🔍 Static Analysis Report - January 21, 2026

[github-actions[bot]]

This report presents findings from the daily static analysis scan of all agentic workflow files in the repository using actionlint (which includes shellcheck and pyflakes integration).

Analysis Summary

• Tools Used: actionlint (with shellcheck & pyflakes)
• Total Findings: 233
• Workflows Scanned: 134
• Workflows Affected: 133
• Coverage: 99.3% of workflows have at least one finding

Findings Overview

Tool	Total	Critical	High	Medium	Low
actionlint/shellcheck	233	0	0	15 warnings	218 style/info
zizmor (security)	N/A	-	-	-	-
poutine (supply chain)	N/A	-	-	-	-

Note: The static analysis compilation step ran actionlint only. Zizmor and poutine security scanners were not included in the compilation output. Future scans should enable all three tools for comprehensive security analysis.

Actionlint/ShellCheck Findings by Code

The following table shows all shellcheck issues found, grouped by their issue code:

Code	Severity	Count	Affected Workflows	Description
SC2166	warning	15	15	Prefer [ p ] && [ q ] as [ p -a q ] is not well defined...
SC2129	style	133	133	Consider using { cmd1; cmd2; } >> file instead of individual...
SC1003	info	82	11	Want to escape a single quote? echo 'This is how it'''s don...
SC2086	info	3	1	Double quote to prevent globbing and word splitting...

Top Priority Issues

1. SC2129: Multiple Individual Redirects (style)

• Count: 133 occurrences
• Severity: Style
• Affected: 133 workflows (all compiled workflows)
• Description: Multiple consecutive redirects to the same file should be grouped
• Impact: Minor performance impact; primarily a code quality and best practices issue
• Reference: https://www.shellcheck.net/wiki/SC2129

Why This Matters: While this is a style issue rather than a security vulnerability, it affects every workflow in the repository. Fixing it will:

• Improve script performance by reducing file I/O operations
• Follow shell scripting best practices
• Improve code readability and maintainability
• Reduce the risk of partial writes if scripts are interrupted

2. SC1003: Single Quote Escaping (info)

• Count: 82 occurrences
• Severity: Info
• Affected: 11 workflows
• Description: Suggests proper way to escape single quotes in shell strings
• Impact: No functional impact; informational best practice suggestion
• Reference: https://www.shellcheck.net/wiki/SC1003

3. SC2166: Deprecated Test Operators (warning)

• Count: 15 occurrences
• Severity: Warning
• Affected: 15 workflows
• Description: Using -a and -o operators in test expressions is deprecated
• Impact: Potential compatibility issues; should use && and || instead
• Reference: https://www.shellcheck.net/wiki/SC2166

This is the highest severity issue found (warning level) and should be addressed first after SC2129.

Fix Template for SC2129 (Most Common Issue)

A detailed fix template has been created and saved to the cache memory for future use. Here's the fix prompt for addressing SC2129:

Issue: Multiple individual redirects to the same file
Recommended Fix: Use command grouping with single redirect

Before:

echo "VAR1=$VALUE1" >> /tmp/file.env
echo "VAR2=$VALUE2" >> /tmp/file.env
echo "VAR3=$VALUE3" >> /tmp/file.env

After:

{
  echo "VAR1=$VALUE1"
  echo "VAR2=$VALUE2"
  echo "VAR3=$VALUE3"
} >> /tmp/file.env

Implementation Steps:

1. Identify all consecutive redirects to the same file in each workflow
2. Group them using curly braces { }
3. Move the redirect operator to the end of the group
4. Test to ensure identical output

View Complete Fix Prompt for Copilot Agent

You are fixing a ShellCheck style issue (SC2129) in GitHub Actions workflow files.

**Issue**: Multiple individual redirects to the same file should be grouped for efficiency and best practices.

**ShellCheck Rule**: SC2129 - Consider using { cmd1; cmd2; } >> file instead of individual redirects
**Reference**: https://www.shellcheck.net/wiki/SC2129

**Task**: Find all instances in the workflow file where multiple consecutive commands redirect output to the same file using individual `>>` operators, and refactor them to use command grouping.

