[uk ai resilience] UK AI Open Code Risk & Resilience Governance — Recent-Changes Review (2026-09-18)

[github-actions[bot]]

Executive summary

This run applied the UK public-sector AI Open Code Risk & Resilience guidance with a recent-changes focus (7-day lookback since 2026-09-11T15:31:19Z) to github/gh-aw. In-window activity: 122 commits (36 flagged as security-signal), 274 open code-scanning alerts (263 error / 10 warning / 1 note), 0 open secret-scanning alerts, and 58 pre-existing open UK-AI-resilience tracking issues.

The dominant finding is scale, not novelty: 256 of 274 open alerts (93%) are non-deterministic dependency-install patterns (npm install/uv pip install/pip install) in compiled .lock.yml workflows, already under one umbrella tracking issue (#61636). The remaining alerts cluster into five previously-identified classes (allocation-size-overflow, bad-redirect-check false positives, GraphQL injection risk, Dockerfile SHA-pinning, missing CODEOWNERS) — all already tracked as open Tier B/C issues. One new, previously untracked finding was identified: alert #679 (go/useless-assignment-to-field in pkg/cli/logs_orchestrator_stdin.go), which weakens observability of log message handling in a recently-touched CLI area.

Note on sub-agent orchestration: the asset-tier-classifier, control-verifier, and ai-risk-scorer sub-agents each failed twice in this run with an infrastructure error (model "gpt-5.4-mini" is not accessible). Per the retry-once guardrail, this analysis proceeds with the primary agent's direct evidence review; confidence is recorded as partial for sections that would normally be sub-agent-verified.

No repository-hiding or concealment measures are recommended anywhere in this report; all actions are open-remediation or time-boxed exception measures.

Asset graph summary (recent-change scoped)

Recent-change segments and ownership signals

Segment	Runtime Area	Key Alerts/Issues	Ownership Signal	Tier Hypothesis
Compiled .lock.yml workflows (npm/uv/pip installs)	CI workflow execution	256 alerts → #61636	gh-aw-bot (auto-compiled), reviewed by pelikhan/mnkiefer	B
pkg/workflow MCP config generators (mcp_cli_mount.go, mcp_setup_generator.go, mcp_github_config.go, compiler_yaml_ai_execution.go)	Compiler	5 alloc-overflow alerts → #60876, #60875, #59773	Copilot agent PRs, human co-author sign-off	C
pkg/cli package-manifest tooling (add_package_manifest_imports.go, add_package_manifest_includes.go) + pkg/workflow/graders_config.go	CLI / compiler	4 bad-redirect-check alerts → #59491, #57472, #54037	Copilot agent PRs	B
pkg/cli/project_command.go	CLI (GitHub GraphQL client)	2 GraphQL-injection-risk alerts → #52749	Copilot agent PRs	B
Root Dockerfile	Container build	1 SHA-pinning alert → #61166	Copilot agent PR	B
pkg/cli/logs_orchestrator_stdin.go	CLI (log ingestion)	1 alert #679 useless-assignment — untracked	Recent CLI churn, unclear reviewer	C (new)
Repo-wide governance	Ownership	Missing CODEOWNERS → #61637	N/A	B

Tier classification table

Tier assignments

Tier	Count of areas	Examples
A — Open Safe	0	—
B — Open With Conditions	5	dependency non-determinism (#61636), bad-redirect-check (#59491 family), GraphQL injection (#52749), Dockerfile pinning (#61166), CODEOWNERS gap (#61637)
C — Restricted Pending Review	3	allocation-overflow cluster (#60876/#60875/#59773), alert-dismissal hygiene gap (#57982 family), new: alert #679 logging bug
D — Decommission Candidate	0	—

Control verification gaps

Control domain status

Domain	Status	Evidence	Gap Severity
Ownership controls	Absent	No .github/CODEOWNERS found for security-sensitive compiler/CLI paths (tracked #61637, still open)	High
SDLC controls	Partial	Commits show consistent "Initial plan" → agentic PR → human co-author sign-off pattern (pelikhan, mnkiefer), but 58 open security issues vs 274 alerts suggests review backlog	Medium
Dependency controls	Absent (for these classes)	256 non-deterministic install alerts unresolved; 1 Dockerfile unpinned image	High
Secret exposure controls	Present	0 open secret-scanning alerts in window	Low
Runtime observability	Partial	pkg/logger namespace convention exists repo-wide, but alert #679 shows a broken log-message assignment shipped in a recently-touched file, untracked	Medium
Recovery controls	Partial	Active issue-tracking loop exists (58 open tracking issues), but multiple prior issues (#57982, #57981, #57728, #59490) report alerts remaining open despite related work being closed — dismissal hygiene lags remediation	Medium-High

