[uk ai resilience] UK AI Open Code Risk & Resilience Governance — Weekly Review (2026-09-17)

[github-actions[bot]]

Executive summary

Recent-changes governance sweep of github/gh-aw over the 7-day window (2026-09-10→2026-09-17): 162 commits (all GPG-verified), 44 flagged as security-relevant, 274 open code-scanning alerts, 56 open security issues (most already tracked under prior [uk-ai-resilience] runs), 0 open secret-scanning alerts. The dominant new, untracked signal is a cluster of 256 dependency-determinism alerts (246 npm-install-non-deterministic + 10 uv-pip-install-non-deterministic) that appeared 2026-09-15 across dozens of generated .github/workflows/*.lock.yml files. These originate from a single compiler-level control point (pkg/workflow/copilot_engine_installation.go, engine_helpers.go, run_install_scripts_validation.go) that emits pinned-version npm install -g <pkg>@<version> / uv pip install steps without a lockfile/hash-pinning mechanism the scanner recognizes. No repository-hiding action is recommended; the fix path is compiler-level (add lockfile or hash-pinned install mode), not per-generated-file edits. Automation (Copilot bot, dependabot, github-actions bot) accounts for ~95% of commit volume, with human (pelikhan) review trailers on Copilot PRs providing the primary human-in-the-loop control.

Asset graph summary (recent-change scoped)

Asset graph (recent-change scoped)

Segment	Runtime Area	Dependencies	Ownership Signal	Tier Hypothesis
Go workflow compiler (pkg/workflow/*.go, engine install/mount/setup)	Build-time compiler emitting Actions YAML	npm/uv/pip CLI installers, MCP config generators	Copilot-authored PRs + pelikhan review co-author trailers	Tier B — Open With Conditions
Generated lock files (.github/workflows/*.lock.yml, ~250+ files)	GitHub Actions runtime (CI)	Node/npm, uv/pip, Docker base images	Regenerated via make recompile; no direct human edits	Tier B — Open With Conditions (untracked determinism gap)
CLI package-manifest tooling (pkg/cli/add_package_manifest_*.go)	Local/CI CLI codemod	Go stdlib net/http redirect handling	Copilot PR + review	Tier B (already tracked issue exists)
Firewall/container images (gh-aw-firewall bump to v0.28.20, squid/agent/cli-proxy/api-proxy)	Runtime network egress control	ghcr.io firewall image set	gh-aw-bot automated bump PRs	Tier A — Open Safe (routine, reviewed bump)
eslint-factory custom lint rules	Dev tooling / static analysis	Node child_process	Copilot PR, narrow scope	Tier A — Open Safe
Docs/instructions (threat-detection report-as-issue field)	Documentation	none	Human-authored doc update	Tier A — Open Safe
Root Dockerfile (alpine:3.24 unpinned)	Container build	apk/alpine base image	Already tracked (issue open)	Tier B — already governed

Most important untracked risks:

• 256 dependency-determinism alerts (npm/uv-pip) with no tracking issue — largest blast radius of the window, spans most compiled workflow lock files, but has a single compiler-level remediation point.
• Fix belongs in pkg/workflow/copilot_engine_installation.go / engine_helpers.go (add hash-pinned or lockfile-based install pattern, or document a pinned-version-only accepted-risk exception), not per-lock.yml edits — editing generated files directly would be immediately overwritten by make recompile.
• Automation-heavy commit stream (Copilot 101, github-actions bot 38, dependabot 15 of 162) means ownership confidence rests on reviewer diligence (pelikhan) rather than a formal CODEOWNERS file — no .github/CODEOWNERS exists in this repo, a governance gap worth flagging but not urgent given 100% commit signature verification.

Control verification gaps

Control verification detail

Control Domain	Evidence	Verdict	Gap
Ownership	No .github/CODEOWNERS; review load concentrated on pelikhan as co-author on Copilot PRs	Partial	No formal per-path ownership mapping
SDLC	162/162 commits GPG-verified; Copilot PRs carry human co-author trailers; .changeset/ used (1 changeset commit in window)	Verified	Changeset discipline is thin relative to commit volume (1 vs 162)
Dependency	Engine installers pin exact versions (e.g. @openai/codex@0.154.0) but no lockfile/hash pinning → scanner flags non-determinism at 256 sites	Partial	No compiler-level lockfile/hash-pin mechanism; untracked
Secret exposure	0 open secret-scanning alerts; no plaintext secrets observed in reviewed commit messages	Verified	GitHub App token-minting feature request open (issue, not yet implemented) — monitor when built
Runtime observability	audit-workflows.lock.yml present and alert-affected (generated); MCP logs guardrail convention documented in repo instructions	Verified	Observability tooling itself carries a few determinism alerts (self-referential, low severity)
Recovery	Firewall version bump commits (v0.27→v0.28.x) show active patch cadence; changeset workflow exists for rollback context	Verified	None material in this window

Risk-scoring table and rationale

AI-aware risk scoring (dimensions 1-5, higher = more risk)

Area	Exposure Amplification	Patchability	Detectability	Operational Fragility	Ownership Confidence (5=high)	Tier
npm/uv-pip install non-determinism (256 alerts, untracked)	4	4 (single compiler fix point, high leverage)	5 (scanner already flags it)	2	3	Tier B
Go allocation-size-overflow (5 alerts, already tracked)	2	4	5	2	4	Tier C (unchanged, governed)
Go bad-redirect-check (4 alerts, already tracked)	2	3	5	2	4	Tier B (unchanged, governed)
Dockerfile SHA-pinning gap (already tracked)	3	5 (trivial pin)	5	1	4	Tier B (unchanged, governed)
Missing CODEOWNERS	2	5 (add file)	2 (not scanner-visible)	2	2	Tier B

Remediation queue with SLAs

1. [NEW] Add lockfile or hash-pinned install mode for AI engine CLI installers in pkg/workflow/copilot_engine_installation.go / engine_helpers.go (or document accepted-risk exception for pinned-version-only installs across ~250 generated workflows) — SLA: high, single compiler-level fix, large blast-radius reduction.
2. [NEW] Add .github/CODEOWNERS mapping pkg/workflow/, pkg/cli/, and .github/workflows/*.md sources to accountable maintainers — SLA: medium.
3. (Already tracked, no new issue) Continue existing remediation on go/allocation-size-overflow, go/bad-redirect-check, Dockerfile SHA-pin, and README smoke-test alert-numbering drift issues — SLA: as previously assigned.

Exception register

None proposed this run — no permanent hidden-repo or scope-suppression exceptions are warranted; the npm/uv-pip finding is addressable at the compiler level within a bounded SLA.

Operational metrics baseline

• MTTR proxy: firewall version bumps land same-day (v0.28.1→v0.28.20 within window) — healthy patch velocity for infra deps.
• Ownership coverage: 0% formal (no CODEOWNERS); informal coverage via a single human reviewer (pelikhan) on ~101 Copilot-authored commits.
• Unsupported dependency ratio: 256/274 (93%) of open code-scanning alerts are dependency-determinism findings concentrated in one remediable pattern.
• Exception aging: n/a (no exceptions currently registered).
• Exposure without recovery capability: low — all flagged areas have a known, bounded fix path (compiler patch, pin, or CODEOWNERS addition); no irrecoverable exposure identified.

Generated by UK AI Operational Resilience · copilot · auto · 83.3 AIC · ⌖ 12.5 AIC · ⊞ 8.3K · ◷

• expires on Sep 20, 2026, 7:40 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #61820.