🔍 Static Analysis Report - November 11, 2025 #3606

2025-11-11T09:21:13Z

github-actions[bot]
bot Nov 11, 2025

🔍 Static Analysis Report - November 11, 2025

Executive Summary

Comprehensive static analysis scan of agentic workflows using zizmor (security scanner), poutine (supply chain security), and actionlint (workflow linter). Scanned 50 out of 75 workflows and identified 28 findings across multiple severity levels.

Key Findings

22 High Severity actionlint errors blocking workflow execution
7 Medium Severity security warnings about network sandboxing
2 Low Severity security findings from zizmor
3 Low Severity package validation warnings

Scan Statistics

Metric	Value
Workflows Scanned	50 / 75 (67%)
Tools Used	zizmor, poutine, actionlint
Total Findings	28
Critical Issues	0
High Severity	22
Medium Severity	7
Low Severity	5
Informational	1

Findings by Tool

📊 Summary Table

Tool	Total Findings	High	Medium	Low
actionlint	25	22	0	3
zizmor	2	0	0	2
poutine	0	0	0	0
Compile Warnings	8	0	7	1

🔴 actionlint Findings (25 issues)

1. Undefined Activation Job Outputs (22 errors - HIGH SEVERITY)

Issue: Workflows reference needs.activation.outputs.comment_id and needs.activation.outputs.comment_repo but activation is not in the job's needs dependency list.

Impact:

Workflows fail actionlint validation during compilation
Runtime errors when accessing undefined outputs
Broken PR creation functionality

Affected Workflows (11 workflows, 22 error instances):

Workflow	Errors	Lines
`security-fix-pr`	2	3659, 3660
`daily-doc-updater`	2	3713, 3714
`go-logger`	2	3832, 3833
`developer-docs-consolidator`	2	4519, 4520
`github-mcp-tools-report`	2	4341, 4342
`unbloat-docs`	2	4731, 4732
`dictation-prompt`	2	3884, 3885
`poem-bot`	2	5911, 5912
`q`	2	5298, 5299
`technical-doc-writer`	2	5028, 5029
`tidy`	2	4249, 4250

Root Cause:

# Current (BROKEN)
create_pull_request:
  needs:
    - agent
    - detection
  env:
    GH_AW_COMMENT_ID: ${{ needs.activation.outputs.comment_id }}  # ❌ activation not in needs

Recommended Fix: Add activation to the needs list

# Fixed
create_pull_request:
  needs:
    - activation  # ✅ Add this
    - agent
    - detection
  env:
    GH_AW_COMMENT_ID: ${{ needs.activation.outputs.comment_id }}  # ✅ Now accessible

2. Shellcheck Issues (3 warnings - LOW SEVERITY)

Issue: SC2086 - Missing quotes in shell scripts could cause issues with filenames containing spaces

Affected Workflows:

super-linter (super-linter.lock.yml:4528, lines 4, 6, 9 within script)

Recommended Fix: Add double quotes around variable expansions

🟡 zizmor Security Findings (2 issues)

Template Injection (Low/Informational Severity)

Rule: template-injection
Description: Potential code injection via template expansion
Reference: (redacted)#template-injection

Findings:

Workflow	Location	Severity	Context
`copilot-session-insights`	Line 204	Informational	`continue-on-error` attribute in Install gh agent-task extension step
`mcp-inspector`	Line 1129	Low	Setup MCPs step

Impact: Low - These are relatively safe template expansions, but should be reviewed for any user-controlled input

Mitigation: Review the steps to ensure no untrusted user input flows into the template expansion

✅ poutine Supply Chain Security (0 issues)

No supply chain security issues were detected by poutine in this scan. This is positive news for the security posture of the workflows.

⚠️ Compilation Warnings (8 warnings)

1. Network Firewall Unsupported (7 warnings - MEDIUM SEVERITY)

Issue: Claude engine does not support network firewalling. Workflows specify network.allowed restrictions, but these may not be enforced.

