[uk ai resilience] UK AI Open Code Risk & Resilience Governance — 2026-06-11

[github-actions[bot]]

Repository: github/gh-aw · Lookback: 2026-06-04 – 2026-06-11 · Run: §27362553635

---

Executive Summary

The 7-day window (494 commits, 145 security-signal) shows active hardening — AWF Firewall bumped 3× (v0.27.0→v0.27.2), safe-outputs MCP received critical fixes, and new agent guardrails shipped. Despite this, two Tier-C findings remain open 22–44 days with no committed fix dates. Zero secret scanning alerts.

Signal	Count	Status
Open code scanning alerts	8	1 CRITICAL · 3 HIGH · 4 MEDIUM
Open security issues	10	2 pentest-confirmed; 4 OWASP ASI
Secret scanning alerts	0	✅ Clean
Static-analysis findings (245 workflows)	1,926	Stable — 2nd consecutive day

Highest-risk finding: Cache-memory cross-run XPIA (#28830) — pentest-confirmed, 44 days open, no content-scanning control in place.

---

Tier Classification

Asset	Tier	Basis
pkg/workflow/ Go compiler core	C — Restricted 🔴	Alert #600 CRITICAL CWE-78/89/94, 22d, Copilot-only owner
actions/setup/sh/ shell scripts	C — Restricted 🔴	Issue #28830 pentest-confirmed XPIA, 44d, no content scanning
.github/workflows/*.lock.yml	C — Restricted 🔴	Alert #585 HIGH untrusted checkout, 36d, Copilot-only
actions/setup/js/ JS MCP runtime	C — Restricted 🔴	RGS-012 ×10 secret HTTP exfil + RGS-018 ×6 payload exec
pkg/workflow/compilerenv/	B — With Conditions 🟡	Alert #609 HIGH int64→int; trivial fix
Agent Sandbox / Guardrails	B — With Conditions 🟡	Issue #28776 circuit-breaker open
AWF Firewall (ext.)	B — With Conditions 🟡	SHA-pinned; CHANGELOG gap; 3 bumps/7 days
pkg/cli/ CLI handlers	B — With Conditions 🟡	No alerts; active churn; monitor
.github/workflows/ CI source	B — With Conditions 🟡	Alerts #610 + #611
pkg/linters/ Go linters	A — Open Safe 🟢	Build-time only; no runtime exposure

Tier-C → Tier-B: requires named human owner + committed PR + independent review.

---

Control Verification Summary

Pass 9 · Partial 25 · Fail 2 (36 domains, 6 asset areas)

Critical failures:

• Recovery / Go Compiler: Zero security-fix commits in 7d for 3 HIGH/CRITICAL alerts; no SLA
• SDLC / Lock Files: Alert [Custom Engine Test] Test Issue Created by Custom Engine #585 HIGH untrusted checkout, 36d unresolved; 289×RGS-004 systemic

Key gaps: Alert #600 CRITICAL owned by AI agent only (no human SLA); Issue #28830 has no human assignee; No content scanning on migrate-legacy-files cache path; No signed provenance on cache commits; Circuit breaker (#28776) unimplemented.

Positive evidence: AWF Firewall — all 4 container images SHA+digest pinned (compiler-enforced); token steering active; maxRuns: 500 + maxAiCredits enforced; OTLP telemetry active; GPG-signed commits.

---

Risk-Scoring Table

AI-aware scoring (1=low risk, 5=high risk).