**Pattern to Find**:
Look for sequences like:
```bash
echo "..." >> /path/to/file
echo "..." >> /path/to/file
echo "..." >> /path/to/file
```

**How to Fix**:
1. Identify all consecutive redirects to the same file
2. Group them using curly braces `{ }`
3. Move the redirect operator to the end of the group
4. Maintain proper formatting and indentation

**Example Transformation**:

Before:
```bash
echo "VAR1=$VALUE1" >> /tmp/file.env
echo "VAR2=$VALUE2" >> /tmp/file.env
echo "VAR3=$VALUE3" >> /tmp/file.env
```

After:
```bash
{
  echo "VAR1=$VALUE1"
  echo "VAR2=$VALUE2"
  echo "VAR3=$VALUE3"
} >> /tmp/file.env
```

**Important Notes**:
- Preserve the exact content and order of all echo statements
- Maintain variable references and expressions as-is
- Keep proper indentation for readability
- Test that the grouped commands produce identical output to the original

**Affected Files**: All 133 .lock.yml workflow files in .github/workflows/ directory

All Findings Details

View Detailed Findings by Workflow (Top 20 Workflows)

typist

Total Findings: 21

• SC1003 (info): 20 occurrence(s)
  • Want to escape a single quote? echo 'This is how it'''s done'
• SC2129 (style): 1 occurrence(s)
  • Consider using { cmd1; cmd2; } >> file instead of individual redirects

semantic-function-refactor

Total Findings: 13

• SC1003 (info): 12 occurrence(s)
  • Want to escape a single quote? echo 'This is how it'''s done'
• SC2129 (style): 1 occurrence(s)
  • Consider using { cmd1; cmd2; } >> file instead of individual redirects

go-logger

Total Findings: 11

• SC1003 (info): 10 occurrence(s)
  • Want to escape a single quote? echo 'This is how it'''s done'
• SC2129 (style): 1 occurrence(s)
  • Consider using { cmd1; cmd2; } >> file instead of individual redirects

daily-doc-updater

Total Findings: 9

• SC1003 (info): 8 occurrence(s)
  • Want to escape a single quote? echo 'This is how it'''s done'
• SC2129 (style): 1 occurrence(s)
  • Consider using { cmd1; cmd2; } >> file instead of individual redirects

step-name-alignment

Total Findings: 9

• SC1003 (info): 8 occurrence(s)
  • Want to escape a single quote? echo 'This is how it'''s done'
• SC2129 (style): 1 occurrence(s)
  • Consider using { cmd1; cmd2; } >> file instead of individual redirects

go-fan

Total Findings: 7

• SC1003 (info): 6 occurrence(s)
  • Want to escape a single quote? echo 'This is how it'''s done'
• SC2129 (style): 1 occurrence(s)
  • Consider using { cmd1; cmd2; } >> file instead of individual redirects

sergo

Total Findings: 7

• SC1003 (info): 6 occurrence(s)
  • Want to escape a single quote? echo 'This is how it'''s done'
• SC2129 (style): 1 occurrence(s)
  • Consider using { cmd1; cmd2; } >> file instead of individual redirects

developer-docs-consolidator

Total Findings: 5

• SC1003 (info): 4 occurrence(s)
  • Want to escape a single quote? echo 'This is how it'''s done'
• SC2129 (style): 1 occurrence(s)
  • Consider using { cmd1; cmd2; } >> file instead of individual redirects

instructions-janitor

Total Findings: 5

• SC1003 (info): 4 occurrence(s)
  • Want to escape a single quote? echo 'This is how it'''s done'
• SC2129 (style): 1 occurrence(s)
  • Consider using { cmd1; cmd2; } >> file instead of individual redirects

