[uk ai resilience] UK AI Open Code Risk & Resilience Governance — Weekly Report 2026-07-24

[github-actions[bot]]

UK AI Open Code Risk & Resilience Governance

Repository: github/gh-aw | Period: 2026-07-17 → 2026-07-24 | Run: §30107107922

---

Executive Summary

The repository is operating at high velocity (354 commits in 7 days, ~50/day) driven largely by Copilot SWE agent. Governance posture is Tier B — Open With Conditions. Two actionable code-scanning findings remain open (GraphQL injection in CLI, JS network-to-file write). The firewall agent container image (agent:0.27.41) carries a critical Go stdlib vulnerability (GO-2026-4337) and a severe Go runtime version lag, requiring urgent upgrade. No secrets were exposed. Dependency license noncompliance persists in container images.

---

Asset Graph Summary (Recent-Change Scoped)

Asset / Surface	Tier	Changed This Week	Key Risk
pkg/cli/project_command.go	B	✅ Yes (lint fixes)	GraphQL injection via fmt.Sprintf (alerts #651, #652)
ghcr.io/github/gh-aw-firewall/agent:0.27.41	C	✅ Yes (version bump)	Critical Go stdlib CVE GO-2026-4337; 365 total CVEs; digest drift
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.41	B	✅ Yes (version bump)	5 CVEs (1 fixable: @opentelemetry/core); 34 denied licenses
scripts/ensure-docs-slide-pdf.js	B	❌ No	CodeQL js/http-to-file-access (alert #636)
.github/workflows/ (lock.yml fleet)	A	✅ Yes (recompile)	Actions pinned by digest; permissions scoped
pkg/linters/	A	✅ Yes (new rules)	Positive: new shell-injection and defer-safety linters
pkg/actionpins/	A	✅ Yes	Container/action pinning enforced
AI-agent SDLC (Copilot SWE)	B	N/A	High commit velocity; human review gating required

---

Tier Classification Table

Tier	Surfaces	Count
A — Open Safe	Workflow lock fleet, linter pkg, actionpins	3
B — Open With Conditions	CLI GraphQL path, api-proxy container, JS docs script, AI-agent SDLC	4
C — Restricted Pending Review	agent container (critical Go stdlib CVE + digest drift)	1
D — Decommission Candidate	None	0

---

Control Verification

Control Domain	Evidence	Status	Gap / Notes
Ownership	pelikhan = primary maintainer; bot PRs reviewed before merge	✅	Single human maintainer — bus-factor risk
SDLC	All commits PGP-verified; PRs required; lint + test CI gates	✅	—
Dependency	Container CVEs tracked; Grype + Grant scans daily; action pins enforced	⚠️	Critical Go stdlib CVE in agent image unpatched; 34+ denied licenses in api-proxy
Secret Exposure	0 secret-scanning alerts; no .env leaks detected	✅	—
Runtime Observability	Daily Semgrep, CodeQL, Grype, container digest drift detection	✅	Alerts #651/#652/#636 open >1 week without assignment
Recovery	Firewall bumped to clear prior CVE gate; digest pinning enables rollback	✅	No formal MTTR SLA documented; recovery relies on manual action

---

Risk-Scoring Table

Area	Exposure Amp.	Patchability	Detectability	Op. Fragility	Ownership Conf.	Tier	SLA
GraphQL injection — project_command.go	3	4 (use GQL vars)	3	2	4	B	High
JS network-to-file — ensure-docs-slide-pdf.js	2	3	3	1	3	B	Medium
Agent container: critical Go stdlib GO-2026-4337	5	4 (upgrade Go)	4	4	4	C	Critical
Api-proxy: fixable @opentelemetry/core CVE	2	5 (upgrade pkg)	3	2	4	B	High
License noncompliance (GPL/LGPL in images)	2	2 (requires audit)	4	1	3	B	Low
AI-agent SDLC (Copilot SWE velocity)	3	3	3	3	4	B	Medium

Scores 1–5 (5 = worst). Overall tier = worst-case dimension result.

---

Remediation Queue with SLAs

Priority	Finding	Action	SLA	Owner
🔴 Critical	Agent container: Go stdlib GO-2026-4337 (critical) + 365 CVEs	Upgrade Go runtime to ≥go1.24.13 in agent image; rebuild + re-pin digest	3 days	pelikhan
🟠 High	GraphQL injection alerts #651/#652 (project_command.go)	Replace fmt.Sprintf + escapeGraphQLString() with parameterised GraphQL variables	7 days	pelikhan
🟠 High	api-proxy: @opentelemetry/core GHSA-8988-4f7v-96qf (fixable)	Upgrade @opentelemetry/core to ≥2.8.0 in firewall npm deps	7 days	pelikhan
🟡 Medium	JS network-to-file alert #636 (ensure-docs-slide-pdf.js)	Review and validate the network-to-file write; add content-type and path sanitisation	14 days	pelikhan
🟡 Medium	Digest drift on agent and api-proxy images	Re-pin both images after validation; add automated re-pin PR on drift detection	14 days	pelikhan
🟢 Low	License noncompliance in containers (GPL/LGPL, 34+ denied)	Audit denied packages; remove unnecessary OS packages or obtain legal approval	30 days	pelikhan

---

Exception Register

No formal exceptions exist at this time. The following items require expedited triage:

Item	Threat Hypothesis	Operational Weakness	Expiry Proposal	Mitigation Plan
Agent container Go stdlib lag	Exploit of GO-2026-4337 against hosted runner	Critical severity, no patch applied	2026-07-27	Upgrade Go runtime; rebuild image
Alert #651/#652 open without assignment	GraphQL injection via owner input	Manual escaping brittle	2026-07-31	Migrate to parameterised GQL variables

---

Operational Metrics Baseline

Metric	Value	Signal
MTTR proxy (CVE → fix)	~3–7 days (based on firewall v0.27.37→38 critical CVE bump)	🟡 Acceptable but undocumented
Ownership coverage	1 human maintainer + automated bots	⚠️ Bus-factor risk
Unsupported dependency ratio	~10% fixable CVEs in containers; many OS-level unfixable	⚠️ Elevated
Open scanning alert aging	Alerts #651/#652: created 2026-07-24; #636: created 2026-06-26 (>28 days)	🔴 Alert #636 overdue
Exposure without recovery capability	Agent image drift unpatched; rollback via digest available	🟡 Recovery path exists, not automated

---

Positive Signals This Week

• ✅ New ESLint rule no-child-process-interpolated-command for shell injection prevention (eslint-factory: add no-child-process-interpolated-command to catch shell-injection command strings #47555)
• ✅ Command execution hardening across git/workflow/CLI paths (Harden command execution inputs in flagged git, workflow, and CLI paths #47546)
• ✅ Grype container scanning added to compile pipeline (Add grype container image vulnerability scanning to compile pipeline #47474)
• ✅ Firewall bumped to clear prior critical CVE gate (chore: upgrade gh-aw-firewall v0.27.37 → v0.27.38 to clear critical CVE gate #47469)
• ✅ docker/build-push-action pinned to commit SHA (Pin docker/build-push-action to commit SHA (CodeQL alert #625) #47334)
• ✅ Zero secret-scanning alerts
• ✅ 354/354 commits PGP-verified

References:

• §30107107922 — Current governance run
• §30071699837 — Daily container image scan
• CodeQL alert #636 | Semgrep alert #651 | #652

Generated by UK AI Operational Resilience · sonnet46 · 66.3 AIC · ⌖ 8.85 AIC · ⊞ 5.3K · ◷

• expires on Jul 27, 2026, 8:05 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #48404.