Security Impact: Network restrictions intended to sandbox workflow execution may not be applied, potentially allowing unauthorized network access.

Affected Workflows (7):

audit-workflows
copilot-session-insights
daily-doc-updater
copilot-agent-analysis
prompt-clustering-analysis
unbloat-docs
blog-auditor

Warning Message:

⚠ Selected engine 'claude' does not support network firewalling; 
workflow specifies network restrictions (network.allowed). 
Network may not be sandboxed.

Recommendations:

Consider using a different engine that supports network firewalling
Add compensating controls for network security
Document that these workflows have relaxed network restrictions
Monitor network activity from these workflows

2. Web Search Unsupported (1 warning)

Issue: Copilot engine doesn't support web-search tool

Affected Workflows: ci-doctor

Impact: Workflow may not work as intended if it relies on web search functionality

3. Pip Package Validation Failed (3 warnings)

Issue: markitdown-mcp package validation failed - package may not exist on PyPI

Affected Workflows:

scout
mcp-inspector
pdf-summary

Impact: Potential runtime failure if the package doesn't exist or isn't accessible

Recommendation: Verify the package exists and is correctly named

Priority Issues & Recommendations

🔥 Priority 1: Fix Undefined Activation Outputs (IMMEDIATE)

Severity: High
Issue Count: 22 errors across 11 workflows
Impact: Workflows are broken and will fail at runtime

Action Items:

Add activation to the needs list in the create_pull_request job
Recompile all affected workflows
Test PR creation functionality
Verify activation comment updates work correctly

Estimated Effort: 1-2 hours (bulk fix across 11 workflows)

See detailed fix instructions in the expandable section below.

🔶 Priority 2: Address Network Firewall Warnings (SHORT-TERM)

Severity: Medium
Issue Count: 7 workflows
Impact: Security - network restrictions may not be enforced

Action Items:

Review network requirements for affected Claude workflows
Evaluate alternative engines that support firewalling
Add compensating security controls
Document network security posture
Consider using network monitoring/logging

Estimated Effort: 1-2 days (requires design decisions)

🔹 Priority 3: Review Template Injection Findings (MEDIUM-TERM)

Severity: Low
Issue Count: 2 workflows
Impact: Potential security vulnerability if user input reaches template expansion

Action Items:

Review copilot-session-insights and mcp-inspector workflows
Trace data flow to ensure no untrusted input
Add input validation if needed
Document security review findings

Estimated Effort: 4-8 hours

🔹 Priority 4: Fix Shellcheck Warnings (LOW-TERM)

Severity: Low
Issue Count: 3 warnings in 1 workflow
Impact: Potential issues with filenames containing spaces

Action Items:

Add double quotes around variable expansions in super-linter
Test with filenames containing spaces
Recompile and verify

Estimated Effort: 30 minutes

Detailed Fix Guide: Undefined Activation Outputs

Fix Guide for Undefined Activation Outputs

Problem Statement

The create_pull_request job in 11 workflows references needs.activation.outputs.comment_id and needs.activation.outputs.comment_repo, but activation is not listed in the job's needs dependency array. This causes actionlint errors and will cause runtime failures.

Technical Details

Current Implementation (BROKEN):

jobs:
  activation:
    # ... job definition with outputs
    
  agent:
    needs: [activation]
    # ... job definition
    
  detection:
    needs: [agent]
    # ... job definition
    
  create_pull_request:
    needs:
      - agent      # ✅ Listed
      - detection  # ✅ Listed
      # ❌ Missing: activation
    env:
      # ❌ ERROR: Trying to access outputs from job not in needs
      GH_AW_COMMENT_ID: ${{ needs.activation.outputs.comment_id }}
      GH_AW_COMMENT_REPO: ${{ needs.activation.outputs.comment_repo }}

Solution

Add activation to the needs array:

  create_pull_request:
    needs:
      - activation  # ✅ ADD THIS LINE
      - agent
      - detection
    env:
      # ✅ Now these work correctly
      GH_AW_COMMENT_ID: ${{ needs.activation.outputs.comment_id }}
      GH_AW_COMMENT_REPO: ${{ needs.activation.outputs.comment_repo }}

