🚨 Runner-Guard Security Finding
Rule: RGS-012 — Secret Exfiltration via Outbound HTTP Request
Severity: High
File: .github/workflows/ab-testing-advisor.lock.yml (and 58 other generated .lock.yml workflows sharing the same template)
Line: 1 (representative; every affected file flags its own "Install gVisor (runsc)" step)
Description
A run: block contains an outbound HTTP request command (curl, wget, httpie, python requests, node fetch, etc.) targeting a non-GitHub domain (i.e., not github.com, api.github.com, or ghcr.io) in a job context that has access to secrets or publishing capabilities. This pattern is a strong indicator of credential exfiltration — the primary objective of most GitHub Actions supply-chain attacks.
In this scan, all 66 RGS-012 hits (59 distinct workflow files) trace back to the same generated "Install gVisor (runsc)" step, which downloads a pinned gVisor release from storage.googleapis.com and verifies it against a pinned SHA-512 checksum before installing:
- name: Install gVisor (runsc)run: | set -euo pipefail ARCH=$(uname -m) URL="https://storage.googleapis.com/gvisor/releases/release/20250707.0/${ARCH}" curl -fsSL "${URL}/runsc" -o /tmp/runsc curl -fsSL "${URL}/runsc.sha512" -o /tmp/runsc.sha512 (cd /tmp && sha512sum -c runsc.sha512) ...This is very likely a false positive: the request downloads a fixed artifact into a file (not a POST carrying secrets/env vars), and the download is integrity-checked via SHA-512 before use.
Impact
This finding jumped from 10 hits across 4 files (2026-08-07 scan) to 66 hits across 59 files today, driven by the recent gVisor sandbox rollout expansion (see 0de69c5 "revert sbx to 10% of agentic workflows, set gvisor to 10%"). Because the step is emitted by the compiler for every workflow that enables the sandbox, this single pattern will keep re-appearing on new/changed workflows every day, adding noise to future scans and making genuine RGS-012 hits harder to spot.
Other affected files sharing this same finding (58)
ace-editor, agent-performance-analyzer, agent-persona-explorer, agentic-token-trend-audit, ai-moderator, api-consumption-report, approach-validator, archie, architecture-guardian, archivx-agentic-workflows-analyzer, artifacts-summary, audit-workflows, auto-triage-issues, avenger, aw-failure-investigator, blog-auditor, bot-detection, breaking-change-checker, changeset, chaos-pr-bundle-fuzzer, ci-coach, claude-code-user-docs-review, cli-consistency-checker, cli-version-checker, cloclo, code-scanning-fixer, code-simplifier, daily-action-setup-security-audit, daily-agent-of-the-day-blog-writer, daily-agentrx-trace-optimizer, daily-ambient-context-optimizer, daily-architecture-diagram, daily-arxiv-researcher, daily-assign-issue-to-user, daily-astrostylelite-markdown-spellcheck, daily-aw-cross-repo-compile-check, daily-awf-spec-compiler-surfacing, daily-byok-ollama-test*, daily-cache-strategy-analyzer, daily-caveman-optimizer, daily-choice-test, daily-cli-performance, daily-code-debt-aider, daily-code-metrics, daily-community-attribution, daily-compiler-quality, daily-compiler-threat-spec-optimizer, daily-credit-limit-test, daily-doc-healer, daily-doc-updater, daily-elixir-credo-snippet-audit, daily-evals-report, daily-experiment-report, daily-fact*, daily-file-diet, daily-model-inventory*, docs-noob-tester*, visual-regression-checker*
* These 5 files already have prior closed issues for RGS-012 (#35652, #30776, #50190, #30776, #30947) and were skipped per dedup policy — listed here only for completeness since they still exhibit the same underlying pattern.
Remediation
Fix at the source (the compiler template that emits the "Install gVisor (runsc)" step) instead of per-workflow, since these files are generated and get overwritten on every compile:
- Locate the shared script/template that emits this step (search the compiler source for
storage.googleapis.com/gvisor). - Add a
# runner-guard:ignore RGS-012 (confirm exact suppression syntax from runner-guard's docs) directly above the curl commands, with a comment noting: pinned version + SHA-512-verified download, no data leaves the runner. - Regenerate all
.lock.yml files so the suppression propagates automatically. - Consider registering
storage.googleapis.com/gvisor as a trusted ecosystem/ sink if runner-guard supports an allowlist, similar to the ecosystem-identifier recommendations already used for firewall allow-lists in this repo.
