[uk ai resilience] UK AI Open Code Risk & Resilience Report — 2026-06-04

[github-actions[bot]]

Executive Summary

7-day window 2026-05-28 → 2026-06-04 | 374 commits | 143 security-signal commits | 13 open security issues | 7 code scanning alerts | 0 secret scanning alerts.

Overall posture: Tier B — Open With Conditions, with one Tier C (restricted) area — the signed-commit push engine — that must be patched before continued production use. Active hardening (safe-output fallback, blocked-command loop, token budget exhaustion) is visible and appropriate.

---

Asset Graph

Asset	Surface	Asset-Tier
safe-outputs-engine	actions/setup/js/	A
workflow-compiler-go	pkg/workflow/	A
cicd-privileged-workflows	.github/workflows/*.lock.yml	B
q-workflow-agent-runtime	Q compiled workflows	B
agent-skills-designer	.github/skills/	C
go-cli-toolchain	cmd/, internal/	C
docs-content	docs/	D

---

Control Verification

Domain	Status	Key Gap
Ownership	⚠️ Partial	Single-wildcard CODEOWNERS — no per-path owners for actions/setup/js/ or pkg/workflow/
SDLC	⚠️ Partial	CodeQL + zizmor + actionlint active; Alert #610 open; branch protection unverifiable
Dependency	⚠️ Partial	Dependabot + vet/policy + SBOM per release; Alert #585 (untrusted-checkout/high) unresolved
Secret exposure	⚠️ Partial	0 open alerts; push-protection enforcement unconfirmed
Runtime observability	❌ Fail	Alert #600 (unsafe-quoting CRITICAL) + Issue #36934 (protected_files bypass) open and unpatched
Recovery	⚠️ Partial	CHANGELOG + SBOM + privileged promote gate; no IR runbook

---

Risk-Scoring Table

Area	Exp	Patch	Detect	Fragility	Owner	Tier	SLA
Signed-commit push / shallow checkout	5	3	2	5	3	C	🔴 Critical
Go compiler unsafe-quoting (Alert #600)	4	3	4	3	3	C	🔴 Critical
CI/CD unpinned actions	4	5	4	2	3	B	🟠 High
Safe-output runtime fail-fast	4	4	3	3	4	B	🟠 High
Sub-agent activation artifact relay	4	3	2	4	4	B	🟡 Medium
Token / budget management	3	4	3	4	4	B	🟡 Medium
Blocked-command loop hardening	3	4	4	3	5	A	🟢 Low

Exposure/Fragility: higher = worse. Patchability/Detectability/Ownership: higher = better.

---

Remediation Queue

🔴 Critical — 72 hours

1. Patch signed-commit push shallow-checkout race (Issue #36934)
File: actions/setup/js/push_signed_commits.cjs — diff-tree is computed against a stale first-parent bundle; when base branch advances, fileChanges silently reverts 178+ upstream commits and bypasses protected_files. Fix: deepen clone before diff-tree or abort if git merge-base detects base-branch delta. Owner: @dsyme

2. Fix unsafe-quoting in pkg/workflow/awf_helpers.go:161 (Alert #600)
Rule: go/unsafe-quoting (CWE-078/089/094) — JSON values embedded in quoted shell strings without escaping. Fix: replace with JSON-safe quoting helper. Owner: @pelikhan

🟠 High — 1 sprint

3. Pin all unpinned GitHub Actions to commit SHAs — Alerts #611 (azure/login@v2), #610 (actions/checkout@v4), #585 (untrusted-checkout/high in q.lock.yml). For #585, evaluate restructuring the issue_comment trigger to avoid secrets-capable checkout of fork code.

4. Add runtime fail-fast for safe_outputs permission denial — A 403 in the safe_outputs job surfaces as generic failure; AI agents may misinterpret as transient and retry. Emit structured error to prevent loops.

🟡 Medium — 2 sprints

5. Post-restore validation for sub-agent activation artifacts — No preflight check before agent step; silent absence leads to hallucinated tool availability.

6. Replace token budget magic sentinels — 0=default (25M), <0=disabled are invisible to YAML authors; no upper-bound guard. Replace with explicit null/omitempty + validator capped at 50M.

7. Per-path CODEOWNERS for high-risk subdirectories — Add entries for actions/setup/js/, pkg/workflow/, .github/workflows/*.lock.yml.

🟢 Low — Ongoing

8. Integer-narrowing guard pkg/workflow/compilerenv/manager.go:97 (Alert #609, CWE-190/681).
9. Add IR runbook and rollback playbook to SECURITY.md.
10. Confirm and document secret scanning push-protection enforcement.

---

Exception Register

ID	Area	Threat	Expiry	Status
EX-001	q.lock.yml untrusted-checkout (Alert #585)	Write-access attacker triggers issue_comment to run fork code in secrets context	2026-07-04	Open — pending structural review

---

Operational Metrics Baseline

Metric	Value
MTTR proxy	Moderate — #36934 open ~2 days; 2 security patches landed this week
Ownership coverage	4 named owners / single wildcard — no per-path for critical surfaces
Unsupported dependency ratio	0 (vet/policy OSSF Maintained check active)
Exception aging	EX-001 new this window; 0 stale
Exposure without recovery	High — Issue #36934 + Alert #600 unpatched
Security-signal commit density	38% (143/374) — appropriate for AI agent repo
Secret scanning alerts	0

References: §26965119536 · Issue #36934 · Alert #600

Generated by UK AI Operational Resilience · sonnet46 6M · ◷

• expires on Jun 7, 2026, 4:39 PM UTC