[uk ai resilience] UK AI Governance: Weekly Resilience Report — 2026-09-01

[github-actions[bot]]

Executive Summary

Recent-change window (7 days, since 2026-08-25): 280 commits, 69 security-signal commits, 40 open security-labeled issues, 8 open code-scanning alerts, 0 open secret-scanning alerts. Two sub-agent specialists (asset-tier-classifier, control-verifier) and the ai-risk-scorer returned no usable output after retry; this report was synthesized directly from precomputed inputs and targeted repository verification (noted limitation, partial confidence on structured sub-agent framing but findings below are evidence-backed).

Headline finding: nearly all currently open code-scanning alerts are already under active remediation tracking via prior UK AI Governance issues. The one genuinely new gap is alert-lifecycle hygiene — alert #653 remains "open" in code scanning even though the underlying ~78MB actionlint/gosec binaries it references were fully removed from the git tree (verified via git ls-files) and 6+ remediation issues are already closed. No live vulnerability was found; this indicates a dismissal/triage process gap, not a security defect. No secret exposure signals. Ownership model is flat (single repo-wide CODEOWNERS line) with heavy bot-authored commit volume, which is a longstanding structural condition rather than a new regression.

Asset Graph Summary (recent-change scoped)

Recent-change surfaces and dependencies

Area	Touches (7d)	Notes
pkg/workflow	1529	includes graders_config.go (redirect-check alerts #668/#669)
pkg/cli	1224	includes project_command.go (GraphQL injection warnings #651/#652), add_package_manifest_includes.go (#667)
actions/setup	1052	firewall/gateway setup scripts
.github/workflows	771	gh-aw-firewall v0.28.12 integration, MCP Gateway v0.4.14 bump, 336 workflow files (many compiled .lock.yml)
docs/adr	634	architecture decision records, non-runtime
pkg/linters	328	redirect/path-traversal guard code
pkg/parser	141	frontmatter/markdown parsing
scripts/ensure-docs-slide-pdf.js	n/a	untrusted network write, CWE-434/912 (#663)

Dependency surface: Go (gomod), npm (docs, actions/setup/js, workflows), pip (workflows), Docker (root, actions/setup/js, devcontainer) — all covered weekly by Dependabot. Ownership: single flat CODEOWNERS (@dsyme @eaftan @pelikhan @krzysztof-cieslak) for entire repo, no path-specific routing for high-risk compiler/CI/firewall code. Commit authorship heavily bot-driven (github-actions[bot], gh-aw-bot, copilot-swe-agent[bot], Copilot App) alongside human maintainers pelikhan, lpcox, dsyme.

Tier Classification Table

Tier assignments for recent-change areas

Area	Tier	Rationale
Redirect/path-traversal guards (graders_config.go, add_package_manifest_includes.go)	B — Open With Conditions	Recurring false-positive pattern on ////\ prefix checks; already tracked (#57472, #54037), low real exploitability but needs a definitive fix or suppression rationale
ensure-docs-slide-pdf.js untrusted write	C — Restricted Pending Review	Real CWE-434/912 pattern, medium severity, long churn history (15+ prior issues/PRs), already tracked (#53737) but unresolved
project_command.go GraphQL query construction	B — Open With Conditions	String-built GraphQL via Sprintf; already tracked (#52749), needs parameterization confirmation
CodeQL alert lifecycle / stale dismissal (#653)	C — Restricted Pending Review	Alert references fully-remediated binaries but remains open; indicates a triage/dismissal process gap that could mask future genuine findings amid noise
gh-aw-firewall / MCP Gateway version-pin integration	A — Open Safe	Active, frequent, well-documented version bumps (v0.28.12, v0.4.14) with pinned versions in compat.json-style config; healthy patch cadence
Repository-wide flat ownership model	B — Open With Conditions	No path-specific reviewer routing for compiler/CI/firewall code despite high bot-authored volume; not a new regression but a standing structural risk

