets) but the job has no `environment:` key.
GitHub Environments let you attach protection rules (required reviewers,
wait timers, deployment branch restrictions) and scope which secrets are
even visible to a job. Without a declared environment, any code that runs
in that job -- including anything reachable via prompt injection into an
agentic step -- has ambient access to every secret available to the
job/repo, with no additional approval gate and no scoping.

Note: gh-aw generates these `.lock.yml` files from `.md` workflow sources
via a shared Go compiler template (not hand-written per workflow), and the
finding appears in nearly all 299 workflows on the same job (typically
`activation` or similar). This is a compiler/template-level issue, not a
per-workflow one -- fixing the shared job template that emits secrets
usage is far more effective than editing 296 generated lock files by hand.

Required Fix:
1. Identify the shared Go template/source that emits the job flagged by
zizmor (check pkg/workflow/*.go or the .md frontmatter compiler for the
job name shown in the finding, e.g. `activation`).
2. Determine which secrets that job actually needs (e.g. `secrets.GITHUB_TOKEN`,
an LLM provider API key, a GH App private key).
3. Add an `environment:` key to that job specifying a named GitHub
Environment (e.g. `environment: agent-runtime`), OR, if per-workflow
environments aren't desired, document why the risk is accepted and add
a `# zizmor: ignore[secrets-outside-env]` suppression with a one-line
justification comment -- only if a security reviewer has confirmed the
job's blast radius is already minimal (e.g. read-only permissions).
4. If introducing a real environment: create/configure the environment in
repo settings (required reviewers / branch restrictions as appropriate),
and confirm the job's secrets access still works in CI.
5. Recompile all workflows (`gh-aw compile` or equivalent) and re-run
zizmor to confirm the finding count drops for every regenerated
workflow, not just one.

Example:
Before:
```yaml
jobs:
activation:
needs: pre_activation
if: needs.pre_activation.outputs.activated == 'true'
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@...
with:
token: ${{ secrets.GITHUB_TOKEN }}
```

After:
```yaml
jobs:
activation:
needs: pre_activation
if: needs.pre_activation.outputs.activated == 'true'
environment: agent-runtime
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@...
with:
token: ${{ secrets.GITHUB_TOKEN }}
```