Risk-scoring table and rationale

AI-aware risk scoring

Area	Exposure Amp	Patchability	Detectability	Operational Fragility	Ownership Confidence	Tier	Remediation Priority
Dependency install non-determinism (256 alerts)	Medium	High	High (already flagged)	Medium	Medium	B	High
Allocation-overflow cluster (5 alerts)	Low	High	Medium	Low	Medium	C	Medium
bad-redirect-check cluster (4 alerts, recurring)	Low-Medium	High	Medium (recurring FP pattern undermines signal trust)	Medium	Medium	B	High
GraphQL injection risk (project_command.go)	Medium	High	Medium	Low	Medium	B	Medium
Dockerfile unpinned image	Medium	High	High	Low	High	B	Medium
Missing CODEOWNERS	Medium	High	High	Medium	Low	B	High
Alert #679 useless-assignment (logs_orchestrator_stdin.go) — NEW	Low	High	Low (silently drops a Message value, no test failure)	Medium (obscures log content on failure paths)	Low (no tracking issue, untriaged)	C	High
Alert-dismissal hygiene gap (systemic)	Medium	Medium	Low (meta-problem, needs process fix not code fix)	High	Low	C	Critical

Rationale: The alert-dismissal hygiene gap is scored Critical because it is a compounding, systemic weakness — every other Tier B/C item's remediation depends on the same triage loop keeping pace, and it currently does not (58 tracked issues vs 274 raw alerts, several issues explicitly noting stale/undismissed items). Alert #679 is elevated to Tier C/High despite low individual severity because it is untracked, silently drops a value used for log messages (reducing incident-response detectability), and sits in a CLI file with ongoing churn.

Remediation queue with SLAs

#	Item	Action	SLA Urgency
1	Alert #679 (new)	Fix useless assignment to Message field in logs_orchestrator_stdin.go; add a regression test asserting the field is read/used correctly	High
2	Alert-dismissal hygiene (systemic)	Run a consolidated triage sweep across #57982/#57981/#57728/#59490 to close/dismiss alerts whose underlying code was already remediated	Critical
3	Dependency non-determinism (#61636)	Prioritize adding --frozen/hash-verification flags to the shared .lock.yml generation templates rather than per-file fixes, given 256 alerts share root cause	High
4	Missing CODEOWNERS (#61637)	Add .github/CODEOWNERS entries for pkg/cli, pkg/workflow, .github/workflows/*.lock.yml generation logic	High
5	bad-redirect-check recurring FP (#59491/#57472/#54037)	Land shared isSafeRelativePath helper to resolve the recurring class rather than re-triaging per alert each cycle	Medium
6	GraphQL injection risk (#52749)	Migrate project_command.go to GraphQL variables instead of fmt.Sprintf string interpolation	Medium
7	Dockerfile SHA pin (#61166)	Pin alpine:3.24 (or current base) to a sha256: digest	Medium

Exception register

No new exceptions are proposed this run. No repository-hiding or permanent concealment measures are recommended. Existing Tier C items (#60876, #60875, #59773, #53737) remain open pending standard remediation; none currently justify a formal temporary exception grant since patchability is High and no active exploit signal was observed.

Operational metrics baseline

Metric	Value	Note
MTTR proxy (tracking-issue backlog)	58 open security issues vs 274 open alerts	Ratio suggests batching/umbrella tracking (e.g. #61636 covers 256 alerts) rather than 1:1 issue-per-alert
Ownership coverage	0% for compiler/CLI paths	No CODEOWNERS file present
Unsupported dependency ratio	N/A this run	No outdated/EOL dependency signal surfaced; focus was install-determinism, not staleness
Exception aging	0 active exceptions	None proposed or outstanding
Exposure without recovery capability	Low	All identified issues are patchable (High patchability across the board); no irrecoverable exposure found

Limitations

• asset-tier-classifier, control-verifier, and ai-risk-scorer sub-agents failed twice with a model "gpt-5.4-mini" is not accessible via the /chat/completions endpoint infrastructure error. Analysis was completed directly by the primary agent using the same evidence files; treat sub-agent-specific confidence as not independently verified this run.

Generated by UK AI Operational Resilience · copilot · auto · 63.6 AIC · ⌖ 8.79 AIC · ⊞ 7.9K · ◷

• expires on Sep 21, 2026, 7:37 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #62397.