Static Analysis Report - 2025-11-29

[github-actions[bot]]

Analysis Summary

Comprehensive static analysis scan completed on 2025-11-29 covering all 89 agentic workflow files using three industry-standard tools: zizmor (security scanner), poutine (supply chain security), and actionlint (workflow linter).

Key Findings:

• Critical Issue Identified: Template injection vulnerability affects ALL 89 workflows (361 occurrences)
• Security Priority: High - Immediate action recommended
• Code Quality: 14 linting issues across 11 workflows (mostly minor)
• Supply Chain: Clean - No supply chain security concerns detected

Full Static Analysis Report

Tools Used

Tool	Purpose	Version
zizmor	GitHub Actions security scanner	latest
poutine	Supply chain security analyzer	latest
actionlint	GitHub Actions workflow linter	latest

Executive Summary Statistics

Overview

Metric	Count
Workflows Scanned	89
Total Findings	378
Critical/High Severity	364
Medium Severity	1
Code Quality Issues	14

Findings by Tool

Tool	Total	Critical	High	Medium	Low	Info
zizmor	364	0	361	1	0	2
poutine	0	0	0	0	0	0
actionlint	14	-	-	-	-	-

Detailed Findings

🔒 Zizmor Security Findings

Total Security Issues: 364 affecting 100% of workflows (89/89)

By Severity

• High: 361 findings
• Medium: 1 finding
• Informational: 2 findings

By Issue Type

Issue Type	Count	Severity	Affected Workflows	Reference
template-injection	361	High	89/89 (100%)	Documentation
unpinned-uses	1	High	1 workflow	Documentation
artipacked	1	Medium	1 workflow	Documentation
excessive-permissions	1	High	1 workflow	Documentation

Priority Issue: Template Injection (361 occurrences)

Description: Code injection via template expansion from user-controlled data

Impact: The workflows use GitHub Actions template expressions (e.g., ${{ github.event.issue.number }}, ${{ github.event.comment.id }}) in contexts where they could expand attacker-controlled data. This creates a template injection vulnerability that could allow:

1. Command injection through malicious input
2. Environment variable manipulation
3. Potential secrets exfiltration

Example Vulnerable Pattern:

run: |
  cat << 'PROMPT_EOF' | envsubst >> "$GH_AW_PROMPT"
  (context name="issue-number")#${{ github.event.issue.number }}(/context)
  (context name="comment-id")${{ github.event.comment.id }}(/context)
  PROMPT_EOF

Affected Workflows: All 89 workflows contain this pattern in the "Append GitHub context to prompt" step.

🔍 Actionlint Linting Findings

Total Issues: 14 affecting 12% of workflows (11/89)

By Kind

Issue Type	Count	Affected Workflows
shellcheck	12	9 workflows
syntax-check	1	1 workflow (cloclo.lock.yml)
expression	1	1 workflow (close-old-discussions.lock.yml)

Details

Shellcheck Issues: Mostly minor shell script quality issues such as:

• SC2086: Missing double quotes to prevent globbing
• Other shell best practice violations

Syntax Check: Invalid key "names" in issues section (cloclo.lock.yml:377)

Expression Error: Undefined property github.aw.inputs.count (close-old-discussions.lock.yml:547)

🔗 Poutine Supply Chain Findings

Total Findings: 0

✅ No supply chain security issues detected - All action references and dependencies are secure.

Fix Recommendations

🚨 IMMEDIATE (High Priority)

1. Fix Template Injection Vulnerability (361 occurrences, all workflows)

Recommended Approach: Use environment variables instead of direct template expansion

Before (Vulnerable):

run: |
  cat << 'PROMPT_EOF' | envsubst >> "$GH_AW_PROMPT"
  (context name="issue-number")#${{ github.event.issue.number }}(/context)
  PROMPT_EOF

After (Secure):

env:
  ISSUE_NUMBER: ${{ github.event.issue.number }}
  COMMENT_ID: ${{ github.event.comment.id }}
run: |
  cat >> "$GH_AW_PROMPT" << 'PROMPT_EOF'
  (context name="issue-number")#${ISSUE_NUMBER}(/context)
  (context name="comment-id")${COMMENT_ID}(/context)
  PROMPT_EOF

Alternative: Consider whether GitHub context information is necessary at all. If the agent has access to GitHub API, this context injection might be redundant.

Implementation Strategy:

1. Update the gh-aw workflow compiler to generate secure code patterns
2. Recompile all workflows with the updated compiler
3. Test a sample workflow to verify functionality
4. Deploy fixes systematically

2. Fix Unpinned Action Reference

One workflow uses an unpinned action reference. Pin to a specific SHA for security.

3. Review Excessive Permissions

One workflow has overly broad permissions. Apply principle of least privilege.

📋 SHORT-TERM (Medium Priority)

1. Address Actionlint Issues

• Fix shellcheck warnings in 9 workflows (mostly quote-related)
• Fix syntax error in cloclo.lock.yml (invalid "names" key)
• Fix expression error in close-old-discussions.lock.yml (undefined property)

2. Review Artipacked Finding

One workflow may be persisting credentials through artifacts. Review and sanitize if needed.

🔄 LONG-TERM (Best Practices)

1. Integrate Static Analysis in CI/CD

   • Add zizmor, poutine, and actionlint to pre-commit hooks
   • Run scans automatically on pull requests
   • Block merges if critical security issues are found

2. Update Workflow Templates

   • Modify gh-aw compiler to generate secure code by default
   • Add security-focused code review guidelines
   • Document secure patterns for workflow authors

3. Establish Security Baseline

   • Set policy: Zero High/Critical security findings
   • Regular scanning schedule (current: daily)
   • Track trends over time

Historical Context

This is the first comprehensive static analysis scan using all three tools. No historical comparison data is available yet. Future scans will track:

• New vulnerabilities introduced
• Issues resolved
• Trend analysis over time

Action Items

• URGENT: Fix template injection in all 89 workflows (consider compiler-level fix)
• Fix unpinned action reference and excessive permissions
• Address actionlint findings (syntax, expression, shellcheck)
• Integrate static analysis tools into CI/CD pipeline
• Schedule next scan for 2025-11-30
• Review whether GitHub context injection is necessary for agent operation

Validation

After implementing fixes:

1. Run gh aw compile --zizmor --actionlint --poutine to verify all issues resolved
2. Test workflows with various inputs to ensure functionality maintained
3. Monitor for regressions in subsequent scans

Resources

• Zizmor Documentation
• Poutine Documentation
• Actionlint Documentation
• Template Injection Fix Guide

Scan Artifacts

Full analysis results have been saved to the cache memory:

• Summary: /tmp/gh-aw/cache-memory/security-scans/2025-11-29.json
• Index: /tmp/gh-aw/cache-memory/security-scans/index.json
• Fix Template: /tmp/gh-aw/cache-memory/fix-templates/template-injection-fix.md

Next Steps

The most critical finding is the template injection vulnerability affecting all 89 workflows. This should be addressed immediately by updating the gh-aw workflow compiler to generate secure code patterns, then recompiling all workflows.

For detailed fix instructions, see the full report above. A fix template has been prepared and saved to the cache memory for reference.

AI generated by Static Analysis Report

[pelikhan]

/plan

[github-actions[bot]]

🎉 Yo ho ho! Plan Command found the treasure and completed successfully! ⚓💰

[github-actions[bot]]

This discussion was automatically closed because it was created by an agentic workflow more than 3 days ago.