[uk-ai-resilience] Untracked go/allocation-size-overflow alerts #675/#676 in mcp_github_config.go (Tier C) #63466

Summary

CodeQL flags two open, untracked go/allocation-size-overflow alerts in pkg/workflow/mcp_github_config.go, a file that was actively modified within the last 7-day lookback window and generates MCP GitHub server configuration used by the agentic workflow runtime.

Tier and risk-scoring breakdown

• Tier: C - Restricted Pending Review (untracked, recently-changed, high severity)
• Exposure amplification: Medium-High (feeds MCP server config consumed by the agent runtime, wider blast radius than a pure CLI-local file)
• Patchability: High (bounds checks on slice pre-allocation are straightforward)
• Detectability: High (CodeQL already flags it)
• Operational fragility: Medium (config-generation path, multiple call sites)
• Ownership confidence: Low - no path-scoped CODEOWNERS entry exists for pkg/workflow/ (see companion Tier B finding in [uk-ai-resilience] Missing .github/CODEOWNERS for security-sensitive compiler/CLI paths (Tier B) #61637)

Alert details

• Alert [Custom Engine Test] Test Issue Created by Custom Engine #675: https://github.com/github/gh-aw/security/code-scanning/675
• Alert [Custom Engine Test] Test Pull Request - Custom Engine Safe Output #676: https://github.com/github/gh-aw/security/code-scanning/676
• Rule: go/allocation-size-overflow
• Severity: high
• Location: pkg/workflow/mcp_github_config.go, multiple make([]string, 0, n) call sites (approx. lines 85, 211, 422, 638, 646) where n is derived from combined slice lengths (e.g. len(enclave.Dynamic.AllowedRepositories)+len(enclave.Dynamic.AllowedOwners))

Remediation action

Validate/bound the computed capacity values before calling make() at each flagged call site, so combined or attacker-influenced slice lengths cannot trigger an allocation-size overflow during MCP config generation. SLA urgency: high.

Discussion report

Full governance analysis, asset graph, and control-verification context: see the "UK AI Open Code Risk & Resilience Review — 2026-09-25 (recent-changes cycle)" discussion report created in this same run.

Generated by UK AI Operational Resilience · copilot · auto · 80.1 AIC · ⌖ 7.25 AIC · ⊞ 7.9K · ◷