[uk-ai-resilience] Tier C: dependabot.yml lacks docker ecosystem entries for gh-aw-firewall/gh-aw-mcpg container images

[github-actions]

Tier: C — Restricted Pending Review

Risk-Scoring Breakdown

• Exposure amplification: Medium-High (runtime execution surface)
• Patchability: Medium (depends on upstream base-image release cadence, but automatable)
• Detectability: High (recurring container-image-scan issues already surface CVEs, e.g. [uk-ai-resilience] [uk-ai-governance] Tier C: Unpatched Critical CVEs in container images (libc6 CVE-2026-5450) #48405 libc6 CVE-2026-5450, [uk-ai-resilience] [security] Upgrade Go runtime in gh-aw-firewall/agent container — critical GO-2026-4337 (Tier C) #47821 Go runtime GO-2026-4337)
• Operational fragility: Medium
• Ownership confidence: Low (no automated update path configured)

Finding

.github/dependabot.yml only configures gomod, npm, and pip ecosystems across /, /docs, /actions/setup/js, and .github/workflows. It has no docker ecosystem entries for the container images referenced by open container-image-scan issues (ghcr.io/github/gh-aw-firewall/agent, /squid, /api-proxy, /cli-proxy, ghcr.io/github/gh-aw-mcpg, ghcr.io/github/github-mcp-server). As a result, known CVEs (libc6 CVE-2026-5450 per issue #48405; Go runtime GO-2026-4337 per issue #47821) are detected only by periodic manual/scheduled scans and have no automated dependency-bump PR path for remediation, leaving exposure without a structural recovery capability.

Remediation Action

Add package-ecosystem: docker entries to .github/dependabot.yml for each Dockerfile directory backing the gh-aw-firewall/* and gh-aw-mcpg images, with a weekly schedule matching existing ecosystems, so base-image/library CVEs (e.g. libc6, Go runtime) generate automated update PRs instead of relying solely on manual triage of container-image-scan issues.

SLA Urgency

Critical

Discussion Report

See the full UK AI Open Code Risk & Resilience governance discussion report created in this run (Recent-Change Governance Review, 2026-07-30) for the full asset graph, tier classification, and control verification tables. This finding complements — and does not duplicate — the CVE-specific issues #48405 and #47821, which track the individual vulnerabilities rather than the missing automated update-path control.

Generated by UK AI Operational Resilience · auto · 56.3 AIC · ⌖ 8.04 AIC · ⊞ 8.8K · ◷

[github-actions]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🍪 Issue Monster selected this for Copilot

I have identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 3.01 AIC · ⊞ 10.5K · ◷

[github-actions]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🍪 Issue Monster selected this for Copilot

I have identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 2.86 AIC · ⊞ 10.5K · ◷

[github-actions]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🍪 Issue Monster selected this for Copilot

I have identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 3.5 AIC · ⊞ 10.5K · ◷

[github-actions]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🍪 Issue Monster selected this for Copilot

I have identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 3.2 AIC · ⊞ 10.8K · ◷

[github-actions]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 4.32 AIC · ⊞ 11.3K · ◷

[github-actions]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🍪 Issue Monster selected this for Copilot

I have identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 3.11 AIC · ⊞ 11.3K · ◷

[github-actions]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🍪 Issue Monster selected this for Copilot

I have identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 3.51 AIC · ⊞ 11.3K · ◷

[github-actions]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🍪 Issue Monster selected this for Copilot

I have identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 3.66 AIC · ⊞ 11K · ◷

[github-actions]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🍪 Issue Monster selected this for Copilot

I have identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 3.41 AIC · ⊞ 11K · ◷

[github-actions]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🍪 Issue Monster selected this for Copilot

I have identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 2.38 AIC · ⊞ 11K · ◷

[github-actions]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🍪 Issue Monster selected this for Copilot

I have identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 3.59 AIC · ⊞ 11.2K · ◷