[uk ai resilience] UK AI Open Code Risk & Resilience Governance — 2026-07-07

[github-actions[bot]]

UK AI Open Code Risk & Resilience Governance Report

Repository: github/gh-aw | Date: 2026-07-07 | Lookback: 7 days (since 2026-06-30)

---

1. Executive Summary

The gh-aw repository is an AI-native GitHub CLI extension with high commit velocity (359 commits in 7 days, ~51/day) and active security posture. The overall risk posture is Tier B — Open With Conditions: the codebase is open-source with strong operational controls, but carries 5 undismissed code-scanning alerts (all opened 11–23 days ago), no CODEOWNERS file, and one supply-chain exposure in its security-critical image publishing pipeline that has not yet received an issue/tracking record.

No secret scanning alerts are open. All runner-guard and static analysis findings are triaged and stable. Recent commits demonstrate rapid response to security-relevant issues.

---

2. Asset Graph Summary (Recent-Change Scoped)

Asset	Type	Changed in Window	Alert Count	Tier
pkg/cli/project_command.go	Go CLI library	✓	2 (#627,#628)	B
scripts/ensure-docs-slide-pdf.js	CI/build script	✓	1 (#636)	B
.github/workflows/publish-safe-outputs-node.yml	Security infra workflow	✓	1 (#625)	C
pkg/workflow/engine_firewall_support.go + actions/setup/setup.sh	Agent sandbox infra	✓	0	B
pkg/workflow/repository_features_validation.go	GraphQL validation	✓	1 (#626)	A
pkg/linters/	Static analysis	✓	0	A
.github/workflows/ (general)	CI pipeline	✓	333 (all triaged)	B
AI agent token/credential access	Cross-cutting	✓	0	B

---

3. Tier Classification Table

Tier	Assets	Rationale
A — Open Safe	repository_features_validation.go, pkg/linters/, smoke tests	No open alerts, static queries, well-tested
B — Open With Conditions	CLI project commands, docs builder, firewall infra, general workflows, token management	Open alerts but mitigated or low-exploitability; controls present
C — Restricted Pending Review	publish-safe-outputs-node.yml (alert #625)	Unpinned supply-chain action in security-critical image publisher; no existing tracking issue
D — Decommission Candidate	None	No assets identified for decommission

---

4. Control Verification Summary

Domain	Status	Evidence	Key Gap
Ownership	PARTIAL	PRs co-authored by pelikhan; Copilot agent reviews; no CODEOWNERS file	No CODEOWNERS — ownership by convention only
SDLC	VERIFIED	CodeQL automated (codeql.yml), Semgrep daily scan, actionlint, runner-guard; all commits PGP-verified	—
Dependency	VERIFIED	dependabot.yml covers go/npm/pip across 4 directories; go.sum (298 lines); Firewall SHA-pinned in recent commit	docker/build-push-action in publish-safe-outputs still on tag
Secret Exposure	VERIFIED	0 open secret scanning alerts; secrets passed via env, not hardcoded in scanned files	—
Runtime Observability	VERIFIED	Daily semgrep scan, smoke-claude/codex, daily-model-inventory, token telemetry workflow, audit-workflows	runner-guard composite grade not emitted in compile output
Recovery	VERIFIED	MTTR proxy: ~24–72h (firewall bump filed→fixed same day; parser issues resolved in 1–2 days); automated recompile on merge	No formal rollback runbook documented

---

5. Risk-Scoring Table

Area	Exp. Amp.	Patchability	Detectability	Op. Fragility	Ownership	Composite	Tier	Priority
Unpinned supply-chain in safe-outputs publisher (#625)	9	2	7	9	3	7.4	C	high
GraphQL injection in project_command.go (#627/#628)	3	2	5	3	3	3.2	B	medium
Network-to-file in docs builder (#636)	3	3	6	2	3	3.4	B	medium
GraphQL static concat (#626)	1	2	8	1	3	2.5	A	low

Scoring rationale (0=best, 10=worst):

Detail: Unpinned supply-chain action (#625)

• exposure_amplification=9: The safe-outputs Node image is consumed by all agentic workflow runs. A compromised image poisons every downstream AI agent execution, giving an attacker persistent presence in all agent-run CI/CD jobs across the repository.
• patchability=2: Trivially fixed — pin docker/build-push-action to its SHA hash (0aefeb1103cb... or current SHA for v7.2.0).
• detectability=7: A compromised action would execute in a GitHub-hosted runner; detecting supply-chain injection in a published Docker image is hard without image provenance verification.
• operational_fragility=9: Publishing pipeline for security infrastructure. If this publish step is compromised, every agent run is affected until the image is republished.
• ownership_confidence=3: Workflow owner is clearly the gh-aw team; response path is clear.
• threat_hypothesis: Attacker gains write access to docker/build-push-action repository or the v7.2.0 tag is moved to point to malicious code, compromising the safe-outputs Node image publish, which propagates a backdoor to all agentic workflow runs.
• exploit_acceleration_claim: AI agents running with GitHub token access make post-compromise pivoting trivially fast — once the image is backdoored, every subsequent agent run becomes an exfiltration/lateral-movement vector.
• operational_weakness: No SHA pin means any change to the upstream action tag is silently accepted.
• mitigation_plan: Pin docker/build-push-action to a specific commit SHA. Add image provenance verification (sigstore/cosign attestation) for the published image as a follow-up.