ci-coach

Total Findings: 4

• SC2086 (info): 3 occurrence(s)
  • Double quote to prevent globbing and word splitting
• SC2129 (style): 1 occurrence(s)
  • Consider using { cmd1; cmd2; } >> file instead of individual redirects

copilot-agent-analysis

Total Findings: 3

• SC1003 (info): 2 occurrence(s)
  • Want to escape a single quote? echo 'This is how it'''s done'
• SC2129 (style): 1 occurrence(s)
  • Consider using { cmd1; cmd2; } >> file instead of individual redirects

unbloat-docs

Total Findings: 3

• SC1003 (info): 2 occurrence(s)
  • Want to escape a single quote? echo 'This is how it'''s done'
• SC2129 (style): 1 occurrence(s)
  • Consider using { cmd1; cmd2; } >> file instead of individual redirects

ai-moderator

Total Findings: 2

• SC2129 (style): 1 occurrence(s)
  • Consider using { cmd1; cmd2; } >> file instead of individual redirects
• SC2166 (warning): 1 occurrence(s)
  • Prefer [ p ] && [ q ] as [ p -a q ] is not well defined

archie

Total Findings: 2

• SC2129 (style): 1 occurrence(s)
  • Consider using { cmd1; cmd2; } >> file instead of individual redirects
• SC2166 (warning): 1 occurrence(s)
  • Prefer [ p ] && [ q ] as [ p -a q ] is not well defined

brave

Total Findings: 2

• SC2129 (style): 1 occurrence(s)
  • Consider using { cmd1; cmd2; } >> file instead of individual redirects
• SC2166 (warning): 1 occurrence(s)
  • Prefer [ p ] && [ q ] as [ p -a q ] is not well defined

cloclo

Total Findings: 2

• SC2129 (style): 1 occurrence(s)
  • Consider using { cmd1; cmd2; } >> file instead of individual redirects
• SC2166 (warning): 1 occurrence(s)
  • Prefer [ p ] && [ q ] as [ p -a q ] is not well defined

craft

Total Findings: 2

• SC2129 (style): 1 occurrence(s)
  • Consider using { cmd1; cmd2; } >> file instead of individual redirects
• SC2166 (warning): 1 occurrence(s)
  • Prefer [ p ] && [ q ] as [ p -a q ] is not well defined

grumpy-reviewer

Total Findings: 2

• SC2129 (style): 1 occurrence(s)
  • Consider using { cmd1; cmd2; } >> file instead of individual redirects
• SC2166 (warning): 1 occurrence(s)
  • Prefer [ p ] && [ q ] as [ p -a q ] is not well defined

mergefest

Total Findings: 2

• SC2129 (style): 1 occurrence(s)
  • Consider using { cmd1; cmd2; } >> file instead of individual redirects
• SC2166 (warning): 1 occurrence(s)
  • Prefer [ p ] && [ q ] as [ p -a q ] is not well defined

pdf-summary

Total Findings: 2

• SC2129 (style): 1 occurrence(s)
  • Consider using { cmd1; cmd2; } >> file instead of individual redirects
• SC2166 (warning): 1 occurrence(s)
  • Prefer [ p ] && [ q ] as [ p -a q ] is not well defined

