[uk ai resilience] [uk-ai-resilience] Governance report - 2026-10-08

[github-actions[bot]]

Executive summary

7-day window (since 2026-10-01): 330 commits (173 Copilot, 79 maintainer, 24 dependabot), 248 open code-scanning alerts, 0 secret-scanning alerts, 44 open security-labelled issues. Most risk is concentrated in compiled workflows (*.lock.yml) and new automation scripts. Most themes already have open tracking issues. Two alerts raised on 2026-10-08 (go/unsafe-quoting, go/weak-sensitive-data-hashing) have no tracking issue.

Limitation: sub-agents (asset-tier-classifier, control-verifier, ai-risk-scorer) were not dispatched; the analysis was done directly from the pre-computed data, so confidence is medium.

Asset graph summary

• Compiled workflows .github/workflows/*.lock.yml: 216 npm + 10 uv + 1 pip install alerts (non-deterministic installs).
• Compiler pkg/workflow: maintenance_workflow_yaml_jobs.go (unsafe quoting, 2 alerts), expression_extraction.go (weak hashing), github_app_requirements.go, graders_config.go (bad-redirect-check).
• CLI pkg/cli: project_command.go (GraphQL via Sprintf), add_package_manifest_* (bad redirect).
• Scripts .github/scripts/*.cjs: 5 insecure-temp-file alerts.

Tier classification

Tier table

Area	Tier	Tracking
Lock-file installs	B	#65894
Temp-file handling in scripts	B	#65895
GraphQL Sprintf in project_command.go	B	#66214
No CODEOWNERS	B	#61637
Maintenance workflow YAML quoting (critical)	B	none, new issue
expression_extraction.go hashing	B	none (low priority)
bad-redirect-check (5 alerts, oldest 2026-08-28)	B	none
Release App token minting	C	#60296
curl | sudo sh installer	B	#62521

Control verification gaps

• Ownership: no .github/CODEOWNERS ([uk-ai-resilience] Missing .github/CODEOWNERS for security-sensitive compiler/CLI paths (Tier B) #61637).
• SDLC: CodeQL alerts sit open for up to ~6 weeks (bad-redirect-check).
• Dependency: 226 non-deterministic install alerts; container CVE burn-down issues are open.
• Secrets: none open. Good.
• Observability/recovery: not independently verified; there is rollback evidence in the reverted App-token change.

Risk scoring

Scores (1-5, higher = riskier)

Area	Exposure	Patchability	Detectability	Fragility	Ownership conf.	Priority
Maintenance YAML unsafe quoting	4	2 (easy fix)	2	3	3	high
Lock-file installs	4	3	2	3	3	high
expression_extraction hashing	2	2	2	2	3	medium
bad-redirect-check	2	2	2	2	3	medium

Remediation queue

Item	SLA
Fix unsafe quoting in maintenance_workflow_yaml_jobs.go (new issue)	high
Triage the 5 bad-redirect-check alerts	medium
Review the weak-hash alert (confirm non-sensitive use)	medium
Existing issues #65894, #65895, #66214, #61637, #60296	per issue

Human review is required for the critical-rated alert and for any workflow permission or token changes.

Exception register

None.

Metrics baseline

• MTTR proxy: oldest open alerts are ~41 days old (bad-redirect-check #665/Codex fails to start github MCP #664, 2026-08-28).
• Ownership coverage: 0% via CODEOWNERS.
• Unsupported dependency ratio: not measured.
• Exception aging: 0 exceptions.
• Exposure without recovery capability: none identified.

Generated by UK AI Operational Resilience · copilot · auto · 15.3 AIC · ⌖ 0.663 AIC · ⊞ 7.9K · ◷

• expires on Oct 11, 2026, 7:40 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #67226.