Implementation Steps

For each affected workflow:

Locate the workflow file (in .github/workflows/)
Find the create_pull_request job (or similar job that references activation outputs)
Locate the needs: section
Add activation to the list (typically as the first item)

Verify the fix:

gh aw compile (workflow-name) --actionlint

Check for errors - should see no more undefined property errors
Commit the changes
Test the workflow end-to-end

Affected Workflows List

Apply this fix to these 11 workflows:

✅ security-fix-pr.md
✅ daily-doc-updater.md
✅ go-logger.md
✅ developer-docs-consolidator.md
✅ github-mcp-tools-report.md
✅ unbloat-docs.md
✅ dictation-prompt.md
✅ poem-bot.md
✅ q.md
✅ technical-doc-writer.md
✅ tidy.md

Bulk Fix Strategy

To fix all workflows efficiently:

Create a script to identify and patch the pattern
Run the script across all affected workflows
Compile all workflows to verify fixes
Create a single PR with all fixes
Test representative workflows from the set

Verification

After applying fixes:

✅ No actionlint errors about undefined properties
✅ Workflows compile successfully
✅ Job dependency graph includes activation
✅ PR creation works and updates activation comments correctly

Alternative Solution

If activation comment updates aren't needed, you could instead remove the environment variables:

env:
  # Remove these lines if not needed:
  # GH_AW_COMMENT_ID: ${{ needs.activation.outputs.comment_id }}
  # GH_AW_COMMENT_REPO: ${{ needs.activation.outputs.comment_repo }}

However, this would break the functionality of linking PRs back to their activation comments, so the recommended fix is to add the dependency.

All Compilation Output Details

Complete Compilation Results

Workflows Successfully Compiled

50 workflows were compiled with all three static analysis tools (zizmor, poutine, actionlint):

Batch 1

✅ static-analysis-report (209.8 KB)
✅ security-fix-pr (223.4 KB) - 2 actionlint errors
✅ audit-workflows (243.5 KB) - firewall warning
✅ safe-output-health (215.2 KB)
✅ smoke-claude (201.9 KB)

Batch 2

✅ daily-doc-updater (226.9 KB) - 2 actionlint errors, firewall warning
✅ go-logger (228.8 KB) - 2 actionlint errors
✅ copilot-agent-analysis (221.3 KB) - firewall warning
✅ lockfile-stats (208.3 KB)
✅ example-workflow-analyzer (193.4 KB)

Batch 3

✅ duplicate-code-detector (190.8 KB)
✅ go-pattern-detector (203.8 KB)
✅ scout (263.9 KB) - pip package warning
✅ developer-docs-consolidator (258.2 KB) - 2 actionlint errors, firewall warning
✅ typist (213.1 KB) - zizmor scan failed (exit code 1)

Batch 4

✅ semantic-function-refactor (216.0 KB)
✅ github-mcp-tools-report (259.4 KB) - 2 actionlint errors
✅ prompt-clustering-analysis (225.9 KB) - firewall warning
✅ unbloat-docs (300.5 KB) - 2 actionlint errors, firewall warning

Batch 5

✅ archie (264.3 KB)
✅ brave (257.6 KB)
✅ changeset (267.0 KB)
✅ ci-doctor (238.7 KB) - web-search unsupported warning
✅ cli-version-checker (236.2 KB)
✅ commit-changes-analyzer (202.0 KB)

Batch 6

✅ copilot-session-insights (268.0 KB) - zizmor template-injection (informational), firewall warning
✅ daily-firewall-report (262.0 KB)
✅ dependabot-go-checker (213.9 KB)
✅ dev-hawk (214.5 KB)
✅ dev (229.3 KB)