Area	Exposure	Fragility	Tier	SLA
Cache-Memory XPIA (setup_cache_memory_git.sh)	5	5	C 🔴	Critical
Compiler Unsafe Quoting (awf_helpers.go:195)	4	3	C 🔴	High
Untrusted Checkout (q.lock.yml:1889)	3	3	B 🟡	High
Safe-Outputs MCP write path	4	4	B 🟡	Medium
Integer Overflow (compilerenv/manager.go:106)	2	2	B 🟡	Medium
AWF Firewall dependency	2	3	B 🟡	Low
Weak Heredoc Hash (strings.go:167)	1	1	A 🟢	Low — False Positive

Cache-Memory XPIA (Critical): Pentest-confirmed, 44d. Structural controls (hooks cleared, exec-bits stripped, symlinks deleted) are strong but do not scan file content. Confirmed attack: run A writes instruction-shaped .md/.json to cache → run B merges → agent reads as instructions with full write-scope token access. No content-scanning control deployed.

Compiler Unsafe Quoting (High): awf_helpers.go:195 embeds ecosystemJSON into a Python raw-string heredoc. Current data (internal domain names) has no triple-quote; exploitability low. Governance gap: CRITICAL CodeQL open 22d, Copilot-only ownership, no fix date. Compiler blast radius means any confirmed injection reaches every compiled workflow. Fix: base64-encode or write to $RUNNER_TEMP.

Weak Heredoc Hash (False Positive): strings.go:167 uses SHA-256 for deterministic heredoc delimiter generation — not credential storage. CWE-916 does not apply; suppress alert #612 with annotation.

---

Remediation Queue

#	Area	Action	Owner	SLA
1	Cache-Memory XPIA	Content scanning before migrate-legacy-files; provenance sidecar; opt-in cross-run for none integrity	Assign human now	7 days
2	Compiler Unsafe Quoting	Replace inline interpolation with base64 decode or $RUNNER_TEMP; or document as FP	Assign human now	14 days
3	Untrusted Checkout	Fix source templates (q.md, ai-moderator.md, dev-hawk.md); recompile	Copilot + human	14 days
4	Integer Overflow	Upper-bound guard at compilerenv/manager.go:106	Copilot	7 days
5	Weak Heredoc Hash (FP)	CodeQL suppression at strings.go:167; close alert #612	Copilot	7 days
6	Missing Permissions	permissions: contents: read in error-message-lint.yml	Copilot	7 days
7	Unpinned Action	Pin azure/login@v2 to full SHA	Copilot	7 days
8	Circuit Breaker ASI-08	Implement per #28776 design	Copilot + human	30 days
9	Memory Sanitisation ASI-06	Content scanner per #28775	Copilot + human	30 days
10	RGS-012 ×10	Triage; enforce HTTPS; mask headers	Copilot	14 days
11	zizmor github-env High	Refine zizmor: ignore scope in dev-hawk.lock.yml:1719	Copilot	14 days

Interim mitigation for Tier-C (if SLAs cannot be met): Restrict cache-memory to merged/approved integrity only; add runtime assertion panicking on triple-single-quote in ecosystemJSON.

---

Operational Metrics Baseline

Metric	Value	Signal
MTTR proxy (HIGH/CRITICAL CodeQL)	>36 days	⚠️ Velocity gap
Ownership coverage (human owner on CRITICAL/HIGH)	0 / 4 (0%)	❌ Gap
Unpinned actions in lock files	0 / ~40	✅
Static-analysis workflow coverage	245 / 245 (100%)	✅
Secret scanning alerts	0	✅ Clean
Signed commits (7d)	GPG RSA key B5690EEEBB952194	✅
Firewall bump velocity	3 / 7 days	⚠️ Monitor
Tier-C areas without automated rollback	2	⚠️

Primary governance gap: Human ownership of HIGH/CRITICAL CodeQL alerts is 0%. All 4 alerts are Copilot SWE only — no human escalation path or SLA. Engineering velocity is high (494 commits/week) but the SAST remediation pipeline is stalled.

---

References:

• §27362553635 — this governance run
• §27327716946 — static analysis report
• #28830 — cache-memory XPIA (pentest-confirmed)

Generated by UK AI Operational Resilience · 2.5K AIC · ⌖ 14.4 AIC · ⊞ 20.9K · ◷

• expires on Jun 14, 2026, 9:10 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #38880.