🔍 Static Analysis Report - 2026-03-04

[github-actions[bot]]

Analysis Summary

The static analysis compilation step failed for the 5th consecutive day (2026-02-28 through 2026-03-04) due to the gh-aw binary not being found at the expected path (./gh-aw). As a result, no zizmor, poutine, or actionlint findings could be collected.

• Tools Attempted: zizmor, poutine, actionlint
• Total Findings: 0 (compilation blocked)
• Workflows Scanned: 0 of 85
• Workflows Affected: Unknown — compilation prerequisite missing
• Root Cause: ./gh-aw: No such file or directory

Findings by Tool

Tool	Total	Critical	High	Medium	Low
zizmor (security)	N/A	N/A	N/A	N/A	N/A
poutine (supply chain)	N/A	N/A	N/A	N/A	N/A
actionlint (linting)	N/A	—	—	—	—

Critical Infrastructure Issue

gh-aw Binary Not Found — Compilation Blocked

• Tool: agenticworkflows-compile (gh-aw CLI)
• Consecutive Failures: 5 days (2026-02-28 → 2026-03-04)
• Error: ./gh-aw: No such file or directory
• Impact: All three static analysis tools (zizmor, poutine, actionlint) cannot run without a successful compilation step
• Affected: All 85 agentic workflow .md files cannot be compiled or scanned

Historical Trends

Date	Run ID	Status	Total Findings
2026-02-28	§22514823241	❌ compilation_failed	0
2026-03-01	§22537683560	❌ compilation_failed	0
2026-03-02	§22564480093	❌ compilation_failed	0
2026-03-03	§22611344871	❌ compilation_failed	0
2026-03-04	§22657934149	❌ compilation_failed	0

• New Issues: None (no new issue types detectable)
• Resolved Issues: None
• Trend: 5 consecutive compilation failures — static analysis has been completely blocked since 2026-02-28

Repository Context

View Workflow Inventory (85 agentic workflows awaiting scan)

The following 85 .md agentic workflow files exist in .github/workflows/ and have pre-existing .lock.yml compiled counterparts, but have NOT been re-analyzed by static analysis tools due to the compilation failure:

• agent-performance-analyzer, agent-persona-explorer, ai-moderator, artifacts-summary, blog-auditor, breaking-change-checker, ci-coach, ci-doctor, claude-code-user-docs-review, cli-consistency-checker, code-scanning-fixer, code-simplifier, commit-changes-analyzer, copilot-agent-analysis, copilot-cli-deep-research, copilot-pr-merged-report, copilot-pr-nlp-analysis, copilot-pr-prompt-analysis, copilot-session-insights, daily-architecture-diagram, daily-cli-performance, daily-code-metrics, daily-compiler-quality, daily-copilot-token-report, daily-doc-healer, daily-doc-updater, daily-firewall-report, daily-issues-report, daily-malicious-code-scan, daily-mcp-concurrency-analysis, daily-observability-report, daily-performance-summary, daily-repo-status, daily-secrets-analysis, daily-security-red-team, daily-semgrep-scan, daily-syntax-error-quality, daily-team-evolution-insights, daily-team-status, daily-test-improver, daily-testify-uber-super-expert, deep-report, developer-docs-consolidator, discussion-task-miner, docs-noob-tester, duplicate-code-detector, firewall-escape, firewall, github-mcp-structural-analysis, github-mcp-tools-report, glossary-maintainer, go-pattern-detector, grumpy-reviewer, issue-triage-agent, layout-spec-maintainer, metrics-collector, org-health-report, plan, pr-nitpick-reviewer, prompt-clustering-analysis, repo-audit-analyzer, repo-tree-map, repository-quality-improver, safe-output-health, schema-consistency-checker, security-compliance, security-review, semantic-function-refactor, slide-deck-maintainer, smoke-agent, smoke-copilot-arm, smoke-copilot, smoke-multi-pr, smoke-project, smoke-temporary-id, smoke-test-tools, smoke-workflow-call, static-analysis-report, step-name-alignment, super-linter, technical-doc-writer, unbloat-docs, weekly-editors-health-check, weekly-issue-summary, weekly-safe-outputs-spec-review

Recommendations

1. Immediate ⚠️: Investigate why the gh-aw binary is not available at ./gh-aw during the static analysis workflow run. The agentics-maintenance.yml or the workflow runner environment may need to ensure gh-aw is installed/available before the compilation step.
2. Short-term: Once the binary issue is resolved, run a full compilation with --zizmor --poutine --actionlint flags to obtain baseline security findings across all 85 workflows.
3. Long-term: Add a pre-flight check to the static analysis workflow that validates the gh-aw binary exists before attempting compilation, and fails fast with a clear error message.
4. Prevention: Pin the gh-aw version in the workflow setup step to ensure consistent availability.

Next Steps

• Fix gh-aw binary availability in the static analysis runner environment
• Verify agentics-maintenance.yml installs gh-aw before this workflow runs
• Re-run static analysis once binary is available to obtain actual security findings
• Establish baseline findings for all 85 workflows
• Set up alerting for consecutive compilation failures

References:

• §22657934149 — Today's failed run
• §22611344871 — Previous failed run (2026-03-03)
• §22564480093 — Previous failed run (2026-03-02)

AI generated by Static Analysis Report

• expires on Mar 5, 2026, 6:33 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-03-05T06:33:23.156Z.

Closed by Workflow