[uk-ai-resilience] Alert-dismissal hygiene gap persists across CodeQL tracking issues (Tier C) #59490
Description
Summary
The UK AI Open Code Risk & Resilience Governance workflow (recent-changes scope, 7-day lookback since 2026-09-01) confirms the dismissal-hygiene gap first raised in #57982: several CodeQL code-scanning alerts remain open in this run's alert set despite prior tracking issues claiming remediation/closure.
Tier & risk-scoring
- Tier: C — Restricted Pending Review
- Exposure amplification: Medium
- Patchability: High (process fix, no code change required)
- Detectability: Low (staleness is silent — no automated re-check that a "remediated" issue's alert actually closed)
- Operational fragility: High
- Ownership confidence: Medium
Remediation action
- Audit the 3 CodeQL alerts referenced in [uk-ai-resilience] Alert-dismissal hygiene gap: 3 CodeQL alerts remain open despite closed/remediated tracking issues (Tier C) #57982 and confirm current state (open vs. dismissed) directly against the code-scanning API.
- For any alert still open despite a closed "remediated" tracking issue, either (a) reopen the tracking issue and re-triage, or (b) explicitly dismiss the alert with a documented reason if it is confirmed fixed/false-positive.
- Add an automated dismissal-hygiene check to the alert-tracking workflow (e.g. a step that verifies code-scanning alert state matches tracking-issue state before allowing issue closure) to prevent recurrence.
SLA urgency
High — this is a process control gap affecting the reliability of the entire alert-remediation loop, not an isolated code defect.
Related
- Prior report: [uk-ai-resilience] Alert-dismissal hygiene gap: 3 CodeQL alerts remain open despite closed/remediated tracking issues (Tier C) #57982
- Full governance report: see linked discussion for this run.
Generated by UK AI Operational Resilience · copilot · auto · 55.1 AIC · ⌖ 12.6 AIC · ⊞ 8.1K · ◷
Activity