[static-analysis] Report - 2026-08-28 #56542

🔍 Static Analysis Report - 2026-08-28

Analysis Summary

• Tools Used: zizmor, poutine, actionlint, runner-guard, syft, grype, yamllint, shellcheck
• Total Findings: 1618 (down from 1665 yesterday, -47 / -2.8%)
• Workflows Scanned: 296 (296 succeeded, 0 failed)
• Workflows Affected: ~40 (across all tools; grype/syft findings are per-container-image rather than per-workflow)

Findings by Tool

Clustered Findings by Tool and Type

Zizmor Security Findings

Poutine Supply Chain Findings

None — scanner ran clean across all 296 workflows.

Actionlint Linting Issues

None — 0 issues across all 296 workflows (actionlint's own rule engine; its embedded shellcheck/pyflakes integration is what surfaced the shellcheck findings below).

Syft SBOM Inventory

Runner-Guard Taint Analysis Findings

No overall Runner-Guard Score/grade was printed in this run's output.

Issues created: none. RGS-012 on github-remote-mcp-auth-test.lock.yml is already covered by closed issue #55652 (same rule + file — skipped per dedup policy). RGS-005 is Medium severity, which is below the Critical/High threshold for issue creation.

Grype Container Vulnerability Findings

Notable change: grype critical findings are now 0 across all 10 images — the last remaining critical (GHSA-23hp-3jrh-7fpw in tar@7.5.16 on node:lts-alpine) is resolved. See Historical Trends below for the image-version-bump breakdown behind the high-severity improvement.

Yamllint YAML Linting Findings

None.

Shellcheck Shell Linting Findings

Root cause: .github/workflows/shared/go-make.md and .github/workflows/shared/hippo-memory.md expand $INPUT_ARGS unquoted in their run: blocks. Unchanged since 2026-08-27. See fix suggestion below.

Top Priority Issues

1. RGS-012 — Secret Exfiltration via Outbound HTTP Request (High)

• Tool: runner-guard
• Count: 1
• Severity: High
• Affected: github-remote-mcp-auth-test.lock.yml:1700
• Description: A run: step ("Verify raw GitHub remote MCP handshake") performs an HTTP request pattern that runner-guard's taint model flags as a potential secret-exfiltration vector.
• Impact: If the target host were attacker-influenced, secrets available to the job could be sent off-repo.
• Status: Already tracked and closed as reviewed/accepted in issue [static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in github-remote-mcp-auth-test.lock.yml #55652 (persists across scans; no new issue filed per dedup policy).

2. gh-aw-mcpg image regression (High, grype)

• Tool: grype
• Count: High severity findings rose 18 → 35 after bumping ghcr.io/github/gh-aw-mcpg from v0.4.10 → v0.4.13
• Affected: ghcr.io/github/gh-aw-mcpg:v0.4.13
• Description: New Go module CVEs (sigstore/fulcio, moby/go-archive, google.golang.org/grpc) appeared with the version bump.
• Impact: Worth a follow-up dependency bump inside the mcpg image build to pick up patched versions of these three modules.
• Reference: GHSA-f5mr-q85p-6hh6, GHSA-hfg8-hc9c-6c3h, GHSA-hrxh-6v49-42gf

3. shellcheck SC2086 in mcp-scripts shared tools (Note, but easily fixed)

• Tool: shellcheck
• Count: 6 (across 4 workflows, 2 shared source files)
• Severity: Note
• Affected: daily-cli-performance, daily-hippo-learn, hippo-embed, smoke-claude
• Description: Unquoted $INPUT_ARGS in generated mcp-scripts run: blocks.
• Impact: Low likelihood of exploitation, but a legitimate glob-expansion risk if args ever contains a wildcard pattern that matches files in the runner's working directory.

Fix Suggestion for shellcheck SC2086 (mcp-scripts unquoted args)

Issue: $INPUT_ARGS expanded unquoted in go/make/hippo mcp-scripts tool definitions
Severity: Note
Affected Workflows: 4 workflows (2 root-cause shared files)

Prompt to Copilot Agent:

You are fixing a shellcheck SC2086 finding ("Double quote to prevent globbing and word splitting") in gh-aw's shared mcp-scripts tool definitions.

