[uk ai resilience] UK AI Open Code Risk & Resilience Governance — 2026-09-16 (7-day lookback)

[github-actions[bot]]

1. Executive summary

Recent-changes scope: 7-day lookback (since 2026-09-09T15:31:12Z), 165 commits, 46 security-signal commits, 56 open security-labeled issues, 274 open code-scanning alerts (0 secret-scanning alerts). The governance loop (classification → control verification → risk scoring → decisioning) is operating continuously — most open alerts already have a matching tracking issue from prior UK AI Governance runs. This run's incremental contribution is narrow: 3 previously-untracked findings surfaced in files touched by a single broad commit (038128d / PR #61359, "Fix stale docker action pins in wasm golden fixture", 2026-09-16), plus confirmation that the bulk of open alerts (256 of 274) are two low-severity, repo-wide "non-deterministic install" lint findings across dozens of generated .lock.yml workflows, not new risk.

No critical/blocking issues found. Two Tier B/C gaps are opened as new issues per Phase 6; all other real alerts already have open tracking issues and are not duplicated here.

2. Asset graph summary (recent-change scoped)

Asset graph (recent-change scoped)

Segment	Files/paths	Recent touch	Alerts in scope
CI docker-pin automation	Dockerfile, .github/workflows/format-and-commit.yml, .github/workflows/daily-geo-optimizer.lock.yml, wasm golden fixture	1 commit (PR #61359, 2026-09-16) touched all of these incidentally while re-pinning stale Docker action refs	#940 (Dockerfile, tracked #61166), #831 (setup-node missing version, untracked), #768 (pip install no hash-check, untracked)
Go CLI — logs orchestrator	pkg/cli/logs_orchestrator_stdin.go	same commit (PR #61359)	#679 (dead assignment, untracked, non-security)
Go compiler / MCP config generators	pkg/workflow/compiler_yaml_ai_execution.go, mcp_cli_mount.go, mcp_setup_generator.go, mcp_github_config.go	not touched in-window; alerts pre-date window	#681, #678, #677, #676, #675 — all tracked (#60875, #60876, #59773)
CLI package-manifest tooling	pkg/cli/add_package_manifest_imports.go, add_package_manifest_includes.go, pkg/workflow/graders_config.go	not touched in-window	#674, #669, #668, #667 — all tracked (#59491), flagged as a recurring false-positive class
Docs/scripts	scripts/ensure-docs-slide-pdf.js, README.md	not touched in-window	#663 (tracked #53737), #657 (tracked #59774)
GraphQL query construction	pkg/cli/project_command.go	not touched in-window	#652, #651 (tracked #52749)
Generated workflow lockfiles (repo-wide)	~85 .github/workflows/*.lock.yml	ongoing compiler output regenerated on every workflow edit	256 alerts: github-actions-npm-install-non-deterministic (246), actions-uv-pip-install-non-deterministic (10) — systemic compiler-template pattern, not per-file drift

Ownership signal: the docker-pin sweep (PR #61359) is a single automated commit touching Dockerfile + multiple unrelated workflow/fixture/CLI files — a broad-scope bot commit, which is why 3 unrelated new findings surfaced together. Dependency risk (unpinned Dockerfile base image, unpinned/no-hash pip install of a third-party skill) is concentrated in CI/build tooling, not application logic.

3. Tier classification table

Tier classification

Finding	File	Tier	Status
#940 dockerfile-non-sha-pinned-image	Dockerfile	B	Already tracked (#61166)
#831 setup-node missing version	.github/workflows/format-and-commit.yml:29	B	New — issue opened this run
#768 pip install no hash-check	.github/workflows/daily-geo-optimizer.lock.yml:2096 (source: .github/workflows/daily-geo-optimizer.md:53, installs third-party PyPI package geo-optimizer-skill)	C	New — issue opened this run
#679 useless-assignment-to-field	pkg/cli/logs_orchestrator_stdin.go:73	A	Correctness bug, no security impact — noted, not filed as a governance issue
#680 workflow-out-of-context ("test_dup_import")	n/a	B	Already tracked (#61165)
#681, #678, #677, #676, #675 go/allocation-size-overflow	pkg/workflow/*.go	C	Already tracked (#60875, #60876, #59773)
#674, #669, #668, #667 go/bad-redirect-check	pkg/cli, pkg/workflow	B	Already tracked (#59491) — recurring false-positive class
#663 js/http-to-file-access	scripts/ensure-docs-slide-pdf.js	C	Already tracked (#53737)
#657 workflow-security-finding-1	README.md	B	Already tracked (#59774)
#652, #651 graphql-injection-sprintf	pkg/cli/project_command.go	B	Already tracked (#52749)
256× npm/pip non-deterministic install lint	generated .lock.yml (repo-wide)	B (systemic)	Compiler-template-level pattern; not itemized per-file (see remediation queue)

