[uk ai resilience] UK AI Open Code Risk & Resilience Governance Report — 2026-08-12 (github/gh-aw)

[github-actions[bot]]

UK AI Open Code Risk & Resilience Governance Report — github/gh-aw

Lookback window: 7 days (since 2026-08-05T15:42:48Z) · Framework: [UK Gov AI, Open Code & Vulnerability Risk Guidance]((www.gov.uk/redacted)

Note on method: The three specialist sub-agents (asset-tier-classifier, control-verifier, ai-risk-scorer) were dispatched with full context but returned empty responses after two follow-up turns each. This report was synthesized directly from pre-computed repository signals (commits, security-labeled issues, code scanning alerts, secret scanning alerts) following the same governance methodology. This limitation is recorded in the operational metrics section below.

1. Executive Summary

Over the last 7 days, gh-aw saw 395 commits (128 flagged by security-relevant keywords), 22 open security-labeled issues, 5 open code scanning alerts, and 0 open secret scanning alerts. The repository shows an active, closed-loop remediation cadence for dependency/container vulnerabilities (multiple "removed/patched/replaced vulnerable X" commits this week) and a mature automated static-analysis pipeline (zizmor, poutine, actionlint, runner-guard, syft, grype, yamllint, shellcheck) filing recurring report issues. The highest-priority open items are two unresolved GraphQL injection code-scanning alerts in pkg/cli/project_command.go and a large volume of unresolved container CVEs (67 Critical / 438 High per grype) tracked across 6 separate open issues. No repository segment warrants Tier D (decommission); most fall in Tier A/B, with two Tier C candidates pending review.

2. Asset Graph Summary (recent-change scoped)

Segment	Recent activity	Type
pkg/cli/project_command.go	Unresolved GraphQL query construction (fmt.Sprintf + escapeGraphQLString)	CLI / GitHub API integration
pkg/cli/bootstrap_profile_github_app.go	GitHub App OAuth bootstrap flow	CLI / auth
pkg/cli/experiments_command.go	exec.Command("git","show",...) with ref/path concatenation	CLI / local git ops
scripts/ensure-docs-slide-pdf.js	Docs build tooling, flagged http-to-file-access	Build tooling
Sandbox runtime (sandbox.agent.runtime)	New preview Cloud Hypervisor microVM support added this week	Agent execution isolation
MCP Gateway (mcpg) enclave compiler	AWF enclaves now compiled through mcpg; run-scoped capability handoff, 630s timeout bound, network validation	Security boundary / core
Container images (10 scanned)	node:lts-alpine, gh-aw-mcpg (v0.4.8→v0.4.9 bump in-window), gh-aw-firewall api-proxy/squid/cli-proxy/agent v0.27.44, github-mcp-server v1.8.0	Supply chain / dependencies
Workflow corpus (285 workflows)	21 flagged by zizmor/runner-guard taint analysis	Compiled GitHub Actions workflows
Dependency remediation (closed-loop)	Removed open-ontologies container, disabled arXiv MCP container, replaced mcp/context7 container, patched ip-address in gh-aw-node, replaced ast-grep MCP container, mcpg version bump	Supply chain — already remediated

Ownership signal: Commits are near-universally co-authored by human maintainer pelikhan alongside copilot-swe-agent[bot]/gh-aw-bot/github-actions[bot] automation — indicating consistent human review of AI-agent-generated changes, a positive AI-governance signal.

3. Tier Classification Table

Asset	Tier	Rationale
Dependency/container remediation commits (this week)	A — Open Safe	Closed-loop: vulnerable components actively removed/replaced/patched the same week findings surfaced.
Secret scanning posture	A — Open Safe	0 open alerts.
Workflow static-analysis pipeline (zizmor/runner-guard/grype etc.)	A — Open Safe	Mature, recurring, produces actionable structured reports (#52235).
MCP Gateway enclave compilation changes	B — Open With Conditions	Core security-boundary logic changed this week (capability handoff, timeout, network validation); needs a follow-up security review pass given the scope of change, but design shows defense-in-depth intent (630s enforcement bound, run-scoped handoff).
Sandbox Cloud Hypervisor runtime (preview)	B — Open With Conditions	New isolation mechanism in preview; parity with docker-sbx claimed but new attack surface for agent execution — recommend a scoped security review before GA.
pkg/cli/experiments_command.go:337 (exec.Command git show)	B — Open With Conditions	Sighthound flagged as Critical command injection; likely mitigated by internal-only ref/path values, but string concatenation into exec.Command is a fragile pattern — needs confirmation/hardening.
Container images with outstanding CVEs (6 open container-image-scan issues)	C — Restricted Pending Review	67 Critical / 438 High CVEs aggregated via grype; each image has a dedicated tracking issue but volume and severity warrant prioritized patching before further reliance.
pkg/cli/project_command.go GraphQL injection alerts (#651, #652)	C — Restricted Pending Review	Two open, unresolved code-scanning alerts on the same user-controlled input pattern; mitigation exists (escapeGraphQLString) but flagged by the tool as brittle — should move to parameterized GraphQL variables.
pkg/cli/bootstrap_profile_github_app.go:286 (OAuth callback)	B — Open With Conditions	Sighthound SQLi flag likely a false positive (no SQL sink visible, code param pre-validated) but warrants a manual confirmation to close definitively.
scripts/ensure-docs-slide-pdf.js (http-to-file-access)	A — Open Safe	Warning-severity, docs build tooling, low blast radius.
README.md workflow-security-finding-1	A — Open Safe	Documentation-context alert, very low risk.