Files to fix:
- .github/workflows/shared/go-make.md (tools: go, make)
- .github/workflows/shared/hippo-memory.md (tool: hippo)

Each tool's `run:` block currently does: `<cmd> $INPUT_ARGS` unquoted. Do NOT wrap $INPUT_ARGS in double quotes directly — these tools accept multi-word argument strings by design (e.g. args: 'test ./...') and quoting would collapse them into one argument, breaking the tool.

Instead, replace the unquoted expansion with an array split that avoids glob expansion:
  read -ra ARGS <<< "$INPUT_ARGS"
  <cmd> "${ARGS[@]}"

Apply this to the go, make, and hippo tool run blocks. Recompile all workflows afterward so the four affected .lock.yml files (daily-cli-performance, daily-hippo-learn, hippo-embed, smoke-claude) regenerate cleanly, and confirm shellcheck no longer reports SC2086 for these steps.

All Findings Details

Historical Trends

• Previous Scan: 2026-08-27
• Total Findings Then: 1665
• Total Findings Now: 1618
• Change: -47 (-2.8%)

New Issues

None. All findings this run are either unchanged from 2026-08-27 or improvements.

Resolved Issues

• Grype critical fully resolved (1 → 0): the last remaining critical finding, GHSA-23hp-3jrh-7fpw (tar CVE on node:lts-alpine), is fixed. This is the first scan since tracking began (2026-08-22) with zero critical container findings.
• Grype high dropped 287 → 273 (-14), driven by container image version bumps:
  • gh-aw-firewall/api-proxy 0.28.7 → 0.28.9: High findings 18 → 4
  • gh-aw-firewall/cli-proxy 0.28.7 → 0.28.9: High findings 18 → 4
  • gh-aw-firewall/agent 0.28.7 → 0.28.9: total findings 350 → 318 (High unchanged at 4)
  • Partially offset by gh-aw-mcpg v0.4.10 → v0.4.13 regressing High 18 → 35 (see Top Priority Issue Add workflow: githubnext/agentics/weekly-research #2)
  • github-mcp-server v1.10.1 → v1.11.0: roughly flat

Recommendations

1. Immediate: No Critical/High findings need new action this run — RGS-012 is already tracked ([static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in github-remote-mcp-auth-test.lock.yml #55652), and the grype critical is resolved.
2. Short-term: Bump the gh-aw-mcpg image's Go module dependencies (sigstore/fulcio ≥1.8.6, moby/go-archive ≥0.3.0, grpc ≥1.82.1) to reverse the High-severity regression from the v0.4.13 bump. Apply the SC2086 fix above to the two shared mcp-scripts files.
3. Long-term: Consider bumping oraios/serena past 1.7.0 once a release with updated tar/minimatch/glob/brace-expansion npm dependencies is available — it accounts for the largest share of grype High findings (155) and package footprint (1678 packages) of any scanned image.
4. Prevention: The 30 workflow_dispatch workflows without a concurrency.job-discriminator and the 10 workflows referencing /tmp/ directly are cheap, mechanical fixes worth batching into a cleanup pass.

Next Steps

• Apply the SC2086 fix to shared/go-make.md and shared/hippo-memory.md
• Bump gh-aw-mcpg image dependencies to address the new High-severity Go module CVEs
• Evaluate an oraios/serena version bump to shed its outdated npm dependency tree
• Batch-add concurrency.job-discriminator to the 30 flagged workflow_dispatch workflows
• Route remaining /tmp/-referencing prompts through /tmp/gh-aw/agent/

References:

• §33150116946

network:
  allowed:
    - defaults
    - "api.anthropic.com"

Generated by 📊 Static Analysis Report · claude · agent · 231.5 AIC · ⌖ 8.89 AIC · ⊞ 11.9K · ◷

• expires on Sep 3, 2026, 11:36 PM UTC-08:00