[uk ai resilience] [uk-ai-resilience] UK AI Open Code Risk & Resilience Governance Report - 2026-08-17

[github-actions[bot]]

Executive summary

Recent-change window: last 7 days, 335 commits (49 flagged security-signal), scoped to github/gh-aw. No open secret-scanning alerts. 5 open CodeQL code-scanning alerts (all warning severity, none error/critical). 32 open issues carry the security label, dominated by routine recurring container-image-scan reports (firewall/mcpg images) and static-analysis digests rather than acute code vulnerabilities. The dominant recent-change surface is the workflow compiler/CLI (pkg/cli/*, pkg/workflow/*, sandbox runtime-profile consolidation, safe-outputs handling) plus a burst of new custom lint rules (eslint-factory/eslint-miner, Go analyzers). One alert pair (#651/#652, GraphQL query built via Sprintf in pkg/cli/project_command.go) is already tracked by open issue #52749 and, on inspection, the actual GraphQL documents are hardcoded constants with variables passed separately (CWE-89 mitigation already documented in-code) — the Sprintf calls flagged are for log/error strings, not query bodies, indicating a likely stale/false-positive alert that still needs formal dismissal. Overall assessment: no open-code exposure requiring restriction; the repository's existing daily security workflow fleet (CodeQL, Semgrep, VulnHunter, Sighthound, malicious-code scan, red-team scan) provides strong continuous coverage. Recommendation is targeted remediation/triage rather than any access restriction.

Asset graph summary (recent-change scoped)

Changed surfaces, likely runtime area, dependencies, ownership

Segment	Purpose	Runtime area	Dependencies implicated	Ownership signal
pkg/cli/* (project_command.go, run/logs/reporting helpers)	CLI commands: project creation, run execution, log/audit reporting	gh aw CLI / GitHub Actions orchestration	GitHub GraphQL API, gh CLI	pelikhan, Copilot-authored PRs, CODEOWNERS: dsyme/eaftan/pelikhan/krzysztof-cieslak
pkg/workflow/*, workflow schema, sandbox runtime profiles	Compiles markdown workflows to .lock.yml; sandbox/security profile consolidation	Workflow compiler	actionlint, workflow JSON schema	Same CODEOWNERS group + lpcox
scripts/ensure-docs-slide-pdf.js	Docs slide-deck PDF generation from LFS pointer via trusted origin	Docs build pipeline	media.githubusercontent.com (pinned trusted origin)	Docs tooling maintainers
eslint-factory / eslint-miner rules	New/expanded custom lint rules (fs-close-sync, lastindex-reset, empty-catch)	Static analysis tooling	ESLint	Automated "miner" bot PRs, human-reviewed
Go linters (packagelevelmutableslicemap, hardcodedfilepath)	New Go static analyzers	Build/lint pipeline	Go analysis framework	pelikhan / core maintainers
gh-aw-firewall container images (agent, squid, cli-proxy, api-proxy)	Network egress control sandbox	Runtime sandbox for agentic workflows	Base images (alpine, node, squid)	Recurring automated container-image-scan issues, no dedicated remediation owner visible per-issue
Daily security workflow fleet (CodeQL, Semgrep, VulnHunter, Sighthound, malicious-code, red-team, security-observability)	Continuous security scanning	GitHub Actions scheduled workflows	Various scanners	Platform/security automation team

Tier classification table

Tier hypotheses for highest-signal changed areas

Area	Tier	Rationale
pkg/cli/project_command.go GraphQL query construction	A — Open Safe (pending alert dismissal)	Code inspection confirms GraphQL bodies are hardcoded string constants with $login passed as a variable; Sprintf usage flagged by CodeQL is confined to human-readable log/error strings, not query text. Issue #52749 already tracks formal verification/closure.
scripts/ensure-docs-slide-pdf.js (js/http-to-file-access, #654)	B — Open With Conditions	Writes network-fetched bytes to disk, but source is a pinned trusted origin (media.githubusercontent.com) with an existing lgtm suppression comment — intentional design, needs a recorded dismissal rationale rather than code change.
actionlint workflow-out-of-context (#653)	B — Open With Conditions	Warning-level lint finding in workflow context evaluation; needs identification of the specific workflow file and either a config fix or documented false-positive dismissal — currently no dedicated tracking issue.
README.md workflow-security-finding-1 (#564)	C — Restricted Pending Review	Oldest of the open alerts (no recent remediation activity visible in the 7-day window); needs a fresh read of the CodeQL alert detail to confirm relevance to current README content before dismissal or fix.
gh-aw-firewall container images (recurring CVE issues)	B — Open With Conditions	High cadence of recurring, mostly base-image CVEs; mitigated by sandbox isolation design, but unsupported/aging base packages accumulate without a visible consolidated remediation cadence beyond one-off issues per scan.
Workflow compiler / CLI general change surface (pkg/cli/*, pkg/workflow/*)	A — Open Safe	High commit velocity but changes are incremental, reviewed, covered by existing daily security scan fleet and CODEOWNERS; no alerts map to net-new logic in this window beyond the already-tracked GraphQL item.

