docs(security): report security findings for the repo [PB9R0VC]

[cameronnewman]

Report is on the branch as a single-file commit. Final verification: git diff --stat main...HEAD shows only docs/security/SECURITY-FINDINGS.md, and markdownlint reports zero errors on it.

Summary

Scanned every stack present in this repository — Go module, GitHub Actions workflows, the published composite Action, the scaffold/example workflows it emits, the embedded render templates, and the GoReleaser pipeline — and wrote the results to docs/security/SECURITY-FINDINGS.md. Eleven findings: 0 Critical, 1 High, 4 Medium, 6 Low. Nothing was fixed; the deliverable is a triage document and the report file is the only file the PR changes.

The High is a template-injection sink in action.yml:151-156, where ${{ inputs.* }} is pasted into a bash run: block — GitHub substitutes before bash parses, so the quoting there does not protect it. Because this Action runs in consumers' repositories, the exposure lands on their runners. The correct pattern is already present two steps earlier at action.yml:66-67.

Changes

• docs/security/SECURITY-FINDINGS.md (new, only file changed) — summary table with per-severity counts, the stacks detected vs. scanned, tools with versions, and the date; an explicit coverage-gaps section; a table walking every manual-review class the task named with its conclusion; then one section per finding, Critical→Low, each with a stable ID, file:line, source, attacker impact, and remediation. No exploit code.

Three findings sit below their scanner default, with the reasoning stated so a reviewer can argue with the argument: the five html/template XSS advisories (no JS, URL, or <meta content> context exists in the embedded template), and both gosec clusters (G304 paths all come from the operator's own flags; G302/G306 files are public by intent).

Worth flagging for triage beyond the findings themselves: the repo's only automated security gate covers go.mod deps and secrets only — Trivy reported Detected config files num=0, and nothing scans action.yml.

Validation

• go vet ./... — exit 0. staticcheck ./... — exit 0. actionlint -no-color -oneline — exit 0.
• govulncheck ./... — exit 3, six called stdlib advisories. gosec -fmt=text ./... — exit 1, nine issues. Trivy 0.72.0 filesystem scan — 0/0/0.
• npx markdownlint-cli2@0.18.1 — zero errors on the report (the repo's own lint config).
• Not verified: CI was not waited on. zizmor and shellcheck could not be installed here, so their coverage is absent and is called out in the report rather than silently omitted.

---

Ergates task: 06G3EKMR4ZJ9ZN8F86WPB9R0VC

[greptile-apps]

Greptile Summary

This PR adds a security-triage report covering the repository’s Go code, GitHub Actions, templates, generated workflows, and release pipeline.

• Documents eleven findings with severity, impact, evidence, and remediation.
• Records scanner coverage, validation results, and known coverage gaps.
• Corrects both previously reported documentation inconsistencies.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

_{Reviews (3): Last reviewed commit: "docs(security): correct input count on S..." | Re-trigger Greptile}