Batch 7

✅ dictation-prompt (233.6 KB) - 2 actionlint errors
✅ issue-classifier (173.7 KB) - custom steps experimental
✅ mcp-inspector (254.2 KB) - zizmor template-injection (low), pip package warning
✅ mergefest (262.5 KB)
✅ notion-issue-summary (175.4 KB)

Batch 8

✅ pdf-summary (263.7 KB) - pip package warning
✅ plan (255.1 KB)
✅ poem-bot (390.4 KB) - 2 actionlint errors
✅ pr-nitpick-reviewer (294.3 KB)
✅ python-data-charts (243.6 KB)

Batch 9

✅ q (316.2 KB) - 2 actionlint errors
✅ repo-tree-map (210.1 KB)
✅ research (216.4 KB)
✅ smoke-detector (262.5 KB)
✅ super-linter (219.1 KB) - 3 shellcheck errors
✅ technical-doc-writer (291.0 KB) - 2 actionlint errors

Batch 10

✅ test-jqschema (90.5 KB)
✅ test-manual-approval (90.1 KB)
✅ test-ollama-threat-detection (219.4 KB)
✅ test-post-steps (86.4 KB)
✅ test-secret-masking (90.5 KB)
✅ test-svelte (87.9 KB)

Batch 11

✅ tidy (286.8 KB) - 2 actionlint errors
✅ video-analyzer (217.4 KB)
✅ weekly-issue-summary (251.7 KB)
✅ artifacts-summary (218.4 KB)
✅ blog-auditor (207.3 KB) - firewall warning
✅ grumpy-reviewer (278.9 KB)

Workflows Not Yet Compiled

25 workflows remain to be compiled:

copilot-pr-nlp-analysis
copilot-pr-prompt-analysis
craft
daily-news
daily-perf-improver
daily-repo-chronicle
daily-test-improver
dev.firewall
example-permissions-warning
firewall
instructions-janitor
schema-consistency-checker
smoke-codex
smoke-copilot
test-claude-oauth-workflow
test-timestamp-js
And others...

These workflows were not compiled in this scan due to time constraints, but should be included in future scans for comprehensive coverage.

Historical Trends

This is the first comprehensive static analysis scan of the repository's agentic workflows. Future scans will include trend data comparing:

Total findings over time
New vs. resolved issues
Issue distribution by severity
Workflow health scores
Security posture improvements

Recommendation: Schedule regular static analysis scans (weekly or bi-weekly) to track security and code quality trends.

Prevention & Process Improvements

1. Automated Static Analysis in CI/CD

Add a pre-commit hook or CI check:

# .github/workflows/static-analysis-ci.yml
name: Static Analysis
on: [pull_request]
jobs:
  analyze:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run static analysis
        run: |
          gh aw compile --actionlint --zizmor --poutine

2. Update Workflow Templates

Create secure workflow templates that:

Include all required job dependencies
Follow security best practices
Pass static analysis by default

3. Developer Training

Educate workflow authors on:

GitHub Actions job dependency requirements
Template injection risks
Network security considerations
Using static analysis tools locally

4. Regular Security Reviews

Establish a cadence:

Daily: Automated static analysis on new workflows
Weekly: Review new security findings
Monthly: Comprehensive security audit
Quarterly: Update security policies and guidelines

Next Steps

Immediate Actions (This Week)

Fix all 11 workflows with undefined activation outputs
Recompile and test affected workflows
Create PR with fixes

Short-term Actions (Next 2 Weeks)

Review and address network firewall warnings
Investigate template injection findings
Fix shellcheck warnings in super-linter
Compile remaining 25 workflows

Long-term Actions (Next Month)

Implement automated static analysis in CI/CD
Create secure workflow templates
Establish regular scanning schedule
Document security best practices
Add pre-commit hooks for local development