Control verification gaps

• Ownership: CODEOWNERS exists and is current (4 named maintainers) — adequate for core pkg/*. No per-issue owner assignment visible for recurring container-image-scan issues ([container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/agent:0.28.1 #53075/[container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/squid:0.28.1 #53073/[container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.1 #53072/[container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/api-proxy:0.28.1 #53071 etc.), risking triage drift.
• SDLC: Strong — CodeQL, Semgrep, VulnHunter, Sighthound, malicious-code, red-team, and security-observability workflows all run on schedule.
• Dependency: deps: commits show routine patch bumps (x/crypto, x/mod, lipgloss); firewall container images show a recurring CVE burn-down issue ([container-image-scan] Container CVE burn-down #52657) but individual image-scan issues open without visible closure linkage in this window.
• Secrets: No open secret-scanning alerts — clean.
• Runtime observability: daily-security-observability and agent-job-health workflows present; recently hardened against tool-denial loops (Harden daily regression audit against tool-denial loops and prevent premature denial-issue closure #53370).
• Recovery: Sandbox runtime-profile consolidation (Collapse sandbox security options into runtime profiles #53168) suggests active investment in rollback-friendly security configuration; no evidence of untested rollback paths in this window.

Risk-scoring table and rationale

AI-aware risk dimensions per Tier B/C area

Area	Exposure amplification	Patchability	Detectability	Operational fragility	Ownership confidence	Overall
ensure-docs-slide-pdf.js (#654)	Low (single trusted origin, docs-build only)	High (add explicit dismissal/comment or origin allowlist check)	High (CodeQL already flags it)	Low	Medium (docs tooling, no named owner in issue)	Low risk, low effort to close
actionlint out-of-context (#653)	Low (lint-time only, no runtime exposure)	Medium (needs locating exact workflow file first)	High	Low	Low (no tracking issue yet)	Low-medium
README.md finding (#564)	Low (documentation surface)	Medium (needs alert detail review — oldest unaddressed)	Medium (aging alert, no recent activity)	Low	Low (no tracking issue)	Low-medium, aging
Firewall container CVEs (recurring)	Medium (sandbox is the security boundary for agent execution)	Medium (base-image bumps, cadence-dependent)	High (weekly scans exist)	Medium (accumulating unaddressed base-image CVEs across versions)	Medium (burn-down issue #52657 exists but individual per-version issues proliferate)	Medium — highest aggregate risk of the batch

Remediation queue with SLAs

1. Firewall container image CVE consolidation — SLA: high. Consolidate recurring per-version scan issues ([container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/agent:0.28.1 #53075/[container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/squid:0.28.1 #53073/[container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.1 #53072/[container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/api-proxy:0.28.1 #53071/[container-image-scan] Container findings for ghcr.io/github/serena-mcp-server #52858/[container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/squid:0.27.44 #52652/[container-image-scan] Container findings for ghcr.io/github/gh-aw-mcpg #52456/[container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/cli-proxy #52455/[container-image-scan] Container findings for node:lts-alpine #51710/[container-image-scan] Container findings for ghcr.io/github/gh-aw-mcpg:v0.4.8 #51707/[container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44 #51329/[container-image-scan] Container findings for ghcr.io/github/github-mcp-server:v1.8.0 #51328/[container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/squid:0.27.44 #51022/[container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.44 #51021/[container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/agent:0.27.44 #51020) under the existing burn-down tracker ([container-image-scan] Container CVE burn-down #52657); confirm base-image bump cadence keeps pace with scan frequency.
2. README.md CodeQL finding [Custom Engine Test] Test Issue Created by Custom Engine #564 — SLA: medium. Oldest open alert with no recent remediation touch; re-triage against current README content and either fix or formally dismiss with rationale.
3. actionlint workflow-out-of-context #653 — SLA: medium. Identify the specific workflow triggering the warning and file a dedicated tracking issue (currently absent) with fix-or-dismiss decision.
4. ensure-docs-slide-pdf.js [Custom Engine Test] Test Issue Created by Custom Engine #654 — SLA: low. Low exposure; add a docs-tooling issue to record the intentional-design rationale and consider an explicit origin/content-type check alongside the existing lgtm suppression for defense-in-depth.
5. GraphQL Sprintf alerts #651/[Custom Engine Test] Test Issue Created by Custom Engine #652 — SLA: low (already tracked in [uk-ai-resilience] [UK AI Governance] Verify/parameterize GraphQL query construction in project_command.go (code scanning warnings) #52749). Recommend closing as false-positive once maintainers confirm log-string vs. query-string distinction, rather than further code changes.

Exception register

None required this cycle — all findings are Tier A/B; no Tier C/D items warrant a temporary hidden-repo or access-restriction exception. No exception register entries created.

Operational metrics baseline

• MTTR proxy: Security-signal commits average ~1 per 6.8 commits in the window; no long-lived open code-scanning alert older than the README.md finding ([Custom Engine Test] Test Issue Created by Custom Engine #564), which lacks a clear "opened" timestamp cross-reference in this precompute — flagged for follow-up.
• Ownership coverage: 100% of pkg/* core surface covered by CODEOWNERS; 0% of individual container-image-scan issues have an assigned owner beyond the bot reporter.
• Unsupported dependency ratio: Not directly measurable from this precompute; container-image scans suggest a non-trivial base-image CVE backlog (multiple versions of squid/cli-proxy/api-proxy/agent images open concurrently).
• Exception aging: 0 active exceptions.
• Exposure without recovery capability: 0 identified — sandboxed execution (firewall containers) is itself the recovery/containment boundary, and it is actively maintained (runtime-profile consolidation this week).

Generated by UK AI Operational Resilience · auto · 45.8 AIC · ⌖ 2.29 AIC · ⊞ 9.1K · ◷

• expires on Aug 20, 2026, 7:40 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #53736.