No assets identified as Tier D — Decommission Candidate in this window.

4. Control Verification Gaps

Domain	Verdict	Notes
Ownership	Adequate	Consistent human maintainer co-authorship on all sampled automated/agent commits.
SDLC	Strong	Active CI, recurring static-analysis reporting workflow, PR-based review pattern evident from commit messages ("Address review", "Fix lint-errors").
Dependency	Adequate	Active remediation loop evidenced this week, but backlog (67 Critical/438 High container CVEs) is large relative to remediation velocity — sustained cadence needed.
Secret exposure	Strong	0 open secret scanning alerts.
Runtime observability	Insufficient evidence	No direct telemetry/observability evidence available in pre-computed context for the new Cloud Hypervisor sandbox or MCP gateway enclave paths; recommend explicit follow-up.
Recovery	Adequate	Versioned pinning (mcpg v0.4.8→v0.4.9) and lock-file recompilation pattern indicate rollback/patch capability, though not exhaustively verified.

5. Risk-Scoring Table and Rationale

Area	Exposure Amplification	Patchability	Detectability	Operational Fragility	Ownership Confidence	Tier
project_command.go GraphQL injection	Medium (auth'd CLI context, user-controlled owner)	High (swap to GraphQL variables)	High (already caught by scanner)	Low-Medium	High	C
bootstrap_profile_github_app.go OAuth callback	Low (likely false positive)	High	High (flagged by scanner)	Low	High	B
experiments_command.go exec.Command	Medium (local git ref/path concatenation)	High	Medium (scanner flagged, needs manual confirm)	Low	Medium	B
Container images (10, CVE-heavy)	High (supply-chain, multiple images)	Medium (upstream-dependent)	High (grype tracked)	Medium	High (dedicated issues per image)	C
Sandbox Cloud Hypervisor runtime	Medium-High (new isolation boundary)	Medium (preview stage)	Medium (no runtime telemetry evidence)	Medium	High	B
MCP Gateway enclave compiler	Medium-High (core security boundary)	Medium	Medium	Medium	High	B
Workflow taint findings (runner-guard/zizmor)	Low-Medium	High (tooling already flags)	High	Low	High	A

6. Remediation Queue with SLAs

Item	Action	SLA Urgency
GraphQL injection (alerts #651/#652)	Replace fmt.Sprintf string interpolation with parameterized GraphQL variables in pkg/cli/project_command.go	High
Container CVE backlog (6 open container-image-scan issues)	Prioritize patching/upgrading images with Critical CVEs; track burn-down rate	Critical
experiments_command.go exec.Command pattern	Confirm ref/path inputs are fully trusted/sanitized before git show; add explicit validation if not	Medium
bootstrap_profile_github_app.go Sighthound SQLi flag	Manually confirm no SQL sink in bootstrapExchangeGitHubAppCode; close or fix	Medium
Sandbox Cloud Hypervisor runtime & MCP gateway enclave changes	Schedule a scoped security review before broader rollout; add runtime observability instrumentation	High

7. Exception Register

No temporary exceptions requested or granted this cycle. All flagged items are routed through the standard remediation queue above rather than exception governance.

8. Operational Metrics Baseline

• MTTR proxy: Multiple vulnerable-dependency commits (container/package replacements) landed within the same 7-day window they were identified — indicating same-week remediation for known-bad supply-chain components.
• Ownership coverage: ~100% of sampled security-signal commits show human co-authorship alongside AI-agent commits.
• Unsupported dependency ratio: Not fully computable from available data; 6 container images under active CVE tracking out of 10 scanned (60%) currently carry unresolved findings.
• Exception aging: N/A — no exceptions open.
• Exposure without recovery capability: No identified cases; version pinning and lock-file recompilation patterns support recovery capability across changed areas.
• Process limitation: The three governance sub-agents (asset-tier-classifier, control-verifier, ai-risk-scorer) did not return usable output this run; findings above were derived directly from pre-computed signals. Recommend investigating sub-agent reliability before the next scheduled run.

---

Generated by the UK AI Open Code Risk & Resilience governance workflow. Run ID: 31613661690.

Generated by UK AI Operational Resilience · auto · 68.1 AIC · ⌖ 2.22 AIC · ⊞ 8.7K · ◷

• expires on Aug 15, 2026, 7:50 AM UTC-08:00