[uk ai resilience] UK AI Open Code Risk & Resilience Governance Report (7-day window)

[github-actions[bot]]

Executive summary

Lookback 7 days: 371 commits (208 security-signal), 26 open security issues, 23 open code-scanning alerts, 0 secret alerts.

Limitations: shell analysis was denied and sub-agents were not dispatched; findings are from grep over alert/issue JSON. Confidence is partial; human review advised.

• 5 error code-scanning alerts in generated lock files: spec-librarian Enable missing-tool safe output by default when safe-outputs are configured #1085, smoke-copilot Fix JavaScript code formatting issue in push_to_pull_request_branch.test.cjs #1084, jsweep Update mcp inspect command to filter safe-outputs without changing parser #1083, eslint-miner Add support for minimum validation in safe-outputs configurations with refactored base type architecture #1082, daily-doc-updater Add mcp list-tools command for listing MCP server tools #1081.
• 18 warnings, mostly actions/setup/sh/*.sh, actions/setup/js/*.cjs, install-gh-aw.sh, pkg/cli.
• Open issues cluster on container CVE burn-downs, egress/domain-allowlist audits, and Bad credentials failures.

Tier classification

Tier table

Area	Tier	Rationale
Egress/domain default bypasses	C	Network boundary gaps; review required
Lock-file error alerts	B	Regenerable, needs triage
Credential failures	B	Operational fragility
Setup shell scripts, install-gh-aw.sh	B	Hardening, supply chain
Container CVEs	B	Tracked burn-downs
pkg/cli warnings	A	Low exposure

Control verification gaps

Ownership, observability and unsupported-dependency ratio unverified. Secrets control effective (0 alerts). Recovery: workflows regenerable; per-binary release attestations still missing.

Remediation queue

Item	Action	SLA
Alerts #1081-#1085	Identify rule, fix in source, recompile	high
Domains-audit issues	Align engine-default guards	high
Credential failures	Verify token provisioning	medium
Setup shell warnings	Harden scripts	medium
CVE burn-downs	Continue existing process	medium

Exception register

None.

Metrics baseline

MTTR proxy, ownership coverage, unsupported-dependency ratio: not computed (tool limits). Exception aging: 0. Exposure without recovery: low.

Issues

None created; top items already tracked by open issues.

Generated by UK AI Operational Resilience · copilot · auto (Claude Sonnet 5.5) · ~17 AIC · ⌖ ~2 AIC · ⊞ 8.8K · ◷

• expires on Nov 15, 2026, 7:31 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #77499.