🔒 Zizmor Security Analysis Report - November 1, 2025

[github-actions[bot]]

🔒 Zizmor Security Analysis Report - November 1, 2025

Comprehensive security scan results for all agentic workflows in the gh-aw repository.

Executive Summary

Today's security scan using zizmor v1.16.1 identified 30 security findings across 65 workflows. The issues range from High to Low severity, with the most critical being the use of insecure workflow triggers that could lead to privilege escalation attacks.

**Key (redacted)

• 🔴 5 High Severity findings (dangerous workflow triggers)
• 🟡 14 Medium Severity findings (excessive permissions, credential exposure)
• 🟢 11 Low Severity findings (potential template injection)

**Most Common (redacted) Excessive permissions (permissions: read-all) found in 13 workflows, violating the principle of least privilege.

**Highest Risk (redacted) Dangerous triggers (workflow_run) found in 3 workflows, creating potential privilege escalation vulnerabilities.

Full Security Scan Report

Security Scan Statistics

Metric	Value
Scan Date	2025-11-01
Scanner	zizmor v1.16.1
Workflows Scanned	65
Workflows with Findings	~20 (some workflows have multiple issues)
Total Findings	30
Critical Severity	0
High Severity	5
Medium Severity	14
Low Severity	11

Findings by Issue Type

1. Excessive Permissions (Medium Severity) - 13 Occurrences

**(redacted) Medium
**(redacted) High
**(redacted) Workflows using permissions: read-all grant unnecessary access

**Affected (redacted)

• ci-doctor
• copilot-agent-analysis
• copilot-pr-prompt-analysis
• daily-news
• daily-perf-improver
• daily-test-improver
• smoke-detector
• technical-doc-writer

**(redacted) If a workflow is compromised, attackers gain access to all repository resources instead of just what's needed.

**Fix (redacted) Medium - Should be addressed during next maintenance cycle

**Recommended (redacted) Replace permissions: read-all with specific scopes:

permissions:
  contents: read
  issues: write
  pull-requests: write
  actions: read

---

2. Template Injection (Low Severity) - 11 Occurrences

**(redacted) Low
**(redacted) High
**(redacted) Potential code injection via template expansion in workflow expressions

**Affected (redacted)

• duplicate-code-detector
• mcp-inspector
• smoke-codex

**(redacted) In certain contexts, untrusted input in template expressions could lead to code execution.

**Fix (redacted) Low - Address when refactoring workflows

**Recommended (redacted) Avoid using user-controlled input directly in expressions. Use intermediate environment variables.

---

3. Artipacked (Medium Severity) - 3 Occurrences

**(redacted) Medium
**(redacted) Low
**(redacted) Potential credential persistence through GitHub Actions artifacts

**Affected (redacted)

• daily-perf-improver
• daily-test-improver
• unbloat-docs

**(redacted) Credentials or sensitive data might be accidentally included in uploaded artifacts, persisting beyond the workflow run.

**Fix (redacted) Medium - Review artifact uploads in these workflows

**Recommended (redacted)

1. Audit what's being uploaded in artifacts
2. Ensure no secrets or credentials are included
3. Consider using artifact retention policies

---

4. Dangerous Triggers (High Severity) - 3 Occurrences ⚠️

**(redacted) High
**(redacted) Medium
**(redacted) Use of workflow_run trigger which creates privilege escalation vulnerabilities

**Affected (redacted)

• ci-doctor
• dev-hawk
• smoke-detector

**(redacted) Critical security risk. The workflow_run trigger allows code from untrusted sources (like fork PRs) to execute with elevated permissions from the main branch.

**Fix (redacted) 🔴 HIGH - Should be addressed immediately

**Attack (redacted)

1. Attacker submits malicious PR from a fork
2. PR triggers a workflow that completes
3. The completion triggers a workflow_run workflow
4. The workflow_run workflow executes with full main branch permissions
5. Attacker's code runs with write access to the repository

**Recommended (redacted)

• ci-doctor: Change to workflow_dispatch with manual triggering, or create a scheduled job that polls for failures
• dev-hawk: Replace with direct push trigger on monitored branches
• smoke-detector: Consolidate into smoke test workflows or use workflow_call

---

Priority Matrix

Issue Type	Severity	Count	Priority	Recommended Timeline
dangerous-triggers	High	3	🔴 Critical	Within 1 week
excessive-permissions	Medium	13	🟡 High	Within 1 month
artipacked	Medium	3	🟡 Medium	Within 1 month
template-injection	Low	11	🟢 Low	Next quarter

Detailed Fix Guides

Fix Template: Excessive Permissions

Issue: Workflows using permissions: read-all grant unnecessary access to repository resources.