4. Control verification gaps

• Ownership: Adequate for CLI/compiler code (clear package structure, active maintainers per commit history); partial for the CI docker-pin sweep pattern — a single wide-blast-radius automated commit touched 3+ unrelated files, making root-cause attribution harder when new alerts surface in a batch.
• SDLC: Adequate — signed/verified commits, PR review via bot + Copilot "Initial plan" pattern, active CI. No gap identified this run.
• Dependency controls: Gap — root Dockerfile uses alpine:3.24 unpinned (tracked), and the generated daily-geo-optimizer.lock.yml runs pip install geo-optimizer-skill with no version pin or hash check, executing arbitrary third-party PyPI code in a daily scheduled CI job. Recommend pinning ==<version> plus --require-hashes or vendoring.
• Secret exposure: Adequate — 0 open secret-scanning alerts, consistent with prior runs. No new evidence of gaps.
• Runtime observability: Minor gap — logs_orchestrator_stdin.go:73 sets logsData.Message on a code path that returns immediately without rendering it (dead code), unlike three sibling call sites in the same file that do render logsData. Not a security issue, but a correctness/observability inconsistency worth a follow-up cleanup (not filed as a governance issue; recommend a normal engineering fix).
• Recovery/remediation velocity: Partial — prior issues ([uk-ai-resilience] Four untracked go/bad-redirect-check alerts in pkg/cli and pkg/workflow (Tier B) #59491, [uk-ai-resilience] Three untracked go/allocation-size-overflow alerts in MCP-gateway config generators (Tier C) #59773) already flag recurring alert classes (go/bad-redirect-check, go/allocation-size-overflow) reappearing in sibling files after earlier fixes, indicating point-fixes rather than root-cause/library-level remediation. No new recurrence introduced this run, but the pattern persists.

5. Risk-scoring table and rationale

Risk-scoring table

Finding	Exposure amplification	Patchability	Detectability	Operational fragility	Ownership confidence	Tier
#831 setup-node missing version	Low–Medium (silent Node version drift across CI runs)	High (add explicit node-version)	Medium (only surfaces if CI behavior changes unexpectedly)	Medium	High (single workflow file, clear owner)	B
#768 pip install no hash-check	Medium–High (arbitrary third-party PyPI code executed unpinned in scheduled CI)	High (pin version + hash)	Low (silent until a supply-chain compromise occurs)	High	Medium (compiled from source .md, but third-party dependency choice not owned by this repo)	C

6. Remediation queue with SLAs

Item	Action	SLA
#831 (new issue)	Pin explicit node-version in actions/setup-node step of format-and-commit.yml	Medium
#768 (new issue)	Pin geo-optimizer-skill to an exact version (and hash-check if available) in daily-geo-optimizer.md source	Critical (supply-chain execution risk in scheduled CI)
#679 (not filed, engineering note)	Remove or wire up the dead logsData.Message assignment in logs_orchestrator_stdin.go:73	Low (cosmetic/correctness, no SLA needed)
Systemic: 256× non-deterministic install lint	Consider updating the workflow-compiler template to pin npm/pip installs (or add --frozen-lockfile/hash-checking) at the generator level rather than per-file	High (single template fix resolves ~93% of open alert volume)
Existing Tier B/C backlog (#59491, #59773, #60875, #60876, #53737, #59774, #52749)	No new action this run — already tracked; recommend a periodic root-cause review per prior alert-dismissal-hygiene findings (#57982, #59490)	Medium

7. Exception register

None created this run — no repository-hiding or long-lived exceptions proposed.

8. Operational metrics baseline

• MTTR proxy: New findings (📝 Reorganize and Update Documentation Structure #831, Fix core.warn API usage and enable comprehensive type checking for JavaScript files #768) surfaced same-day as their introducing commit (PR [ci-coach] Fix stale docker action pins in wasm golden test fixture #61359) via this automated run — near-zero detection latency.
• Ownership coverage: High for CLI/compiler; Medium for CI dependency-pinning practices (recurring gap class across Dockerfile + workflow steps).
• Unsupported dependency ratio: 1 unpinned Docker base image + 1 unpinned/no-hash third-party PyPI package identified in this window's scope.
• Exception aging: N/A — no open exceptions.
• Exposure without recovery capability: Low — both new findings are straightforwardly patchable (version/hash pinning) with no rollback complexity.

Generated by UK AI Operational Resilience · copilot · auto · 94.4 AIC · ⌖ 7.9 AIC · ⊞ 8.2K · ◷

• expires on Sep 19, 2026, 7:39 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #61635.