Detail: GraphQL injection (#627/#628)

• Code review reveals createProject() and linkProjectToRepo() ALREADY use parameterized GraphQL variables ($ownerId: ID!, $projectId: ID!, $repositoryId: ID!) — the semgrep alerts are likely stale or false positives targeting an older code version that used string interpolation. The escapeGraphQLString() function exists in the same file. Real injection risk is low.
• exposure_amplification=3: Limited to project management CLI commands; requires authenticated operator to invoke.
• mitigation_plan: Verify current semgrep alerts against lines 294-310 and 390-396 — if parameterized variables are confirmed, dismiss the alerts with documented rationale.

Detail: Network-to-file in docs builder (#636)

• Code review shows a CodeQL suppression comment at line 148: // codeql[js/http-to-file-access]: readPdfBytes() only downloads from a fixed GitHub media URL and validates content type, size, and PDF signature before this write. The validation appears intentional and documented.
• exposure_amplification=3: Docs build script; runs in CI but only writes to a fixed output path with validated content.
• mitigation_plan: Formally dismiss CodeQL alert [Custom Engine Test] Test Pull Request - Custom Engine Safe Output #636 with the existing comment as justification, or move the suppression comment to the standard // codeql-disable-next-line format to close the alert.

---

6. Remediation Queue with SLAs

#	Finding	Tier	SLA	Action	Status
1	Pin docker/build-push-action to SHA in publish-safe-outputs-node.yml (#625)	C	High — 7 days	Replace @v7.2.0 with SHA pin. See issue #aw_pub625	🆕 New issue
2	Verify/dismiss GraphQL alerts #627/#628 — code uses parameterized variables	B	Medium — 14 days	Manual review + dismiss if false positive	Tracked in #43830
3	Dismiss/close CodeQL alert #636 — validated suppression comment present	B	Medium — 14 days	Add formal dismissal with CWE-434 rationale	Tracked in #43831
4	Add CODEOWNERS file	B	Low — 30 days	Define ownership for pkg/, scripts/, .github/workflows/	Untracked
5	Fix SC2086/SC2038 shellcheck warnings in compiler templates	B	Low — 30 days	Compiler-level fix (see static-analysis report #43937)	Tracked in #43937
6	Dismiss GraphQL static concat alert #626 — static query, not user-controlled	A	Low — 30 days	Formal dismissal with rationale	Untracked

---

7. Exception Register

Finding	Threat Hypothesis	Expiry	Mitigation
runner-guard RGS-004 (305 findings)	Comment-triggered workflows without author-auth check	Already closed per policy #31043	Per-file issues filed and closed
runner-guard RGS-012 (11 findings)	Secret exfiltration via outbound HTTP	Already closed per policy #31043	Legitimate model API calls; reviewed
poutine untrusted_checkout_exec (10)	Fork checkout execution	# poutine:ignore annotation	Post-merge execution pattern; reviewed

All current exceptions are temporary and auditable via closed issue trail. No permanent hidden-repo exceptions.

---

8. Operational Metrics Baseline

Metric	Value	Assessment
MTTR proxy	~24–72h	Based on firewall bump same-day response; parser/test fixes in 1–2 days
Ownership coverage	~70%	PR review by pelikhan + Copilot agent on most changes; no CODEOWNERS
Unsupported dependency ratio	Low	Dependabot active across 4 ecosystems; AWF firewall proactively bumped
Exception aging	Healthy	All active exceptions are closed per documented policy
Exposure without recovery capability	Low	Rapid publish cycle; rollback via re-running publish workflow
Commit velocity	51/day	Very high; increases integration risk without automated gates
Code scanning coverage	High	CodeQL + Semgrep + runner-guard + zizmor + poutine + actionlint
Secret scanning	Clean	0 open alerts

---

Next Actions

1. 🔴 [High, 7 days] Pin docker/build-push-action to SHA in publish-safe-outputs-node.yml — see new issue #aw_pub625
2. 🟡 [Medium, 14 days] Review and dismiss GraphQL alerts Add test agentic workflow for GitHub remote MCP #627/Add execution duration tracking to tool usage reporting for both Codex and Claude engines #628 (likely false positives — parameterized variables already used)
3. 🟡 [Medium, 14 days] Formally dismiss CodeQL [Custom Engine Test] Test Pull Request - Custom Engine Safe Output #636 (suppression comment already present)
4. 🟢 [Low, 30 days] Add CODEOWNERS file
5. 🟢 [Low, 30 days] Emit runner-guard composite grade in gh aw compile output

References:

• §28881016107
• Static Analysis Report #43937
• [UK AI Open Code Guidance]((www.gov.uk/redacted)

Generated by UK AI Operational Resilience · 132.2 AIC · ⌖ 6.28 AIC · ⊞ 5.1K · ◷

• expires on Jul 10, 2026, 8:28 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #44783.