[plan] Security remediation plan for static analysis findings (Jan 14, 2026)

[github-actions]

Overview

This tracking issue addresses security and code quality findings from the comprehensive static analysis report conducted on 2026-01-14.

Source: Discussion #9966

Findings Summary

• Total Issues: 688 findings across 124 workflows
• Critical/High: 1 high severity issue (unpinned actions)
• Medium: 2 medium severity issues (credential persistence)
• Code Quality: 197 shellcheck errors, 122 unverified script execution warnings
• Informational: 119 template injection warnings (mitigated by safe-inputs)

Planned Remediation Tasks

This work is broken down into 5 focused sub-issues addressing immediate security concerns:

1. Fix unpinned action references (High severity) - Pin actions to commit SHAs in release.md
2. Fix credential persistence issues (Medium severity) - Prevent credentials in artifacts for release.md
3. Add missing GitHub permissions (4 workflows) - Add required permissions for GitHub API toolsets
4. Fix critical shellcheck issues (Top priority errors) - Address SC2155 and other critical shell scripting issues
5. Implement automated security scanning (CI/CD integration) - Add pre-commit hooks and CI checks for zizmor and actionlint

Success Metrics

• ✅ Zero High severity findings
• ✅ Zero Medium severity findings
• ✅ 100% workflows have correct permissions
• ✅ Critical shellcheck errors reduced by 75%
• ✅ Automated scanning integrated in CI/CD

References

• Static Analysis Report: 🔍 Static Analysis Security Report - 2026-01-14 #9966
• Zizmor Documentation: https://docs.zizmor.sh/
• Actionlint Documentation: https://github.com/rhysd/actionlint
• GitHub Security Hardening: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions

AI generated by Plan Command for discussion #9966