[uk ai resilience] UK AI Open Code Risk & Resilience Report - 2026-11-10

[github-actions[bot]]

Executive summary

7-day window: 381 commits, 204 security-signal, 29 open security issues, 23 code-scanning alerts, 0 secret alerts. Key risks: ai-scan CWE-59/78/1327 findings in actions/setup/sh/* and workflows; non-deterministic npm/uv installs in 5 lock workflows (alerts 1081-1085); container CVE backlogs; engine egress-default gaps. All areas Tier B or A; no Tier C/D.

Limitation: sub-agents were not dispatched and file analysis was restricted by tool permissions; findings are based on alert/issue metadata (reduced confidence). No new issues created since existing open issues already track the top items.

Tiers

• Tier B: setup/sh symlink/log findings, install-gh-aw.sh, CWE-78 workflows, unpinned lock installs, container CVEs, egress defaults, pkg/cli CWE-22/732
• Tier A: remaining areas

Control gaps

Dependency (unpinned installs, Pi runtime graph, CVE backlog); ownership per area unverified. SDLC, secrets (0 alerts), recovery adequate.

Remediation queue

• High (7d): pin npm/uv installs; lock Pi graph; close egress gaps
• Medium (14d): triage ai-scan alerts 1086-1101; CVE burn-down
• Low (30d): alert 1102

Exceptions

None.

Metrics

MTTR proxy, ownership coverage: not computed. Unpinned installs: 5 lock files. Exception aging: 0. Exposure without recovery: none identified.

Generated by UK AI Operational Resilience · copilot · auto (Claude Sonnet 5.5) · ~18 AIC · ⌖ ~2 AIC · ⊞ 8.8K · ◷

• expires on Nov 13, 2026, 7:31 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #76892.