View All 133 Affected Workflows

• agent-performance-analyzer: 1 finding(s)
• agent-persona-explorer: 1 finding(s)
• agentic-campaign-generator: 1 finding(s)
• ai-moderator: 2 finding(s)
• archie: 2 finding(s)
• artifacts-summary: 1 finding(s)
• audit-workflows: 1 finding(s)
• auto-triage-issues: 1 finding(s)
• blog-auditor: 1 finding(s)
• brave: 2 finding(s)
• breaking-change-checker: 1 finding(s)
• changeset: 1 finding(s)
• ci-coach: 4 finding(s)
• ci-doctor: 1 finding(s)
• cli-consistency-checker: 1 finding(s)
• cli-version-checker: 1 finding(s)
• cloclo: 2 finding(s)
• code-scanning-fixer: 1 finding(s)
• code-simplifier: 1 finding(s)
• codex-github-remote-mcp-test: 1 finding(s)
• commit-changes-analyzer: 1 finding(s)
• copilot-agent-analysis: 3 finding(s)
• copilot-cli-deep-research: 1 finding(s)
• copilot-pr-merged-report: 1 finding(s)
• copilot-pr-nlp-analysis: 1 finding(s)
• copilot-pr-prompt-analysis: 1 finding(s)
• copilot-session-insights: 1 finding(s)
• craft: 2 finding(s)
• daily-assign-issue-to-user: 1 finding(s)
• daily-choice-test: 1 finding(s)
• daily-cli-performance: 1 finding(s)
• daily-code-metrics: 1 finding(s)
• daily-compiler-quality: 1 finding(s)
• daily-copilot-token-report: 1 finding(s)
• daily-doc-updater: 9 finding(s)
• daily-fact: 1 finding(s)
• daily-file-diet: 1 finding(s)
• daily-firewall-report: 1 finding(s)
• daily-issues-report: 1 finding(s)
• daily-malicious-code-scan: 1 finding(s)
• daily-multi-device-docs-tester: 1 finding(s)
• daily-news: 1 finding(s)
• daily-observability-report: 1 finding(s)
• daily-performance-summary: 1 finding(s)
• daily-regulatory: 1 finding(s)
• daily-repo-chronicle: 1 finding(s)
• daily-safe-output-optimizer: 1 finding(s)
• daily-secrets-analysis: 1 finding(s)
• daily-team-evolution-insights: 1 finding(s)
• daily-team-status: 1 finding(s)
• daily-testify-uber-super-expert: 1 finding(s)
• daily-workflow-updater: 1 finding(s)
• deep-report: 1 finding(s)
• delight: 1 finding(s)
• dependabot-go-checker: 1 finding(s)
• dev: 1 finding(s)
• dev-hawk: 1 finding(s)
• developer-docs-consolidator: 5 finding(s)
• dictation-prompt: 1 finding(s)
• discussion-task-miner: 1 finding(s)
• docs-noob-tester: 1 finding(s)
• duplicate-code-detector: 1 finding(s)
• example-custom-error-patterns: 1 finding(s)
• example-permissions-warning: 1 finding(s)
• example-workflow-analyzer: 1 finding(s)
• firewall: 1 finding(s)
• firewall-escape: 1 finding(s)
• github-mcp-structural-analysis: 1 finding(s)
• github-mcp-tools-report: 1 finding(s)
• github-remote-mcp-auth-test: 1 finding(s)
• glossary-maintainer: 1 finding(s)
• go-fan: 7 finding(s)
• go-logger: 11 finding(s)
• go-pattern-detector: 1 finding(s)
• grumpy-reviewer: 2 finding(s)
• hourly-ci-cleaner: 1 finding(s)
• instructions-janitor: 5 finding(s)
• issue-arborist: 1 finding(s)
• issue-classifier: 1 finding(s)
• issue-monster: 1 finding(s)
• issue-triage-agent: 1 finding(s)
• jsweep: 1 finding(s)
• layout-spec-maintainer: 1 finding(s)
• lockfile-stats: 1 finding(s)
• mcp-inspector: 1 finding(s)
• mergefest: 2 finding(s)
• metrics-collector: 1 finding(s)
• notion-issue-summary: 1 finding(s)
• org-health-report: 1 finding(s)
• pdf-summary: 2 finding(s)
• plan: 2 finding(s)
• poem-bot: 2 finding(s)
• portfolio-analyst: 1 finding(s)
• pr-nitpick-reviewer: 2 finding(s)
• prompt-clustering-analysis: 1 finding(s)
• python-data-charts: 1 finding(s)
• q: 2 finding(s)
• release: 1 finding(s)
• repo-audit-analyzer: 1 finding(s)
• repo-tree-map: 1 finding(s)
• repository-quality-improver: 1 finding(s)
• research: 1 finding(s)
• safe-output-health: 1 finding(s)
• schema-consistency-checker: 1 finding(s)
• scout: 2 finding(s)
• security-compliance: 1 finding(s)
• security-fix-pr: 1 finding(s)
• security-review: 2 finding(s)
• semantic-function-refactor: 13 finding(s)
• sergo: 7 finding(s)
• slide-deck-maintainer: 1 finding(s)
• smoke-claude: 1 finding(s)
• smoke-codex: 1 finding(s)
• smoke-copilot: 1 finding(s)
• smoke-opencode: 1 finding(s)
• stale-repo-identifier: 1 finding(s)
• static-analysis-report: 1 finding(s)
• step-name-alignment: 9 finding(s)
• sub-issue-closer: 1 finding(s)
• super-linter: 1 finding(s)
• technical-doc-writer: 1 finding(s)
• terminal-stylist: 1 finding(s)
• test-create-pr-error-handling: 1 finding(s)
• tidy: 2 finding(s)
• typist: 21 finding(s)
• ubuntu-image-analyzer: 1 finding(s)
• unbloat-docs: 3 finding(s)
• video-analyzer: 1 finding(s)
• weekly-issue-summary: 1 finding(s)
• workflow-generator: 1 finding(s)
• workflow-health-manager: 1 finding(s)
• workflow-normalizer: 1 finding(s)
• workflow-skill-extractor: 1 finding(s)

