[static-analysis] Report - 2026-11-08

[github-actions[bot]]

🔍 Static Analysis Report - 2026-11-08

Analysis Summary

• Tools Used: zizmor, poutine, actionlint, runner-guard, syft, grype, yamllint, shellcheck
• Workflows Scanned: 362 (all compiled successfully, 221 compiler warnings)
• Total Findings: 19,184 (zizmor 16,389 · poutine 29 · actionlint 2 · runner-guard 19 · grype 2,743 · yamllint 0 · shellcheck 2 · syft is inventory only)
• Actions taken: no pull request opened. There are no Critical/High runner-guard findings, and the remaining High zizmor findings are generated-lock-file or upstream-managed items (see below).

Findings by Tool

Tool	Total	Critical	High	Medium	Low
zizmor (security)	16,389	0	4	12,596	3,785 (+4 informational)
poutine (supply chain)	29	0	0	1 (warning)	28 (note)
actionlint (linting)	2	-	-	-	-
runner-guard (taint analysis)	19	0	0	19	0
syft (SBOM inventory)	12 images / 3,926 packages	-	-	-	-
grype (container CVEs)	2,743	79	715	923	152 (+869 negligible, 5 unknown)
yamllint (yaml linting)	0	-	-	-	-
shellcheck (shell linting)	2	-	-	-	-

Clustered Findings by Tool and Type

Zizmor Security Findings

Issue Type	Severity	Count	Affected Workflows
secrets-outside-env	Medium	12,503	354 workflows
self-repository	Low	3,346	362 workflows (uses: ./actions/setup)
adhoc-packages	Low	393	305 workflows
artipacked	Medium	92	91 workflows
template-injection	Low / Info	46	43 workflows (smoke-, engine-conformance-, eslint-*, repo-tree-map)
undocumented-permissions	Low	3	super-linter, stale-pr-cleanup, draft-pr-cleanup
dangerous-triggers	High	3	ai-moderator, q, squad (issue_comment trigger)
bot-conditions	High	1	squad (pre_activation if: at line 3043)
secrets-inherit	Medium	1	1 workflow
superfluous-actions	Info	1	1 workflow

Poutine Supply Chain Findings

Issue Type	Severity	Count	Affected Workflows
github_action_from_unverified_creator_used	Note	28	~25 workflows (mostly pinned astral-sh/setup-uv; also safedep/pmg, erlef/setup-beam, actions-ecosystem/action-add-labels, gaurav-nelson/github-action-markdown-link-check)
pr_runs_on_self_hosted	Warning	1	smoke-copilot-arm (ubuntu-24.04-arm, a GitHub-hosted ARM label rather than a true self-hosted runner)

Actionlint Linting Issues

Issue Type	Count	Affected Workflows
shellcheck integration (SC1003)	2	sergo.lock.yml:1344

Syft SBOM Inventory

Image	Packages
ghcr.io/oraios/serena:1.7.0	1,678
ghcr.io/github/gh-aw-firewall/agent:0.29.7	590
ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.7	350
ghcr.io/github/gh-aw-mcpg:v0.5.4	290
ghcr.io/github/gh-aw-firewall/api-proxy:0.29.7	197
ghcr.io/github/gh-aw-node	178
grafana/mcp-grafana:1.1.0-alpine	178
ghcr.io/xberg-io/xberg:1.3.6	169
node:lts-alpine	166
ghcr.io/github/github-mcp-server:v2.1.0	41
ghcr.io/github/gh-aw-firewall/squid:0.29.7	63
ghcr.io/github/gh-aw-firewall/router:0.29.7	26

Runner-Guard Taint Analysis Findings

No Critical or High findings. The runner-guard score and grade were not present in the compile output. The two RGS-018 High findings recorded yesterday are not reported today.

Rule ID	Name	Severity	Count	Affected Workflows
RGS-005	Excessive Permissions on Untrusted Trigger	Medium	19	ai-moderator.lock.yml (7), squad.lock.yml (5), q.lock.yml (5), agentic_commands.yml (1), agentic-workqueue.yml (1)

Pull requests staged: none (runner-guard PRs are limited to Critical/High findings).

Grype Container Vulnerability Findings

All 12 scans have an explicit Grype scan completed line; none failed or were omitted.

