[static-analysis] RGS-012: Secret Exfiltration via Outbound HTTP Request in shared/playwright-title-test.md (7 workflows)

[github-actions]

🚨 Runner-Guard Security Finding

Rule: RGS-012 — Secret Exfiltration via Outbound HTTP Request
Severity: High
Files: 7 workflows, all via the shared component .github/workflows/shared/playwright-title-test.md

• .github/workflows/smoke-copilot.lock.yml:733
• .github/workflows/smoke-test-tools.lock.yml:581
• .github/workflows/smoke-gemini.lock.yml:628
• .github/workflows/smoke-agent-scoped-approved.lock.yml:559
• .github/workflows/smoke-claude.lock.yml:656
• .github/workflows/smoke-codex.lock.yml:628
• .github/workflows/smoke-copilot-small.lock.yml:572

Description

runner-guard flags a run: block that starts a local Playwright title-test HTTP server and then curls it back to confirm it's up:

nohup node "$RUNNER_TEMP/playwright-title-test-server.cjs" > "$RUNNER_TEMP/playwright-title-test-server.log" 2>&1 &
echo "$!" > "$RUNNER_TEMP/playwright-title-test-server.pid"
curl --fail --silent --show-error --retry 10 --retry-connrefused \
  --retry-all-errors --retry-max-time 30 \
  "(127.0.0.1/redacted) > /dev/null

RGS-012's domain heuristic only allowlists github.com, api.github.com, and ghcr.io — it does not special-case loopback/private addresses (127.0.0.1, localhost, 0.0.0.0), so any curl/wget targeting a local port in a secrets-bearing job trips the rule.

This is a new false-positive source: the shared component shared/playwright-title-test.md was added around 2026-08-31/09-01 (see closed issue #57721 "Add shared Playwright title smoke test" and #56904 "Add Playwright combination coverage to smoke workflows via shared component") and is now included by 7 smoke-test workflows, which is why RGS-012 findings jumped from 1 workflow to 8 in today's scan.

Impact

The request here targets 127.0.0.1 — a server the same job just started — not an attacker-controlled endpoint, so this specific pattern is not a credential-exfiltration risk. However, since it's a genuine rule match (non-GitHub-domain HTTP request in a secrets-bearing job) it will keep re-alerting on every scan across all 7 (and any future) workflows that pull in this shared component, adding noise that could mask a real finding.

Remediation

Pick one:

1. Add a runner-guard suppression comment (consistent with prior RGS-012 suppressions in this repo, e.g. Annotate reviewed RGS-012 outbound HTTP steps in workflow sources #52917 "Annotate reviewed RGS-012 outbound HTTP steps in workflow sources") directly in shared/playwright-title-test.md, so the fix is applied once and inherited by all 7 (and future) includers.
2. If runner-guard supports it, request/track an upstream rule refinement so RGS-012 excludes loopback/private-address targets (127.0.0.1, localhost, ::1, 0.0.0.0) by default — this would also prevent recurrence for any future local-server-healthcheck pattern.

---

Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/33592036533

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 📊 Static Analysis Report · claude · agent · 271.9 AIC · ⌖ 11.9 AIC · ⊞ 11.9K · ◷

• expires on Sep 8, 2026, 9:16 PM UTC-08:00