Historical Trends

This is the first comprehensive static analysis scan stored in the cache memory system. Future scans will compare against this baseline to track:

• New issues introduced
• Issues resolved
• Overall security posture trends
• Most problematic workflow patterns

Baseline Established: 2026-01-21

• Total findings: 233
• Affected workflows: 133

Recommendations

Immediate Actions (Priority 1)

1. Fix SC2166 warnings: Address the 15 occurrences of deprecated test operators (-a, -o) as these can cause compatibility issues
2. Enable missing security tools: Ensure zizmor and poutine are included in future static analysis runs for comprehensive security coverage

Short-term Actions (Priority 2)

3. Fix SC2129 style issues: Apply the provided fix template to group redirects in all 133 workflows
4. Review SC1003 info messages: Address single quote escaping where it improves clarity

Long-term Actions (Priority 3)

5. Automate static analysis: Add actionlint, zizmor, and poutine to CI/CD pipeline
6. Create workflow templates: Update workflow creation templates to avoid these common patterns
7. Establish quality gates: Block workflow updates that introduce new shellcheck warnings
8. Documentation: Add best practices guide for workflow authors

Missing Security Analysis

Important: This scan only includes actionlint/shellcheck findings. The following security-focused tools were not present in the compilation output:

• zizmor: GitHub Actions security analyzer - checks for common security vulnerabilities in workflows
• poutine: Supply chain security scanner - identifies risks in action dependencies

Action Required: Future scans should ensure all three tools (actionlint, zizmor, poutine) are enabled during the compilation phase to provide complete security coverage.

Next Steps

• Review and prioritize SC2166 warning fixes (15 occurrences)
• Apply SC2129 fix template to all workflows using automation
• Enable zizmor and poutine in the compilation step
• Establish baseline metrics for tracking improvement
• Schedule weekly static analysis scans
• Create automated PR for fixing SC2129 issues

Cache Memory Storage

Analysis results have been stored in persistent cache memory for historical tracking:

• /tmp/gh-aw/cache-memory/security-scans/2026-01-21.json - Full scan data
• /tmp/gh-aw/cache-memory/security-scans/index.json - Scan index
• /tmp/gh-aw/cache-memory/vulnerabilities/by-workflow.json - Per-workflow findings
• /tmp/gh-aw/cache-memory/fix-templates/shellcheck-SC2129.md - Fix template

References:

• Workflow Run §21213379504

AI generated by Static Analysis Report

• expires on Jan 28, 2026, 2:40 PM UTC