Appendix: Tool Information

zizmor

Purpose: Security scanner for GitHub Actions workflows
Focus: Template injection, credential exposure, unsafe practices
Website: (redacted)
Findings: 2 issues (template-injection)

poutine

Purpose: Supply chain security scanner
Focus: Dependency vulnerabilities, malicious packages, supply chain attacks
Findings: 0 issues (clean scan)

actionlint

Purpose: Linter for GitHub Actions workflow files
Focus: Syntax errors, type checking, undefined references, shellcheck integration
Website: https://github.com/rhysd/actionlint
Findings: 25 issues (22 expression errors, 3 shellcheck warnings)

Scan Metadata

Scan Date: 2025-11-11
Repository: githubnext/gh-aw
Branch: main
Workflows Scanned: 50 / 75 (67% coverage)
Total Findings: 28
Scan Duration: ~10 minutes
Tools: zizmor, poutine, actionlint (all via gh-aw compile)
Cache Location: /tmp/gh-aw/cache-memory/security-scans/2025-11-11-analysis.json

This report was generated automatically by the Static Analysis Report Agent. For questions or to request additional analysis, please comment on this discussion.

AI generated by Static Analysis Report

pelikhan · 2025-11-11T19:11:52Z

pelikhan
Nov 11, 2025
Maintainer

/plan

1 reply

github-actions[bot] bot Nov 11, 2025
Author

✅ Agentic Plan Command completed successfully.

2025-11-28T23:03:22Z

github-actions[bot]
bot Nov 28, 2025
Author

This discussion was automatically closed because it was created by an agentic workflow more than 1 week ago.

0 replies

🔍 Static Analysis Report - November 11, 2025 #3606

Uh oh!

github-actions[bot] bot Nov 11, 2025

🔍 Static Analysis Report - November 11, 2025

Executive Summary

Key Findings

Scan Statistics

Findings by Tool

📊 Summary Table

🔴 actionlint Findings (25 issues)

1. Undefined Activation Job Outputs (22 errors - HIGH SEVERITY)

2. Shellcheck Issues (3 warnings - LOW SEVERITY)

🟡 zizmor Security Findings (2 issues)

Template Injection (Low/Informational Severity)

✅ poutine Supply Chain Security (0 issues)

⚠️ Compilation Warnings (8 warnings)

1. Network Firewall Unsupported (7 warnings - MEDIUM SEVERITY)

2. Web Search Unsupported (1 warning)

3. Pip Package Validation Failed (3 warnings)

Priority Issues & Recommendations

🔥 Priority 1: Fix Undefined Activation Outputs (IMMEDIATE)

🔶 Priority 2: Address Network Firewall Warnings (SHORT-TERM)

🔹 Priority 3: Review Template Injection Findings (MEDIUM-TERM)

🔹 Priority 4: Fix Shellcheck Warnings (LOW-TERM)

Fix Guide for Undefined Activation Outputs

Problem Statement

Technical Details

Solution

Implementation Steps

Affected Workflows List

Bulk Fix Strategy

Verification

Alternative Solution

Complete Compilation Results

Workflows Successfully Compiled

Batch 1

Batch 2

Batch 3

Batch 4

Batch 5

Batch 6

Batch 7

Batch 8

Batch 9

Batch 10

Batch 11

Workflows Not Yet Compiled

Historical Trends

Prevention & Process Improvements

1. Automated Static Analysis in CI/CD

2. Update Workflow Templates

3. Developer Training

4. Regular Security Reviews

Next Steps

Immediate Actions (This Week)

Short-term Actions (Next 2 Weeks)

Long-term Actions (Next Month)

Appendix: Tool Information

zizmor

poutine

actionlint

Scan Metadata

Replies: 2 comments · 1 reply

Uh oh!

pelikhan Nov 11, 2025 Maintainer

Uh oh!

Uh oh!

github-actions[bot] bot Nov 11, 2025 Author

Uh oh!

github-actions[bot] bot Nov 28, 2025 Author

github-actions[bot]
bot Nov 11, 2025

Replies: 2 comments 1 reply

pelikhan
Nov 11, 2025
Maintainer

github-actions[bot] bot Nov 11, 2025
Author

github-actions[bot]
bot Nov 28, 2025
Author