Image (pinned reference)	Scan Status	Finding Count
gh-aw-firewall/agent:0.29.7@sha256:bd8d363c...1cb2f5	completed	347
gh-aw-firewall/api-proxy:0.29.7@sha256:c3b4c800...b79b94a	completed	10
gh-aw-firewall/squid:0.29.7@sha256:0790d978...4d154	completed	18
gh-aw-mcpg:v0.5.4@sha256:801db64c...1b86c09	completed	87
gh-aw-node@sha256:2c2ea524...99749f	completed	11
github-mcp-server:v2.1.0@sha256:f6056fc1...e0f8a	completed	34
gh-aw-firewall/cli-proxy:0.29.7@sha256:d2c0259d...cce124bb	completed	7
gh-aw-firewall/router:0.29.7@sha256:6f1b3160...95bb29c	completed	0
oraios/serena:1.7.0@sha256:6c9459e4...ab6730	completed	1,703
xberg-io/xberg:1.3.6@sha256:f1e23c63...4e2e	completed	428
node:lts-alpine@sha256:06d7adf3...8d53b4	completed	23
grafana/mcp-grafana:1.1.0-alpine@sha256:e0eb29cd...ca6cb4	completed	75

Top Critical/High packages (finding lines across all images):

Package	Severity	Count	Affected Images
curl / libcurl4t64	Critical (14 each), High (50 each)	128	serena, xberg
pillow	Critical (10), High (46)	56	serena
tar	High	24	serena
libssl3 / libcrypto3	High (34), Critical (5)	39	grafana/mcp-grafana, gh-aw-mcpg, github-mcp-server
zlib (CVE-2026-4738, fix 1.4-r0)	Critical	7	api-proxy, cli-proxy, squid, gh-aw-mcpg, gh-aw-node, grafana/mcp-grafana, node:lts-alpine
pyjwt, certifi (GHSA-6q48-6c7w-9gw2), urllib3, filelock	Critical/High	~20	serena
undici, brace-expansion	High	6	node:lts-alpine
Go stdlib / x/net / klauspost/compress	High	6	grafana/mcp-grafana, firewall agent

ghcr.io/oraios/serena alone accounts for 1,703 of 2,743 findings (62%), and xberg for another 428.

Yamllint YAML Linting Findings

None.

Shellcheck Shell Linting Findings

Code	Count	Affected Workflows
SC1003	2	sergo.lock.yml (step "Execute Claude Code CLI", script:57)

Top Priority Issues

1. dangerous-triggers / bot-conditions (zizmor, High)

• Count: 4 (3 dangerous-triggers, 1 bot-conditions)
• Affected: ai-moderator.lock.yml:64, q.lock.yml:73, squad.lock.yml:67 and :3043
• Description: issue_comment triggers are flagged as insecure triggers, and the generated pre_activation condition compares github.actor against a bot name, which zizmor treats as spoofable.
• Impact: These are comment-driven agent workflows. The compiler already gates them with author-association checks (OWNER/MEMBER/COLLABORATOR) and activation roles. They are by-design and recurring. squad.md declares source: github/squad/workflows/squad.md@dev (upstream-managed), and the others are compiler-generated .lock.yml files, so no in-repo fix is possible.
• Reference: (docs.zizmor.sh/redacted) · (docs.zizmor.sh/redacted)

2. Grype Critical findings in container images

• Count: 79 Critical across 9 images; 715 High
• Description: Mostly OS packages (curl/libcurl, zlib CVE-2026-4738, libssl) and Python packages in serena (pillow, pyjwt, certifi).
• Impact: Third-party tool images (serena, xberg, grafana) dominate. Bumping the pinned digests is the primary remediation. Most firewall-image findings have fixed versions (for example zlib 1.4-r0, musl 1.2.6-r3).

3. secrets-outside-env (zizmor, Medium)

• Count: 12,503, which is 76% of all zizmor findings
• Description: Compiler-emitted secrets.* references in generated lock files without a dedicated environment. It is an architecture-wide pattern, so it is best handled with a compiler-level decision or an audit suppression rather than per-workflow edits.

