[uk-ai-resilience] Remove committed actionlint/gosec binaries flagged out-of-context (#653) #52527

Summary

CodeQL "Malicious Code Scanner" alert #653 (workflow-out-of-context) flags two pre-built third-party binaries committed directly to git history in PR #48979 (commit 9e4de3594991dbd4296799587890c2f15ee4ed9a):

• actionlint (8,452,012 bytes, sha256 4e6adea4de17cd3787c28f3031962f4109d6bfde66a84aa9fe6977f7e3772f5c)
• gosec (69,372,088 bytes, sha256 0905b2df37caaf21faeead23a632a7d86d0e52958823c437f8ed8c347249fc98)

Threat Score: 4/10 — assessed as accidental (likely a local build artifact committed by mistake), not malicious. The gosec binary's strings output matches github.com/securego/gosec/v2@v2.27.1, consistent with the version-downgrade commit message, so provenance appears legitimate. However:

• The Makefile expects these tools via go install (github.com/rhysd/actionlint/cmd/actionlint, github.com/securego/gosec/v2/cmd/gosec), not vendored binaries.
• ~78MB of opaque compiled Go ELF code is now permanently in git history for a source-only Go repository, bypassing code review for that content.
• .gitignore only excludes gosec-report.json/gosec-results.sarif, not the binaries themselves.

UK AI Governance Tier & Risk Scoring

• Tier: B — Open With Conditions
• Exposure amplification: Low (no malicious intent found, hashes verifiable against upstream)
• Patchability: High (simple removal + .gitignore addition)
• Detectability: High (already caught by scanner)
• Operational fragility: Low
• Ownership confidence: Medium

Remediation Action

1. Remove actionlint and gosec binaries from the git tree (git rm + history note, or filter if warranted).
2. Add /actionlint and /gosec to .gitignore.
3. Confirm CI/Makefile targets rely on go install rather than any committed binary.
4. Optionally verify sha256 hashes against upstream releases for independent confirmation (already partially done via strings analysis).

SLA urgency: Medium

Reference

Full governance analysis: see the linked discussion report "UK AI Open Code Risk & Resilience — Weekly Assessment (2026-08-13)" created by this workflow run (recent-changes focus, 7-day lookback).

Generated by UK AI Operational Resilience · auto · 59.8 AIC · ⌖ 2.75 AIC · ⊞ 8.7K · ◷