[uk ai resilience] UK AI Open Code Risk & Resilience Report - 2026-10-09 #67226

Executive summary

Lookback: 7 days (since 2026-10-02). 349 commits (171 Copilot, 99 maintainer, 45 bot, 24 dependabot), 47 open security issues, 253 open code-scanning alerts, 0 secret-scanning alerts. Dominant risk is supply-chain reproducibility in compiled workflows (218 of the 253 alerts are non-deterministic npm installs). Most other findings already have open [uk-ai-resilience] issues. One new cluster (work-queue scripts, filed 2026-10-09) lacks tracking; a new issue is raised for it. No secret exposure.

Asset graph summary (recent-change scoped)

Tier classification

Control verification gaps

• Ownership: .github/CODEOWNERS missing (still open, [uk-ai-resilience] Missing .github/CODEOWNERS for security-sensitive compiler/CLI paths (Tier B) #61637).
• SDLC: code scanning is running and alerts arrive within a day; but 253 open alerts show slow burn-down.
• Dependency: unpinned/non-lockfile installs in compiled workflows; unpinned curl | sudo sh ([setup-security] Unpinned curl | sudo sh root install in sudo_docker_sbx_install.sh (supply-chain risk) #62521).
• Secrets: 0 open secret-scanning alerts — control effective.
• Observability: red-team, VulnHunter, static-analysis and container scan reports are running — good.
• Recovery: patch path exists (Dependabot, firewall bump); release token minting reverted without a documented rollback ([uk-ai-resilience] GitHub App token minting for release workflow added and reverted without documented security sign-off (Tier C [Content truncated #60296).
• Sub-agents were not dispatched; assessment was done directly from the pre-computed data (limitation: reduced confidence on ownership detail).

Risk scoring

Remediation queue

Human-review trigger: any change to compiler template output or release token minting.

Exception register

None.

Operational metrics baseline

• MTTR proxy: alerts created in window were open <= 1 day; oldest open alert dates 2026-08-28 (~42 days) for bad-redirect-check.
• Ownership coverage: 0% formal (no CODEOWNERS).
• Unsupported dependency ratio: not measurable from inputs; 218+ unpinned-install alerts.
• Exception aging: 0 exceptions.
• Exposure without recovery capability: 1 area (release token minting, [uk-ai-resilience] GitHub App token minting for release workflow added and reverted without documented security sign-off (Tier C [Content truncated #60296).

Generated by UK AI Operational Resilience · copilot · auto · 16.7 AIC · ⌖ 0.731 AIC · ⊞ 7.8K · ◷

• expires on Oct 12, 2026, 7:37 AM UTC-08:00