[uk ai resilience] UK AI Open Code Risk & Resilience: Recent-Change Governance Review (7-day window, 2026-07-30)

[github-actions[bot]]

Executive Summary

Recent-change-scoped review (7-day window, since 2026-07-23) of github/gh-aw covering 347 commits, 157 security-signal commits, 51 open security issues, 4 open code-scanning alerts, 0 open secret-scanning alerts. Activity is dominated by Copilot-authored automated commits (262) plus github-actions/dependabot maintenance (72) and human maintainer review (12, primarily @pelikhan). No new secret exposure detected. The security backlog is heavily process-generated: three separate open issues (#43830, #46277, #47822) recur for the same GraphQL-injection finding in pkg/cli/project_command.go spanning three weeks, indicating slow remediation velocity and duplicate-issue churn rather than concealment risk. One governance gap not previously tracked was found: the repository has no .github/CODEOWNERS file, so security-sensitive paths (pkg/cli/, scripts/, container/workflow definitions) have no enforced reviewer routing.

Asset Graph Summary (recent-change scoped)

Component	Recent change surface	Risk signal
pkg/cli/project_command.go	GraphQL query construction (getOwnerNodeId, fmt.Sprintf + escapeGraphQLString)	Code-scanning #651/#652, warning severity
pkg/cli/outcome_eval.go	REST path construction via fmt.Sprintf("repos/%s/%s", escapeOwnerRepo(...), endpoint)	Historically flagged (#641/#642, #45519), mitigated with escapeOwnerRepo
scripts/ensure-docs-slide-pdf.js	Fixed-URL PDF download → local file write	CodeQL js/http-to-file-access #636; already annotated/suppressed with justification comment
Git auth helpers (git_auth_helpers.cjs)	Duplicate Authorization header fix for fork-backed PRs (#49059)	Resolved this window; regression test added
Secret handling (uploadSecretToRepo, CLI secret set)	--body - stdin delivery, symlink-bypass fix in ValidatePathWithinBase, argv-exposure fix	Actively hardened this window (ADR-48318 drafted)
Container images (gh-aw-firewall/*, gh-aw-mcpg, github-mcp-server)	Version bumps + recurring container-image-scan issues	Unpatched libc6 CVE-2026-5450 (#48405), Go runtime GO-2026-4337 (#47821) still open

Tier Classification

Area	Tier	Rationale
pkg/cli/project_command.go GraphQL construction	B — Open With Conditions	Mitigating control (escapeGraphQLString) exists but is string-based, not variable-based; fix has been re-reported 3x without closure
pkg/cli/outcome_eval.go REST path construction	A — Open Safe	escapeOwnerRepo mitigation present; no recurrence in this window
scripts/ensure-docs-slide-pdf.js	A — Open Safe	Fixed-source download, content-type/size/signature validated, inline justification comment present
Container images (firewall/mcpg family)	C — Restricted Pending Review	Known unpatched CVEs (libc6, Go runtime) persist across multiple weekly scan cycles
Repository ownership routing	C — Restricted Pending Review	No CODEOWNERS file; security-sensitive paths have no enforced review gate

Control Verification Gaps

Control domain	Evidence	Gap
Ownership	No .github/CODEOWNERS found	No automatic reviewer assignment for pkg/cli/, scripts/, workflow/container definitions
SDLC	Semgrep/CodeQL scanning active (produces the 4 alerts reviewed)	Alerts recur across weeks (#651/#652 issue chain since 2026-07-06) without closure — indicates review/backlog gap, not detection gap
Dependency	dependabot.yml covers gomod/npm/pip ecosystems weekly	No Docker/container-image ecosystem entry for gh-aw-firewall/* or gh-aw-mcpg; container CVEs (libc6, Go runtime) rely solely on manual/scheduled container-image-scan issues
Secret exposure	Multiple hardening commits this window (argv exposure fix, --body -, ADR-48318)	None currently open; secret-scanning alerts = 0
Runtime observability	Namespaced debug logger (pkg/logger) referenced across CLI	Adequate for CLI; no equivalent evidence for container runtime alerting
Recovery	GraphQL injection issue lineage (#43830→#46277→#47822) unresolved 3+ weeks	Slow patch velocity; no visible rollback/mitigation interim control noted

Risk-Scoring Table

Area	Exposure amplification	Patchability	Detectability	Operational fragility	Ownership confidence	Tier
GraphQL injection (project_command.go)	Medium (owner/org-scoped GraphQL API only)	High (swap to typed GraphQL variables)	High (CodeQL/Semgrep catches recurrence)	Low	Medium	B
Container image CVEs (libc6, Go runtime)	Medium-High (runtime execution surface)	Medium (depends on upstream base-image release cadence)	High (scheduled scans)	Medium	Low (no dependabot docker ecosystem entry)	C
Missing CODEOWNERS	N/A (process control)	High (trivial to add)	N/A	Low	Low	C

Remediation Queue

Item	Action	SLA
project_command.go GraphQL injection	Replace fmt.Sprintf query interpolation with typed GraphQL variables (-f login=$owner variable binding, not string embed)	High — close existing #47822 lineage this sprint
Container base images	Add docker/ghcr.io ecosystem entries to dependabot.yml for gh-aw-firewall/* and gh-aw-mcpg; bump libc6/Go runtime per #48405/#47821	Critical
CODEOWNERS	Add .github/CODEOWNERS covering pkg/cli/, scripts/, .github/workflows/, container Dockerfiles	Medium

Exception Register

None required this cycle — no permanent hidden-repo or scope-reduction exceptions requested.

Operational Metrics Baseline

• MTTR proxy: GraphQL injection finding open ≥24 days across 3 duplicate issues (2026-07-06 → still open 2026-07-30)
• Ownership coverage: 0% — no CODEOWNERS enforcement
• Unsupported/stale dependency ratio: 2 of 6 tracked container images have confirmed unpatched CVEs open >3 days (libc6, Go runtime)
• Exception aging: N/A (no active exceptions)
• Exposure without recovery capability: Container image CVEs lack an automated dependency-update path (Docker ecosystem absent from dependabot.yml)

Generated by UK AI Operational Resilience · auto · 56.3 AIC · ⌖ 8.04 AIC · ⊞ 8.8K · ◷

• expires on Aug 2, 2026, 8:11 AM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-02T16:11:18.284Z.

Closed by Workflow