Security Impact:

• Increased attack surface if workflow is compromised
• Violates principle of least privilege
• Potential for unauthorized data access or modifications

Fix Steps:

1. Identify actual permission needs for the workflow
2. Replace permissions: read-all with specific scopes
3. Test the workflow to ensure it still functions correctly

Example:

# Before (Insecure)
permissions: read-all

# After (Secure)
permissions:
  contents: read        # Read repository code
  issues: write         # Create/comment on issues
  pull-requests: write  # Comment on PRs
  actions: read         # Read workflow run details

Common Permission Scopes:

• actions: read - Read workflow runs and artifacts
• contents: read - Read repository content
• issues: write - Create and comment on issues
• pull-requests: write - Create and comment on PRs

---

Fix Template: Dangerous Triggers

Issue: Use of workflow_run trigger creates privilege escalation vulnerabilities.

Security Impact:

• CRITICAL: Code from untrusted sources can execute with elevated permissions
• Bypasses branch protection rules
• Token exposure with write permissions
• Supply chain attack vector

Why workflow_run is Dangerous:
When a PR from a fork triggers a workflow that then triggers another workflow via workflow_run:

1. Initial workflow runs with restricted permissions (safe)
2. workflow_run triggered workflow runs with full repo permissions (dangerous!)
3. Attackers can inject malicious code that executes with elevated privileges

Fix Options:

Option 1: Remove workflow_run (Recommended)

# Before (Insecure)
on:
  workflow_run:
    types: [completed]
    workflows:
      - Daily Test Improver

# After (Secure)
on:
  schedule:
    - cron: '0 6 * * *'  # Run on schedule
  workflow_dispatch:      # Allow manual triggering

Option 2: Use Safer Triggers

# For CI/CD workflows
on:
  push:
    branches: [main]
  pull_request:
    types: [opened, synchronize]

Option 3: Manual Dispatch with Validation

on:
  workflow_dispatch:
    inputs:
      workflow_run_id:
        description: 'Workflow run ID to process'
        required: true

Migration Strategy for Affected Workflows:

• ci-doctor: Change to workflow_dispatch or scheduled polling
• dev-hawk: Trigger directly on push events
• smoke-detector: Consolidate into smoke test workflows

Recommendations

Immediate Actions (This Week)

1. ✅ Review and fix dangerous-triggers in ci-doctor, dev-hawk, and smoke-detector
2. ✅ Validate artifact contents in workflows flagged for artipacked
3. ✅ Document findings in team security review

Short-term Actions (This Month)

1. Address excessive-permissions by replacing read-all with specific scopes
2. Create workflow security guidelines for the team
3. Set up automated zizmor scanning in CI/CD pipeline

Long-term Actions (This Quarter)

1. Review template-injection findings during workflow refactoring
2. Implement workflow security training for contributors
3. Establish quarterly security audits for workflows

Preventive Measures

1. Add zizmor to pre-commit hooks to catch issues before they're merged
2. Create secure workflow templates with minimal permissions
3. Document security best practices in contributing guidelines
4. Regular security reviews of new workflow contributions

Historical Context

This is the first security scan using zizmor for this repository. Future scans will include trend analysis comparing:

• Number of findings over time
• New vs. resolved issues
• Security posture improvements

Next Steps

1. Immediate: Address dangerous-triggers findings (High priority)
2. This week: Create issues for each category of findings
3. This month: Implement fixes for Medium severity issues
4. Ongoing: Monitor for new security patterns in workflow additions

References

• Zizmor Documentation
• GitHub Actions Security Best Practices
• Security Lab Research

---

**Scan Performed (redacted) Zizmor Security Analyzer Agent
**(redacted) 2025-11-01
**(redacted) githubnext/gh-aw
**Workflow (redacted) §18990005010

AI generated by Zizmor Workflow Security Analyzer

[github-actions[bot]]

This discussion was automatically closed because it was created by an agentic workflow more than 1 week ago.