[uk ai resilience] UK AI Governance: recent-change risk review (2026-08-28 to 2026-09-04)

[github-actions[bot]]

Executive summary

7-day recent-change scan (2026-08-28 → 2026-09-04) across 193 commits (51 security-signal). Of 11 open CodeQL alerts, most are already tracked by prior UK AI resilience issues (#54037, #57472, #57728, #52749, #53737, #57981) and remain in steady-state Tier B/C holding patterns. Two alerts are newly untracked this cycle: #672 (allocation-size-overflow, already caught by prior-run issue #58261, still open) and #674 (bad-redirect-check in the new add_package_manifest_imports.go file, an extension of the same false-positive pattern already tracked at #54037/#57472). #673 (unsafe-quoting) is now stale: its underlying fix (PR #58495) landed in-window and the code path is verified correctly escaped, so the alert should be dismissed rather than re-remediated. Separately, the static-analysis pipeline (#58390) reported a real observability gap — 6 of 8 scanning tools produced zero output — which is itself the highest-priority operational-resilience finding this cycle. No open secret-scanning alerts. Overall repository posture: Tier B (Open With Conditions), no new Tier C/D exposure identified.

Asset graph summary (recent-change scoped)

Recent-change asset graph

Segment	Runtime area	Dependencies / ownership	Notes
pkg/cli/add_package_manifest_imports.go (new file)	CLI, compile-time only	Local, no CODEOWNERS path-specific rule; org-wide CODEOWNERS (@dsyme @eaftan @pelikhan @krzysztof-cieslak)	Package manifest import-graph resolution; introduces alert #674
pkg/workflow/auto_update_workflow.go	Generated GH Actions workflow (auto-upgrade)	Same CODEOWNERS	Fix #58495 landed in-window; alert #673 now stale
pkg/workflow/mcp_setup_generator.go	Workflow compiler (MCP tool wiring)	Same CODEOWNERS	Pre-existing tracked finding #58261 (alert #672)
pkg/workflow/graders_config.go, pkg/cli/add_package_manifest_includes.go	Compile-time path guards	Tracked in #57472 (Tier B)	Recurring false-positive shape, no new risk
Static-analysis scan pipeline (.github/workflows)	CI security tooling	Same CODEOWNERS + Dependabot (gomod/npm/pip/docker, weekly)	Instrumentation gap: poutine/runner-guard/syft/grype/yamllint/shellcheck produced no output (#58390)
Sighthound command-injection findings (pip_validation.go, git.go, runner_guard.go, upgrade_command.go)	CLI/workflow generation, internal tooling	Same CODEOWNERS	New scan (#58398), not yet triaged against actual exec.Command usage

Tier classification table

Tier classification

Finding	Tier	Rationale
#674 bad-redirect-check, add_package_manifest_imports.go	B	Same verified false-positive shape as #54037/#57472 (path-traversal guard, not a redirect handler); new file, no existing tracking issue
#672 allocation-size-overflow, mcp_setup_generator.go	B	Already tracked (#58261), still open; genuine arithmetic-overflow risk though exposure is low (compile-time input)
#673 unsafe-quoting, auto_update_workflow.go	B (stale, pending dismissal)	Underlying fix (#58495) verified landed and correct; alert is a false leftover, not a live risk
Static-analysis pipeline data gap (#58390)	C	6/8 security tools silently produced zero output for at least one run — a control/observability failure, higher priority than any single code finding
Sighthound command-injection claims (#58398)	C (pending review)	Flags internal CLI exec paths; needs confirmation these use exec.Command argument arrays vs shell string building before downgrading
Recurring already-tracked findings (#667–#669, #663, #653, #651/#652, #564)	B/C (unchanged)	No new evidence this cycle; existing tracking issues remain open and current

Control verification gaps

• Ownership: repo-wide CODEOWNERS exists (@dsyme @eaftan @pelikhan @krzysztof-cieslak) but has no path-scoped rules — ⚠️ no directory-level ownership signal for pkg/cli/, pkg/workflow/, or scripts/, which the [uk-ai-resilience] Untracked code-scanning alert #672 in mcp_setup_generator.go (Tier B) #58261 tracker also flagged as an ownership-confidence gap.
• Dependency controls: .github/dependabot.yml covers gomod, npm (docs, actions/setup/js, workflows), pip, and docker across multiple directories on a weekly cadence — adequate coverage, no gap found.
• Runtime/CI observability: ⚠️ confirmed gap — static-analysis run ([static-analysis] Report - 2026-09-04 #58390) shows poutine, runner-guard, syft, grype, yamllint, and shellcheck produced zero output while zizmor/actionlint worked normally; this is an instrumentation failure in the scanning pipeline itself, not a "clean" result, and risks masking real findings from those 6 tools.
• Secret exposure: 0 open secret-scanning alerts — no gap identified from available data (repo-level enforcement settings could not be verified read-only in this run).
• SDLC/branch protection: not independently verifiable in this run (API access to branch-protection settings was not available); recommend confirming required-review and required-status-check settings on main in a future cycle.

