[static-analysis] RGS-018: Suspicious Payload Execution Pattern in daily-work-queue-formal-verification.lock.yml #75102

safe-outputs:
  create-pull-request:
    protected-files:
      policy: request-review
      exclude:
        - .changeset/

🚨 Runner-Guard Security Finding

Rule: RGS-018 — Suspicious Payload Execution Pattern
Severity: High
File: .github/workflows/daily-work-queue-formal-verification.lock.yml (source: .github/workflows/daily-work-queue-formal-verification.md)
Line: 2480 ("Download pinned TLC" step)

Evidence

The 2026-11-05 scan flagged the Download pinned TLC step. The step downloads the version-pinned tla2tools.jar (v1.7.4) to disk with curl --output and runs sha256sum --check against a pinned digest. Nothing is piped to a shell and nothing is eval-decoded, so the finding is a false positive. The same finding was assessed as a false positive in the 2026-11-04 scan.

Change

Adds # runner-guard:ignore RGS-018 -- <reason> in the step script, following the existing convention in credentials-check.yml, daily-byok-ollama-test.md and shared/tla-plus.md. The inline-ignore filter (pkg/cli/runner_guard_inline_ignore.go) matches this marker within its look-ahead window of the reported line. The download and checksum verification are unchanged.

Validation

• Recompiled the edited workflow with gh aw compile (via make recompile). The lock file regenerated; the diff is the new comment plus the frontmatter/admission hash refresh.
• The full make recompile run exited non-zero on a package-availability validation failure in another workflow, unrelated to this change. I reverted its unrelated rewrite of agentic_commands.yml.
• runner-guard is not installed in this sandbox, so I did not re-run the scanner. The next scheduled scan should confirm the finding clears.
• No Go code changed, so I ran neither make fmt nor make test-unit.

Not addressed

Two other RGS-018 findings (smoke-test-tools and super-linter, the "Execute Pi CLI" step) come from compiler-generated code in pkg/workflow/pi_engine.go. Other Pi workflows with the same step are not flagged, so I could not identify the trigger without the scanner and left them out rather than add an unverified suppression.

Maintainer note: the lock file may be stripped on delivery; run gh aw compile and commit the regenerated lock before merging.

Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/41969157669

🤖 Generated with [Claude Code]((claude.com/redacted)

# Download the artifact from the workflow run
gh run download '41969157669' -n agent -D '/tmp/agent-41969157669'

# Resolve the bundle source ref, fetch it into a temporary ref, then create the local branch
bundle_path='/tmp/agent-41969157669/aw-github-gh-aw-static-analysis-rgs-018-tlc-ignore.bundle'
temp_ref='refs/bundles/create-pr-static-analysis-rgs-018-tlc-ignore-2da5465e4dfa13d3-b94439da'
target_ref='refs/heads/static-analysis/rgs-018-tlc-ignore-2da5465e4dfa13d3'
bundle_source_ref=$(git bundle list-heads "$bundle_path" | awk '$2 ~ /^refs\/heads\// { print $2 }')
if [ -z "$bundle_source_ref" ]; then
  bundle_source_ref=$(git bundle list-heads "$bundle_path" | awk '$2 == "HEAD" { print $2 }')
fi
if [ "$(printf '%s\n' "$bundle_source_ref" | sed '/^$/d' | wc -l | tr -d ' ')" != "1" ]; then
  echo "Expected exactly one bundle source ref, found: $bundle_source_ref" >&2
  exit 1
fi
git fetch "$bundle_path" "${bundle_source_ref}:${temp_ref}"
git update-ref "$target_ref" "$temp_ref"
git checkout 'static-analysis/rgs-018-tlc-ignore-2da5465e4dfa13d3'
# Ensure the working tree matches the updated branch
git reset --hard
# Remove the temporary bundle ref
git update-ref -d "$temp_ref"

# Push the branch to the target remote
git push 'origin' 'static-analysis/rgs-018-tlc-ignore-2da5465e4dfa13d3'

# Create the pull request
gh pr create --title '[static-analysis] RGS-018: Suspicious Payload Execution Pattern in daily-work-queue-formal-verification.lock.yml' --base 'main' --head 'static-analysis/rgs-018-tlc-ignore-2da5465e4dfa13d3' --repo 'github/gh-aw'

Generated by 📊 Static Analysis Report · claude · routed: sonnet55 high · ~100 AIC · ⌖ ~2 AIC · ⊞ 9.6K · ◷

• expires on Nov 11, 2026, 9:34 PM UTC-08:00