Fix Suggestion for template-injection (zizmor)

Issue: ${{ ... }} expressions interpolated directly into run: scripts instead of being passed through env:.
Severity: Low (Info for some)
Affected Workflows: 43 workflows (smoke-update-cross-repo-pr has 4)

Prompt to Copilot Agent:

You are fixing a template-injection finding reported by zizmor.

Rule: template-injection - (docs.zizmor.sh/redacted)

Problem: a `run:` step interpolates a GitHub expression directly into the script.
The expanded value becomes part of the shell source, so attacker-influenced values
(branch names, titles, inputs) can inject commands.

Fix:
1. Find each flagged line in the affected .lock.yml (run `gh aw compile` and read the zizmor output).
2. Do NOT edit .lock.yml by hand. Edit the source .md workflow or the Go compiler template
   that emits the step (pkg/workflow), then run `make recompile`.
3. Move the expression into the step's `env:` block and reference it as a shell variable.

Before:
  run: echo "Branch is ${{ github.head_ref }}"

After:
  env:
    HEAD_REF: ${{ github.head_ref }}
  run: echo "Branch is ${HEAD_REF}"

Affected: smoke-update-cross-repo-pr, smoke-work-queue*, smoke-service-ports, smoke-azure-*,
engine-conformance-*, eslint-*, repo-tree-map. Skip workflows with a `source:` frontmatter entry.
Validate with `make recompile` and re-run the zizmor scan.

All Findings Details

High severity zizmor details

• ai-moderator.lock.yml:64:3 dangerous-triggers (issue_comment)
• q.lock.yml:73:3 dangerous-triggers
• squad.lock.yml:67:3 dangerous-triggers
• squad.lock.yml:3043:211 bot-conditions (github.actor == 'github-actions[bot]' in the pre_activation if:)

Compiler / tool notes

• zizmor failed was reported by the compile step: it found 4 high/critical findings (the items above).
• 69 slash_command entries exist; 2 do not use centralized routing.
• Several sub-agent model hints (inherit, small) may be incompatible with the claude engine's model-routing API.
• Compiler suggestion repeated for several workflows: workflow_dispatch with no concurrency.job-discriminator.

Historical Trends

• Previous Scan: 2026-11-07
• Zizmor then → now: 19,323 → 16,389 (−2,934, −15.2%). The compile output format differs slightly from the prior run, so part of the drop may be parsing rather than a real reduction. undocumented-permissions fell from 3,053 to 3.
• Grype: 2,741 → 2,743 (+2). All 12 scans completed in both runs.
• Runner-guard High: 2 → 0 (RGS-018 on the Execute Pi CLI step is not reported today). RGS-005 Medium stays at 19.
• Poutine: 57 → 29 findings (unverified-creator notes 57 → 28).
• Shellcheck / actionlint: unchanged (SC1003 ×2 in sergo).
• Workflows scanned: 359 → 362.

New Issues

• None among the High-severity finding types.

Resolved Issues

• RGS-018 (High) no longer reported.
• The undocumented-permissions bulk of about 3,050 findings is gone.

Recommendations

1. Immediate: Refresh the pinned digests for serena, xberg, and grafana/mcp-grafana, and for the firewall images with an available fix (zlib, musl, sqlite-libs). These are the Critical/High CVEs with a fix available.
2. Short-term: Fix the template-injection findings (43 workflows) in the compiler templates. Decide whether secrets-outside-env should be suppressed at the compiler level, since it makes up 76% of the noise.
3. Long-term: Raise the bot-conditions and dangerous-triggers findings upstream (github/squad, ai-moderator, q generator) so that the author-association gating is recognised as a mitigation.
4. Prevention: Use the syft inventory to review the 1,678-package serena image, which holds 62% of all CVE findings.

Next Steps

• Bump container digests with available fixes
• Apply the template-injection fix prompt to the compiler templates
• Triage the secrets-outside-env suppression question
• Review SC1003 in the sergo "Execute Claude Code CLI" script generator

References:

• §42447688942

Generated by 📊 Static Analysis Report · claude · routed: sonnet55 high · ~47 AIC · ⌖ ~2 AIC · ⊞ 9.6K · ◷

• expires on Nov 14, 2026, 9:10 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Static Analysis Report.

A newer discussion is available at Discussion #76143.