Risk-scoring table and rationale

Risk-scoring breakdown

Finding	Exposure amplification	Patchability	Detectability	Operational fragility	Ownership confidence	Overall
#674 bad-redirect-check	Low	High	High (CodeQL)	Low	Medium	Low-Medium
#672 allocation-size-overflow	Low	High	High (CodeQL)	Low	Low (no path-scoped CODEOWNERS)	Medium
#673 unsafe-quoting (stale)	Low	High (already fixed)	High (CodeQL)	Low	Medium	Low
Static-analysis data gap (#58390)	Medium (masks other findings)	Medium (needs pipeline fix, not code fix)	Low (silent failure)	Medium	Medium	Medium-High
Sighthound command-injection claims (#58398)	Unconfirmed — pending code review	Unknown	Medium (LLM-based scan, unverified)	Low	Medium	Pending review

Remediation queue with SLAs

1. [High] Fix scanning-pipeline instrumentation gap so poutine/runner-guard/syft/grype/yamllint/shellcheck report reliably ([static-analysis] Report - 2026-09-04 #58390) — restores detectability for 6 of 8 security tools.
2. [Medium] Dismiss alert Test Issue for Commands #673 (go/unsafe-quoting) as remediated — fix verified present in auto_update_workflow.go line ~208 via escapeYAMLSingleQuoted.
3. [Medium] Add CodeQL suppression or backslash-guard to isPathWithinPackageRoot/readLocalImportedManifest in pkg/cli/add_package_manifest_imports.go (alert #674), consistent with the fix already proposed for [uk-ai-resilience] UK AI Governance: unreviewed CodeQL go/bad-redirect-check alert in add_package_manifest.go (Tier B) #54037/[uk-ai-resilience] UK AI Governance: recurring go/bad-redirect-check false positive across path-traversal guards (Tier B) #57472; consider batching all four sibling false positives ([Custom Engine Test] Test Pull Request - Custom Engine Safe Output #667, Codex fails to report failure if unauthorised #668, [Custom Engine Test] Test Issue Created by Custom Engine #669, #674) into one PR.
4. [High] Add overflow guard or widen intermediate type for the allocation-size computation in pkg/workflow/mcp_setup_generator.go:146 (alert Hello from Claude #672, already tracked at [uk-ai-resilience] Untracked code-scanning alert #672 in mcp_setup_generator.go (Tier B) #58261) — add a regression test for large/edge-case input.
5. [Medium] Triage sighthound command-injection findings ([sighthound] Security findings in github/gh-aw #58398) in pip_validation.go, git.go, runner_guard.go, upgrade_command.go — confirm exec.Command argument-array usage vs shell concatenation; document outcome to prevent repeat false-positive churn.
6. [Low] Add path-scoped CODEOWNERS entries for pkg/cli/, pkg/workflow/, and scripts/ to close the recurring "ownership confidence: low" finding raised across multiple tracker issues.

Exception register

None required this cycle — no finding meets the bar for a temporary hidden/suppressed exception. All identified gaps have direct, non-concealment remediation paths (code fix, dismissal with rationale, or pipeline instrumentation fix).

Operational metrics baseline

• MTTR proxy: [code-scanning-fix] Fix go/unsafe-quoting: escape single quotes in GH_AW_UPGRADE_OPTIONS #58495 (unsafe-quoting fix) landed same-window as its originating concern — fast remediation velocity for actively-tracked findings.
• Ownership coverage: repo-wide only (1 rule, 4 owners); 0% path-scoped coverage for pkg/cli/, pkg/workflow/, scripts/.
• Unsupported/stale dependency ratio: not assessable this cycle (Dependabot active weekly across 9 ecosystem/directory pairs; no stale-PR backlog surfaced in available data).
• Exception aging: 0 open exceptions (register empty).
• Exposure without recovery capability: 0 findings identified without a documented remediation path; static-analysis pipeline gap ([static-analysis] Report - 2026-09-04 #58390) is the one item where detection capability, not recovery capability, is degraded.

Generated by UK AI Operational Resilience · copilot · auto · 50.7 AIC · ⌖ 8.47 AIC · ⊞ 8.1K · ◷

• expires on Sep 7, 2026, 7:37 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #59250.