fix(rules): ignore bash scripts under RUNNER_TEMP in untrusted_checkout_exec

[Tyagiquamar]

Problem

untrusted_checkout_exec reports a finding when a workflow checks out code and later runs bash .../*.sh, even when the script lives under RUNNER_TEMP (runner-provisioned tooling), not the checked-out workspace. See #457.

Root cause

The rule matches any .sh invocation in run steps after an untrusted checkout. It does not distinguish workspace paths from \ / \ paths.

Solution

Add a guard so run steps whose script path references RUNNER_TEMP are excluded from untrusted_checkout_exec command matching. Document the behavior in the rule page.

Tests

Docker golang:1.26-bookworm:

go test ./scanner -run TestRunnerTempScriptNotFlaggedAsUntrustedCheckoutExec -count=1 (pass)

Issue

Fixes #457

Compatibility

No API changes. Narrows findings (fewer false positives) for workflows that execute scripts from RUNNER_TEMP.

[fproulx-boostsecurity]

Sorry, but CI fails. Some tests do not pass @Tyagiquamar

[Tyagiquamar]

TestGithubWorkflows lists every workflow under scanner/testdata. The runner-temp fixture was missing from that list, so go test ./... failed in scanner before the new regression could matter.

Added .github/workflows/runner_temp_script.yml to the expected paths in acf59bb.

docker run --rm -v <checkout>:/src -w /src golang:1.26-bookworm go test ./scanner -count=1 -timeout 180s completed with ok github.com/boostsecurityio/poutine/scanner 24.039s.

[Tyagiquamar]

@fproulx-boostsecurity The failure in that build_test run is only TestGithubWorkflows. The scan found an extra path, .github/workflows/runner_temp_script.yml, because the regression fixture lives under scanner/testdata.

That path is in the expected list as of acf59bb. Locally, go test ./scanner -count=1 in golang:1.26-bookworm passed. The workflow runs for that commit are action_required, so GitHub has not executed them yet.