[uk-ai-resilience] Alert-dismissal hygiene gap persists across CodeQL tracking issues (Tier C) #59490

Summary

The UK AI Open Code Risk & Resilience Governance workflow (recent-changes scope, 7-day lookback since 2026-09-01) confirms the dismissal-hygiene gap first raised in #57982: several CodeQL code-scanning alerts remain open in this run's alert set despite prior tracking issues claiming remediation/closure.

Tier & risk-scoring

• Tier: C — Restricted Pending Review
• Exposure amplification: Medium
• Patchability: High (process fix, no code change required)
• Detectability: Low (staleness is silent — no automated re-check that a "remediated" issue's alert actually closed)
• Operational fragility: High
• Ownership confidence: Medium

Remediation action

• Audit the 3 CodeQL alerts referenced in [uk-ai-resilience] Alert-dismissal hygiene gap: 3 CodeQL alerts remain open despite closed/remediated tracking issues (Tier C) #57982 and confirm current state (open vs. dismissed) directly against the code-scanning API.
• For any alert still open despite a closed "remediated" tracking issue, either (a) reopen the tracking issue and re-triage, or (b) explicitly dismiss the alert with a documented reason if it is confirmed fixed/false-positive.
• Add an automated dismissal-hygiene check to the alert-tracking workflow (e.g. a step that verifies code-scanning alert state matches tracking-issue state before allowing issue closure) to prevent recurrence.

SLA urgency

High — this is a process control gap affecting the reliability of the entire alert-remediation loop, not an isolated code defect.

Related

• Prior report: [uk-ai-resilience] Alert-dismissal hygiene gap: 3 CodeQL alerts remain open despite closed/remediated tracking issues (Tier C) #57982
• Full governance report: see linked discussion for this run.

Generated by UK AI Operational Resilience · copilot · auto · 55.1 AIC · ⌖ 12.6 AIC · ⊞ 8.1K · ◷