[uk ai resilience] UK AI Open Code Risk & Resilience Report – 2026-11-13

[github-actions[bot]]

Executive summary

Lookback 7 days: 363 commits (208 with security signals), 24 open code-scanning alerts, 0 secret-scanning alerts, 26 open security-labelled issues. Secret exposure controls look healthy. Main gaps: 8 high-severity CWE-59 (symlink/file-write) AI-scan alerts in actions/setup/sh/*, non-deterministic installs in compiled lock workflows, and aging container CVE burn-down issues (oldest 2026-10-13).

Caveat: sub-agents and some shell reads were unavailable under tool permissions, so scoring relies on the pre-computed alert and issue data plus limited file reads. Confidence is medium.

Asset graph summary (recent-change scoped)

Asset graph

Segment	Surface	Alerts
actions/setup/sh	runtime shell helpers (patch gen, usage artifacts, proxies, MCP gateway)	1088-1096 (6 high CWE-59, others medium)
actions/setup/js	MCP handler and validator	1061, 1097, 1098
pkg/cli	package ownership, mcp logs guardrail	1086 (high CWE-732), 1099
.github/workflows/*.lock.yml	compiled workflows	1081-1085 (high, non-deterministic installs)
copilot-maintenance.yml, upgrade-test.yml	CI maintenance	1100 (high), 1101
scripts/	CI scripts	1103 (high), 1104
install-gh-aw.sh	installer	1087

Ownership signals were not verified per path (no CODEOWNERS check).

Tier classification

Tier table

Area	Tier
actions/setup/sh symlink handling (CWE-59)	C – Restricted Pending Review (affected scripts)
Lock-file non-deterministic installs	B
mcp_logs_guardrail.go perms (CWE-732)	B
Maintenance workflows (CWE-78)	B
scripts/ci-front-door.cjs, markdown_metadata_test_adapter.cjs	B
install-gh-aw.sh	B
actions/setup/js alerts	A/B
Container CVE burn-downs (#68340-#69275)	B (aging)
Domain egress audit issues (#70226, #72063, #72064, #73396)	B

No Tier D candidates identified.

Control verification gaps

• Ownership: no per-path evidence gathered.
• SDLC: CodeQL and AI-scan active, but 6 high CWE-59 alerts open show remediation lagging detection.
• Dependency: non-deterministic npm/uv installs in lock workflows (1081-1085); container CVE issues up to ~31 days old.
• Secrets: 0 open alerts; PR Sous Chef add-comment repeatedly fails with Bad credentials for per-handler token #72944 and Cross-repository smoke checkouts reject GH_AW_SIDE_REPO_PAT with Bad credentials #72945 show token-handling fragility.
• Runtime observability: possible sensitive logging in start_mcp_gateway.sh:460 (1088).
• Recovery: patch/rollback via compiler regeneration is plausible but unverified.

Risk scoring

Scores (1 low risk – 5 high risk)

Area	Exposure	Patchability	Detectability	Fragility	Ownership confidence	Priority
actions/setup/sh CWE-59	4	2	2	3	3	high
Lock-file installs	3	2	2	2	3	high
mcp_logs_guardrail perms	2	1	2	2	3	medium
Maintenance workflows CWE-78	3	1	2	2	3	high
Container CVE burn-downs	3	3	1	2	3	medium

Rationale: the shell helpers run in every compiled workflow, amplifying exposure. Alerts exist but are untriaged.

Remediation queue

#	Action	SLA
1	Harden symlink/path handling in actions/setup/sh (1089-1094)	high
2	Pin lock-file installs (1081-1085) in compiler templates	high
3	Fix CWE-78 in copilot-maintenance.yml / upgrade-test.yml	high
4	CWE-732 in mcp_logs_guardrail.go (1086)	medium
5	Triage container CVE burn-down issues, assign owners	medium

Human review triggers: changes to patch generation or usage artifact collection; any ownership gap.

Exception register

None. Any exception needs threat hypothesis, exploit acceleration claim, operational weakness, expiry date and mitigation plan.

Operational metrics baseline

• MTTR proxy: oldest open container CVE issue ~31 days.
• Ownership coverage: not measured.
• Unsupported dependency ratio: not measured; 5 non-deterministic install alerts.
• Exception aging: 0 exceptions.
• Exposure without recovery capability: none confirmed (unverified).

Generated by UK AI Operational Resilience · copilot · auto (Claude Sonnet 5.5) · ~21 AIC · ⌖ ~2 AIC · ⊞ 8.8K · ◷

• expires on Nov 16, 2026, 7:32 AM UTC-08:00