[uk ai resilience] [uk-ai-resilience] Weekly recent-change risk & resilience review (2026-09-08 to 2026-09-15)

[github-actions[bot]]

Executive summary

Recent-changes-scoped UK AI Open Code Risk & Resilience review of github/gh-aw over the 7-day window since 2026-09-08. 193 commits merged (51 flagged security-signal), 55 pre-existing open security issues, 274 open code-scanning alerts (263 error / 10 warning / 1 note), 0 open secret-scanning alerts.

The dominant volume (246 of 274 alerts) is a single systemic pattern — non-deterministic npm install/uv pip install steps embedded in compiler-generated .lock.yml workflow files — not new logic risk, and best fixed once at the gh aw compile template level rather than per-file. Beyond that noise floor, this week's genuinely new signals are: (1) a release-workflow GitHub App token-minting change that was merged and reverted within the same week without a documented sign-off (already tracked, Tier C); (2) two new go/allocation-size-overflow CodeQL findings (already tracked, Tier C precedent); (3) a stray 2.3MB compiled Go binary (test_dup_import) committed directly to main alongside a secret-validation PR, indicating an automation commit-hygiene gap; and (4) a fresh Dockerfile SHA-pinning gap on the repo's own root Dockerfile (distinct from the already-tracked, already-remediated node:lts-alpine vendored image). No open secret-scanning alerts were found. Overall resilience posture is reasonable — the token-minting incident shows fast, working rollback — but two items lack any open tracking issue and are escalated below.

Asset graph summary (recent-change scoped)

Recent-change asset graph

Asset	Files / Surfaces	Why it matters	Tier hypothesis
Release workflow token minting	.github/workflows/release*.md/.lock.yml	Credential-minting change to release automation, merged+reverted same week, no documented sign-off (tracked #60296)	C
Secret extraction/redaction	pkg/workflow/secret_extraction.go (ReplaceSecretsWithEnvVars, ReplaceSecretsWithShellEnvVars), #60267, #60348	Handles how ${{ secrets.* }} expressions are rewritten into env-var references for generated workflow steps; uses backslash/JSON-safe prefixing, no plaintext interpolation found	A/B
Agent Plugin checkout auth	#59744 (runtime-retrieved credentials), #59743 (permission preservation)	Auth/credential surface for checkout steps in generated workflows	B
Token/usage/AIC accounting	#60997, #60892, #60526, #60424	Billing/cost-guardrail logic, not security-sensitive but operationally important	A
CodeQL Go findings (fresh)	pkg/workflow/compiler_yaml_ai_execution.go:92, pkg/workflow/mcp_cli_mount.go:378 (alloc-overflow, tracked #60875/#60876); pkg/cli/logs_orchestrator_stdin.go:73 (useless field assignment, alert #679, untracked); test_dup_import root (workflow-out-of-context, alert #680, untracked)	Static-analysis surface touched by this week's compiler/CLI commits	C (alloc-overflow, precedent) / B (#679 code-quality) / B (#680 commit-hygiene, escalated)
Dockerfile SHA pinning	root /Dockerfile (FROM alpine:3.24), alert #940 (fresh, 2026-09-15, untracked)	Non-deterministic build base for the repo's own compiler image; distinct from the already-remediated vendored node:lts-alpine image tracked in container-image-scan issues	B (escalated, no tracking issue)
Workflow lock-file supply chain	~256 alerts across dozens of .github/workflows/*.lock.yml	Systemic, compiler-generated non-deterministic install pattern; needs a template-level fix, not per-file remediation	B (systemic, low per-instance severity)

Tier classification table

Tier classification

Area	Tier	Rationale
Release token minting revert (#60296)	C	Credential-minting to release automation shipped+reverted without visible sign-off; revert was fast and clean (good recovery signal)
Secret extraction/redaction	A	Env-var indirection pattern reviewed in code; no plaintext secret interpolation in run: blocks found
Agent Plugin checkout auth	B	Credential-scoped change, reviewed via PR, but touches token permission semantics — merits a follow-up confirmation pass
Token/usage/AIC accounting	A	Non-security financial/reporting logic; correctness bugs (fixed this week) not exploitable
go/allocation-size-overflow (x2, tracked)	C	Existing precedent tier from #60875/#60876
go/useless-assignment-to-field (#679, untracked)	B	Dead-store code-quality issue in pkg/cli/logs_orchestrator_stdin.go, not exploitable, low urgency
Stray committed binary test_dup_import (#680, untracked)	B	Committed 2.3MB Go ELF binary + template-leak artifacts alongside a secret-validation PR (#60267); benign payload (no net/exec symbols) but signals an automation commit-hygiene gap worth a tracked remediation
Dockerfile SHA pinning (#940, untracked)	B	Root /Dockerfile base image not pinned to digest; reproducibility/supply-chain gap on the repo's own compiler image, security_severity_level: high per rule
Workflow lock-file supply chain (246+10 alerts)	B	Systemic, low-severity-per-instance, generated pattern; needs compiler template fix

