[uk ai resilience] UK AI Open Code Risk & Resilience Governance — 2026-07-10

[github-actions[bot]]

UK AI Operational Resilience Report

Repository: github/gh-aw | Lookback: 7 days (2026-07-03 to 2026-07-10) | Run: §29106286100

---

Executive Summary

In the 7-day window, 334 commits landed with 72 security-signal commits (21.6%). The repository shows high security-change velocity, consistent with active hardening of the agentic workflow compilation infrastructure. No secret scanning alerts exist. All 3 top-tier code scanning alerts (GraphQL injection, network-to-file write, unpinned action tag) already have open tracking issues. Static analysis posture is stable: 0 High/Critical zizmor findings for the 22nd+ consecutive day.

Overall posture: Tier B — Open With Conditions. One residual Tier C surface (unpinned safe-outputs image action) remains open but tracked.

---

Asset Graph Summary (Recent-Change Scoped)

Surface	Changed This Week	Tier	Risk Driver
pkg/cli/project_command.go	No (alert since Jun-16)	C	GraphQL injection (CWE-89)
scripts/ensure-docs-slide-pdf.js	No (alert since Jun-26)	C	Network-to-file write (CWE-434/912)
.github/workflows/publish-safe-outputs-node.yml	No (alert since Jun-14)	C	Unpinned action tag (CWE-829)
pkg/workflow/ security SG model	Yes	A	Formal verification added (+15 tests)
MCP Gateway write-sink guard policy	Yes	B	New DIFC enforcement; needs runtime validation
Safe-outputs runtime	Yes	A	SEC-004 conformance + disclosure-header
Threat detection warn-mode fallback	Yes	B	Engine failure now surfaced; silent-failure risk reduced
OAuth token propagation	Yes (fixed)	A	Silent failure now propagates as conclusion failure
Checkout auth safe-output-github-app	Yes	B	New auth path; credential isolation reviewed
ARC DinD runner guide	Yes	B	DinD requirement clarified; privilege docs corrected

---

Tier Classification Table

Tier	Count	Areas
A — Open Safe	3	SG formal model, safe-outputs conformance, OAuth token fix
B — Open With Conditions	4	MCP write-sink guard, threat-detection fallback, checkout auth, ARC DinD
C — Restricted Pending Review	3	GraphQL injection (#43830), network-to-file (#43831), unpinned action (#44078)
D — Decommission	0	None

---

Control Verification

Domain	Status	Evidence	Gaps
Ownership	Good	pelikhan, lpcox active; PR review enforced	Some runner-guard findings lack named owners
SDLC	Good	CodeQL, Semgrep, zizmor, poutine, actionlint, runner-guard in CI	3 code-scanning alerts unresolved >3 weeks
Dependency	Partial	Most actions SHA-pinned; poutine unverified-creator flagged	docker/build-push-action@v7.2.0 not pinned (tracked #44078)
Secret Exposure	Good	0 secret scanning alerts; OAuth token propagation fixed	None
Runtime Observability	Good	Threat detection warn-mode surfaces engine failures	No MTTR metric formally tracked
Recovery	Good	72 security commits in 7 days = high patch velocity	No formal rollback SLA defined

---

Risk-Scoring Table

Area	Exposure	Patchability	Detectability	Fragility	Ownership	Tier	Priority
GraphQL injection (#43830)	3	4	3	3	4	C	High
Network-to-file write (#43831)	3	3	4	2	3	C	Medium
Unpinned action tag (#44078)	5	5	4	5	3	C	High
MCP write-sink guard policy	3	3	3	4	4	B	Medium
Threat detection warn-mode	3	3	3	4	4	B	Medium
Checkout auth new path	3	3	3	3	4	B	Medium

Scores: 1=low risk, 5=high risk (except Patchability where 5=easy fix)

Rationale for highest risk (Unpinned Action): publish-safe-outputs-node.yml builds the Node image all agentic workflows depend on. A supply-chain compromise of docker/build-push-action would propagate a backdoor to every agent run — exposure amplification is maximum (5/5) in the AI-agentic context.

---

Remediation Queue with SLAs

Finding	Issue	SLA	Status
Pin docker/build-push-action to SHA in publish-safe-outputs-node.yml	#44078	7 days	Open
Fix GraphQL injection: escapeGraphQLString in project_command.go	#43830	14 days	Open
Review/restrict network-to-file write in ensure-docs-slide-pdf.js	#43831	14 days	Open
Apply env-indirection fix in compiler templates (zizmor template-injection)	—	30 days	Backlog
Fix SC2086 shell quoting in 4 source workflows	#44351	14 days	Open
Resolve SEC-004 conformance false positive	#44674	7 days	Open

---

Exception Register

No new exceptions required. All Tier C findings are actively tracked with open issues.

---

Operational Metrics Baseline

Metric	Value	Trend
MTTR proxy	Less than 7 days (72 security commits in window)	Healthy
Ownership coverage	~85% (pelikhan, lpcox on most PRs)	Partial
Unsupported dependency ratio	1 unpinned action of ~30	1 gap
Exception aging	No standing exceptions	Clean
Exposure without recovery capability	0 (all Tier C tracked)	Good
Open code-scanning alerts	6 (3 substantive + 1 note + 1 dummy + 1 dup)	Monitor
Secret scanning alerts	0	Clean
Zizmor template-injection (informational)	627 stable (new baseline from 2026-07-09)	Monitor

---

New Issues Created This Run

None. All top-priority Tier C findings already have open tracking issues:

• [uk-ai-resilience] [security] Pin docker/build-push-action to SHA in publish-safe-outputs-node.yml (CodeQL #625, CWE-829) #44078 — Unpinned docker/build-push-action (CodeQL alert [Custom Engine Test] Test Issue Created by Custom Engine #625, CWE-829)
• [uk-ai-resilience] [security] Fix GraphQL injection in project_command.go (Semgrep #627/#628, CWE-89) #43830 — GraphQL injection in project_command.go (Semgrep alerts Add test agentic workflow for GitHub remote MCP #627/Add execution duration tracking to tool usage reporting for both Codex and Claude engines #628, CWE-89)
• [uk-ai-resilience] [security] Review network data written to file in ensure-docs-slide-pdf.js (CodeQL #636, CWE-434) #43831 — Network data written to file in ensure-docs-slide-pdf.js (CodeQL alert [Custom Engine Test] Test Pull Request - Custom Engine Safe Output #636, CWE-434)

References:

• §29106286100
• §29072629695 (static analysis)
• §29074992976 (safe-outputs conformance)

Generated by UK AI Operational Resilience · 83.6 AIC · ⌖ 7.56 AIC · ⊞ 5.1K · ◷

• expires on Jul 13, 2026, 8:18 AM UTC-08:00