Control Verification Gaps

• Ownership: flat, repo-wide CODEOWNERS; no path-specific reviewer requirements for pkg/workflow, pkg/cli, .github/workflows, or firewall integration code.
• SDLC: heavy automated/bot commit volume (github-actions[bot], gh-aw-bot, copilot-swe-agent[bot]) — no direct evidence of gaps, but breadth of CODEOWNERS reduces routing precision.
• Dependency controls: Dependabot covers all four ecosystems (gomod, npm, pip, docker) across all key directories at weekly cadence — adequate coverage, no detected gap.
• Secret exposure: 0 open secret-scanning alerts — consistent with effective prevention; no evidence of reduced scanning coverage in new areas.
• Runtime/alert observability: alert #653 remaining open post-remediation, plus high volume of recurring automated bot reports (container-image-scan, sighthound, vulnhunter, static-analysis, domains-audit) across 40 open security issues, suggests alert fatigue risk — genuine signals may be diluted by noise and stale/undismissed alerts.
• Recovery/patch readiness: version-pinned compat config (compat.json) and frequent incremental firewall/gateway bumps show active patch cadence and rollback-capable versioning.

Risk-Scoring Table and Rationale

Dimension scoring (Low/Medium/High)

Area	Exposure Amplification	Patchability	Detectability	Operational Fragility	Ownership Confidence
Redirect/path-traversal guards	Low	High	High (CodeQL catches it)	Low	Medium
ensure-docs-slide-pdf.js write	Medium	Medium	High	Medium (repeated regressions)	Medium
GraphQL Sprintf construction	Low–Medium	High	High	Low	Medium
Stale alert #653 (triage gap)	Low	High (process fix only)	Low (masked by noise)	Medium (alert fatigue)	Low (no clear alert-lifecycle owner)
Firewall/Gateway version pins	Low	High	High	Low	High
Flat ownership model	Medium (broad blast radius if reviewer capacity saturated)	Medium	Medium	Medium	Low

Remediation Queue with SLAs

Item	Action	SLA Urgency	Tracking
Redirect-check false positives	Land definitive fix (check ////\) or documented suppression	Medium	#57472, #54037 (existing, open)
ensure-docs-slide-pdf.js write	Validate Content-Type/size before write, close CWE-434/912 gap	High	#53737 (existing, open)
project_command.go GraphQL	Parameterize/verify GraphQL query construction	Medium	#52749 (existing, open)
Stale alert #653 dismissal	Dismiss/close alert as remediated; add process step to auto-dismiss alerts once linked remediation issue closes	Medium	New issue filed this run
Flat CODEOWNERS	Consider path-specific ownership for pkg/workflow, pkg/cli, .github/workflows firewall integration	Low	No existing issue; recommendation only, not filed this run (below issue-creation threshold)

Exception Register

No temporary exceptions requested or granted this run. No permanent hidden-repo or scanning-suppression exceptions recommended.

Operational Metrics Baseline

• MTTR proxy: ensure-docs-slide-pdf.js finding has been reopened/relanded across 15+ issues/PRs since Q1 2026 — indicates slow terminal remediation despite frequent attempts.
• Ownership coverage: 100% nominal (flat CODEOWNERS) but 0% path-specific for high-risk compiler/CI/firewall code.
• Unsupported dependency ratio: not detected as elevated; Dependabot covers all 4 ecosystems across all key manifests.
• Exception aging: none currently open.
• Exposure without recovery capability: none identified — all flagged areas have active patch cadence or existing remediation tracking.

Limitation note: sub-agent specialists (asset-tier-classifier, control-verifier, ai-risk-scorer) returned empty responses after retry; findings above rely on direct evidence review with partial confidence on structured scoring framing, though underlying facts (alert states, file locations, CODEOWNERS, Dependabot config, binary removal) were independently verified.

Generated by UK AI Operational Resilience · copilot · auto · 65.5 AIC · ⌖ 8.45 AIC · ⊞ 8.1K · ◷

• expires on Sep 4, 2026, 7:54 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #57980.