Please apply this fix at the shared compiler-template level (not to
individual `.lock.yml` files) so it takes effect across all 296 affected
workflows on the next `gh-aw compile` run. Validate against a sample of
affected workflows including: ab-testing-advisor.lock.yml, and re-run the
static-analysis scan to confirm the count drops from 8198 toward 0 (or to
a documented, justified residual with ignore annotations).
```

### All Findings Details

Zizmor High-Severity Findings (full detail)

- **github-app** (8 occurrences, High): `.github/workflows/squad-game-planner.lock.yml:366`, `.github/workflows/squad-implement-worker.lock.yml:406`, `.github/workflows/squad-plan.lock.yml:429`, `.github/workflows/squad.lock.yml:456` — dangerous use of GitHub App tokens minted without scoped `permissions:` input.
- **unpinned-images** (1 occurrence, High): `.github/workflows/smoke-service-ports.lock.yml:446` — floating `redis:7` image tag with no digest pin.
- **bot-conditions** (1 occurrence, High): `.github/workflows/squad.lock.yml:2479` — spoofable `github.actor == 'github-actions[bot]'`-style bypass check.

These 10 High findings and their 4 affected workflows have been unchanged since at least 2026-09-12/13 (byte-identical rule/workflow pairs). No existing issue has been filed for them (checked previously) — this scan does not create new issues for zizmor findings per current process, only for runner-guard Critical/High findings.

Grype Critical Findings — Full Package Detail

| Image | Critical Count | Dominant CVEs |
|-------|----------------|----------------|
| ghcr.io/oraios/serena:1.7.0 | 12 | CVE-2026-18924/19931 (curl), CVE-2026-63073/75803 (openssl) |
| ghcr.io/github/gh-aw-firewall/squid:0.28.18 | 10 | CVE-2026-18924/19931 (curl), CVE-2026-63073/75803 (openssl) |
| ghcr.io/xberg-io/xberg:latest | 7 | CVE-2026-18924/19931 (curl), CVE-2026-52490 (libtiff6), CVE-2026-58016 (libglib2.0), CVE-2026-6653 (libxml2) |
| ghcr.io/github/gh-aw-firewall/api-proxy:0.28.18 | 4 | CVE-2026-18924/19931 (curl) |
| ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.18 | 4 | CVE-2026-18924/19931 (curl) |
| ghcr.io/github/gh-aw-mcpg:v0.4.23 | 4 | CVE-2026-63073/75803 (openssl) |
| grafana/mcp-grafana:1.1.0-alpine | 4 | CVE-2026-63073/75803 (openssl) |
| node:lts-alpine | 4 | CVE-2026-63073/75803 (openssl) |
| ghcr.io/github/gh-aw-node | 2 | CVE-2026-18924/19931 (curl) |
| ghcr.io/github/github-mcp-server:v1.12.1 | 1 | CVE-2026-75803 (openssl) |

This distribution has been stable and unchanged since 2026-09-10 — most of these CVEs have no upstream fix available yet within the pinned base image versions (Alpine/Debian package repos haven't shipped patched builds).

Shellcheck / Actionlint SC1003 Findings

206 occurrences of `SC1003` ("Want to escape a single quote?") across 33 workflows, all in the shared `Execute Pi CLI` / `Execute Claude Code CLI` / `Execute Gemini CLI` step templates at `script:40-42:*`. This is a code-quality note (not a security finding) surfaced by both actionlint's embedded shellcheck pass and the standalone shellcheck tool, hence appearing in both tool counts. First appeared 2026-09-12 (0→130), grew to 206/212 by 2026-09-13, and has now been flat for 3 consecutive scans (2026-09-14, 2026-09-16) — still not root-caused to a specific shared component. Recommend prioritizing root-cause investigation given the finding count is large and duplicated across two tool reports.

### Historical Trends

- **Previous Scan**: 2026-09-14 (no 2026-09-15 scan on record)
- **Total Findings Then**: 15,530
- **Total Findings Now**: 15,569
- **Change**: +39 (+0.25%)

#### New Issues
None — no new rule types or newly-affected workflows this scan.

#### Resolved Issues
None — zizmor's -1 (adhoc-packages) and grype's severity-mix shift are within normal day-to-day noise, not resolutions of a tracked issue.

#### Notable Pattern
Grype's critical-severity distribution (52 findings across 10/11 images) has now been byte-identical for a full week (since 2026-09-10) — this looks like a stable baseline rather than an active regression, since the dominant CVEs (curl CVE-2026-18924/19931, openssl CVE-2026-63073/75803) have no upstream-fixed package versions yet in the pinned Alpine/Debian bases.

### Recommendations

1. **Immediate**: Fix all Critical and High severity security issues — prioritize zizmor's `github-app` (unscoped App tokens, 4 workflows) and `bot-conditions` (spoofable actor check, 1 workflow), both High severity with no filed issue yet.
2. **Short-term**: Address the `secrets-outside-env` Medium cluster at the shared compiler-template level (see Fix Suggestion above) and root-cause the SC1003 shellcheck/actionlint regression (206/212 findings, flat for 3 days but unresolved).
3. **Long-term**: Establish automated static analysis in CI/CD (already running daily via this workflow) and track curl/openssl base-image CVEs for upstream patches to clear the stable 52-critical grype baseline.
4. **Prevention**: Update workflow templates to avoid common patterns (unscoped App tokens, missing `environment:` on secret-consuming jobs) and use syft inventory data to review unexpected container packages before adding new MCP/tool images.

### Next Steps

- [ ] Apply suggested fix for `secrets-outside-env` at the compiler-template level
- [ ] Review and fix the 3 High-severity zizmor findings without existing issues (github-app x4wf, unpinned-images x1wf, bot-conditions x1wf)
- [ ] Root-cause the SC1003 shellcheck/actionlint regression (flat at 206/212 for 3 days)
- [ ] Track upstream fixes for the stable grype critical baseline (curl, openssl CVEs)
- [ ] Continue monitoring RGS-005 (Medium) for potential permission scoping improvements on agentic_commands.yml, ai-moderator, q, squad

> [!WARNING]
>
> Firewall blocked 1 domain
>
> The following domain was blocked by the firewall during workflow execution:
>
> - `api.anthropic.com`
>
> To allow these domains, add them to the `network.allowed` list in your workflow frontmatter:
>
> ```yaml
> network:
> allowed:
> - defaults
> - "api.anthropic.com"
> ```
>
> See [Network Configuration](https://github.github.com/gh-aw/reference/network/) for more information.
>
>

> Generated by [📊 Static Analysis Report](https://github.com/github/gh-aw/actions/runs/35056817903) · claude · agent · 260 AIC · ⌖ 10.8 AIC · ⊞ 12.3K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fstatic-analysis-report%22&type=issues)
> - [x] expires on Sep 22, 2026, 9:18 PM UTC-08:00

Start in pkg/workflow/*.go or the .md frontmatter compiler to find the shared template emitting the activation job, rather than editing generated .lock.yml files. Review the affected job's secret usage and environment-handling requirements, then run gh-aw compile and zizmor against a sample such as ab-testing-advisor.lock.yml. Done means the shared fix regenerates workflows and the secrets-outside-env count drops or has documented, reviewed suppressions.

Written by the indexing model from the issue text.