[static-analysis] Report - 2026-08-22 #54728

You are fixing a shellcheck SC2015 finding in the gh-aw compiler.

**Vulnerability/Issue**: SC2015 - "Note that A && B || C is not if-then-else. C may run when A is true."
**Rule**: SC2015 - (www.shellcheck.net/redacted)

**Current Issue**:
pkg/workflow/threat_detection_steps.go (function buildCopyDetectionFirewallLogsStep, lines 230-231)
generates two shell lines of the form:

  [ -d X ] && mkdir -p Y && cp -r X/. Y/ || true

If `mkdir -p` or `cp -r` fails (e.g. disk full, permission error), the `|| true`
silently swallows that failure and makes it indistinguishable from the `-d X`
test simply being false. This masks real errors in a step whose whole purpose
is to preserve firewall/audit log data for the threat-detection job.

**Required Fix**:
Rewrite both lines as explicit if/then blocks so the truth-test and the
copy operation are not conflated by `&&`/`||` chaining:

  if [ -d X ]; then mkdir -p Y && cp -r X/. Y/; fi

This preserves the "do nothing if the directory doesn't exist" behavior
without using `|| true` to blanket-suppress errors from the commands that
run when it does exist.

**Example**:
Before:
```go
fmt.Sprintf("          [ -d %s ] && mkdir -p %s/logs && cp -r %s/. %s/logs/ || true\n", proxyLogsDir, detectionFirewallLogsDir, proxyLogsDir, detectionFirewallLogsDir),
fmt.Sprintf("          [ -d %s ] && mkdir -p %s/audit && cp -r %s/. %s/audit/ || true\n", auditDir, detectionFirewallLogsDir, auditDir, detectionFirewallLogsDir),

### All Findings Details

<details>
<summary><b>Zizmor: unverified-creator actions flagged despite inline ignores</b></summary>

29 workflows use one of `astral-sh/setup-uv`, `erlef/setup-beam`, `safedep/pmg`, `super-linter/super-linter`, `actions-ecosystem/action-add-labels`, or `gaurav-nelson/github-action-markdown-link-check`, each already annotated with `# zizmor: ignore[github_action_from_unverified_creator_used]` in the source `.md`/`.yml`. Zizmor still surfaces them as `info`-level notes in this scan mode; no action needed unless the ignore annotations should be tightened per-action.

`smoke-copilot-arm.lock.yml` additionally triggers `pr_runs_on_self_hosted` (warning) because it runs on `ubuntu-24.04-arm`, which is treated as a non-standard/self-hosted-like runner class by zizmor's heuristic — expected for this ARM smoke-test workflow.

</details>

<details>
<summary><b>Grype: images with no critical/high findings</b></summary>

`ghcr.io/github/gh-aw-firewall/api-proxy`, `cli-proxy`, `squid`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, and `grafana/mcp-grafana` contribute only medium/low/negligible findings (mostly `bind9-libs`, `libexpat1`, and similar base-OS packages in the firewall agent image). No action recommended beyond routine base-image refresh cadence.

</details>

### Historical Trends

- **Previous Scan**: none found in cache memory (`/tmp/gh-aw/cache-memory/security-scans/index.json` was empty before this run)
- **Total Findings Then**: N/A
- **Total Findings Now**: 2,091
- **Change**: N/A (baseline established)

#### New Issues
All findings are new since this is the first recorded scan.

#### Resolved Issues
None (no prior scan to compare against).

### Recommendations

1. **Immediate**: Review the 4 `RGS-005` (medium) findings — confirm write permissions are actually required for `agentic_commands.yml`, `ai-moderator.lock.yml`, `q.lock.yml`, and `squad.lock.yml` given their externally-triggerable events.
2. **Short-term**: Apply the SC2015 fix in `pkg/workflow/threat_detection_steps.go` (single source change, fixes 275 workflows) and recompile.
3. **Long-term**: Track `ghcr.io/oraios/serena:latest`'s upstream release cadence for the 51 critical CVEs; consider pinning to a patched digest once upstream updates, or evaluate whether a slimmer base image is feasible.
4. **Prevention**: Add a scan of the generated "Copy detection firewall logs" step (or similar shared step-builders) to a pre-commit/CI shellcheck pass on the compiler's Go string templates, so future template changes catch SC-series issues before 275 workflows inherit them at once.

### Next Steps

- [ ] Apply the SC2015 fix in `pkg/workflow/threat_detection_steps.go` and recompile all workflows
- [ ] Review the 4 medium-severity RGS-005 permission findings
- [ ] Monitor `ghcr.io/oraios/serena:latest` upstream for patched critical CVEs
- [ ] Confirm zizmor's 29 unverified-creator-action notes are intentionally accepted (they already carry inline ignores)
- [ ] Consider adding all eight tools to pre-commit hooks

> Generated by [📊 Static Analysis Report](https://github.com/github/gh-aw/actions/runs/32552694294) · agent · 125.4 AIC · ⌖ 13.4 AIC · ⊞ 11.9K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fstatic-analysis-report%22&type=issues)
> - [x] expires <!-- gh-aw-expires: 2026-08-29T05:14:52.955Z --> on Aug 28, 2026, 9:14 PM UTC-08:00

<!-- gh-aw-agentic-workflow: Static Analysis Report, engine: claude, model: agent, id: 32552694294, workflow_id: static-analysis-report, run: https://github.com/github/gh-aw/actions/runs/32552694294 -->

<!-- gh-aw-workflow-id: static-analysis-report -->
<!-- gh-aw-workflow-call-id: github/gh-aw/static-analysis-report -->