Control verification gaps

• Ownership: CODEOWNERS lists 4 named maintainers repo-wide (no path-scoped rules) — coarse but present; no gap specific to this week's changes.
• SDLC: All flagged changes went through PR review (including Copilot automated review) with merge records; the token-minting PR (Add GitHub App token minting for release workflow #60214) and its revert (Revert GitHub App token minting for release tags #60218) both had Copilot review comments but no explicit human security sign-off recorded in either PR body — this is the SDLC gap already tracked in [uk-ai-resilience] GitHub App token minting for release workflow added and reverted without documented security sign-off (Tier C [Content truncated #60296.
• Dependency controls: No new third-party dependencies introduced this week; Dockerfile base-image pinning gap (Add rocket social icon linking to instructions.md in Astro Starlight docs #940) is the one dependency-adjacent gap lacking tracking.
• Secret exposure: Secret-handling code changes this week route secrets through env-var substitution, not inline interpolation — no plaintext exposure found.
• Runtime observability: Token-usage/AIC accounting fixes this week directly improve observability of zero/failed-usage edge cases (Fix zero token usage in the logs MCP tool run schema #60424, Treat missing evals accounting as zero AIC #60892) — a net positive control improvement.
• Recovery controls: Token-minting revert (Revert GitHub App token minting for release tags #60218) executed cleanly within ~20 minutes of the original merge, with a documented root cause (APP_ID not installed) and validation notes (gh aw compile --strict passed) — strong rollback evidence, but no post-incident sign-off was logged.

Risk-scoring table and rationale

AI-aware risk scoring

Area	Exposure Amplification	Patchability	Detectability	Operational Fragility	Ownership Confidence	Tier	Priority	SLA
Release token minting (#60296)	Medium	High	Medium	Low	Medium	C	High	7 days
Stray committed binary (#680)	Low	High	Low (only via scanner)	Low	Medium	B	High	14 days
Dockerfile SHA pinning (#940)	Medium	High	High (scanner-flagged)	Low	High	B	Medium	30 days
go/useless-assignment-to-field (#679)	Low	High	High	Low	High	B	Low	60 days
Workflow lock-file supply chain (systemic)	Low	Medium (needs template fix)	High	Medium	Medium	B	Medium	30 days

Rationale: the stray-binary finding is elevated to High priority despite low exploit potential because it is direct evidence that an automated/agentic commit path bypassed normal build-artifact hygiene — a process-integrity signal the governance guidance treats as higher-value than the payload's own risk. The Dockerfile pinning gap is Medium priority: high detectability and patchability keep it low-effort to close, but it affects the reproducibility of the repo's own published compiler image.

Remediation queue with SLAs

#	Item	Action	SLA Urgency
1	Stray test_dup_import binary + leftover template artifacts on main	Remove committed binary/artifacts; add .gitignore rules for compiled test binaries and tmp/ scratch files; audit the automation path behind the originating commit	High — 14 days
2	Root Dockerfile FROM alpine:3.24 unpinned	Pin to @sha256:<digest>, wire into existing --force-refresh-container-pins refresh cadence	Medium — 30 days
3	go/useless-assignment-to-field in logs_orchestrator_stdin.go:73	Remove or fix the dead assignment to Message field	Low — 60 days
4	Workflow lock-file non-deterministic installs (systemic)	Update gh aw compile templates to pin/lock npm and uv installs at generation time rather than per-file	Medium — 30 days
5	Release token-minting sign-off gap (#60296, already tracked)	No new action — continue existing tracked remediation	High — per existing issue

Exception register

None raised this cycle. No permanent hidden-repo or scope exceptions requested; all items above are addressed via standard remediation, not concealment.

Operational metrics baseline

• MTTR proxy: Token-minting revert completed in ~21 minutes from merge to revert-merge — strong rollback velocity.
• Ownership coverage: Repo-wide CODEOWNERS with 4 maintainers, no path-scoped rules for security-sensitive paths (e.g., pkg/workflow/secret_extraction.go, release workflows).
• Unsupported dependency ratio: 0 new third-party dependencies introduced this week; 1 unpinned base image (Dockerfile Add rocket social icon linking to instructions.md in Astro Starlight docs #940).
• Exception aging: N/A — no active exceptions.
• Exposure without recovery capability: None identified this week — all flagged changes had either a fast revert (token minting) or a straightforward removal path (stray binary, unpinned image).

Generated by UK AI Operational Resilience · copilot · auto · 87.8 AIC · ⌖ 6.25 AIC · ⊞ 8.2K · ◷

• expires on Sep 18, 2026, 7:38 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #61377.