A full fix-prompt template is available in cache memory at vulnerabilities/fix-templates/runner-guard-RGS-012.md for a future Copilot agent task.
Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/31240585744
Generated by 📊 Static Analysis Report · agent · 187.9 AIC · ⌖ 39.2 AIC · ⊞ 11.1K · ◷
🚨 Runner-Guard Security Finding
Rule: RGS-012 — Secret Exfiltration via Outbound HTTP Request
Severity: High
File:
.github/workflows/ab-testing-advisor.lock.yml(and 58 other generated.lock.ymlworkflows sharing the same template)Line: 1 (representative; every affected file flags its own "Install gVisor (runsc)" step)
Description
A
run:block contains an outbound HTTP request command (curl, wget, httpie, python requests, node fetch, etc.) targeting a non-GitHub domain (i.e., not github.com, api.github.com, or ghcr.io) in a job context that has access to secrets or publishing capabilities. This pattern is a strong indicator of credential exfiltration — the primary objective of most GitHub Actions supply-chain attacks.In this scan, all 66 RGS-012 hits (59 distinct workflow files) trace back to the same generated "Install gVisor (runsc)" step, which downloads a pinned gVisor release from
storage.googleapis.comand verifies it against a pinned SHA-512 checksum before installing:This is very likely a false positive: the request downloads a fixed artifact into a file (not a POST carrying secrets/env vars), and the download is integrity-checked via SHA-512 before use.
Impact
This finding jumped from 10 hits across 4 files (2026-08-07 scan) to 66 hits across 59 files today, driven by the recent gVisor sandbox rollout expansion (see
0de69c5"revert sbx to 10% of agentic workflows, set gvisor to 10%"). Because the step is emitted by the compiler for every workflow that enables the sandbox, this single pattern will keep re-appearing on new/changed workflows every day, adding noise to future scans and making genuine RGS-012 hits harder to spot.Other affected files sharing this same finding (58)
ace-editor, agent-performance-analyzer, agent-persona-explorer, agentic-token-trend-audit, ai-moderator, api-consumption-report, approach-validator, archie, architecture-guardian, archivx-agentic-workflows-analyzer, artifacts-summary, audit-workflows, auto-triage-issues, avenger, aw-failure-investigator, blog-auditor, bot-detection, breaking-change-checker, changeset, chaos-pr-bundle-fuzzer, ci-coach, claude-code-user-docs-review, cli-consistency-checker, cli-version-checker, cloclo, code-scanning-fixer, code-simplifier, daily-action-setup-security-audit, daily-agent-of-the-day-blog-writer, daily-agentrx-trace-optimizer, daily-ambient-context-optimizer, daily-architecture-diagram, daily-arxiv-researcher, daily-assign-issue-to-user, daily-astrostylelite-markdown-spellcheck, daily-aw-cross-repo-compile-check, daily-awf-spec-compiler-surfacing, daily-byok-ollama-test*, daily-cache-strategy-analyzer, daily-caveman-optimizer, daily-choice-test, daily-cli-performance, daily-code-debt-aider, daily-code-metrics, daily-community-attribution, daily-compiler-quality, daily-compiler-threat-spec-optimizer, daily-credit-limit-test, daily-doc-healer, daily-doc-updater, daily-elixir-credo-snippet-audit, daily-evals-report, daily-experiment-report, daily-fact*, daily-file-diet, daily-model-inventory*, docs-noob-tester*, visual-regression-checker*
* These 5 files already have prior closed issues for RGS-012 (#35652, #30776, #50190, #30776, #30947) and were skipped per dedup policy — listed here only for completeness since they still exhibit the same underlying pattern.
Remediation
Fix at the source (the compiler template that emits the "Install gVisor (runsc)" step) instead of per-workflow, since these files are generated and get overwritten on every compile:
storage.googleapis.com/gvisor).# runner-guard:ignore RGS-012(confirm exact suppression syntax from runner-guard's docs) directly above the curl commands, with a comment noting: pinned version + SHA-512-verified download, no data leaves the runner..lock.ymlfiles so the suppression propagates automatically.storage.googleapis.com/gvisoras a trusted ecosystem/ sink if runner-guard supports an allowlist, similar to the ecosystem-identifier recommendations already used for firewall allow-lists in this repo.A full fix-prompt template is available in cache memory at
vulnerabilities/fix-templates/runner-guard-RGS-012.mdfor a future Copilot agent task.Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/31240585744