Repository navigation
[uk-ai-resilience] Untracked GraphQL sprintf alerts #651/#652 in project_command.go #64527
Description
Tier B — Untracked GraphQL string-interpolation alerts #651/#652
Location: pkg/cli/project_command.go:269,272 (rule workflow-go-graphql-injection-sprintf, open since 2026-07-24, no tracking issue).
Risk scoring (1–5): exposure 3, patchability 2, detectability 2, fragility 2, ownership 4 → priority high.
Remediation: build queries with GraphQL variables (or strictly validate/escape inputs) instead of fmt.Sprintf; add a unit test with hostile input.
SLA: high (≈7 days). Human review trigger: ownership confidence low (no CODEOWNERS, see #61637).
Discussion report: see the "UK AI governance report - 2026-09-30" discussion created in this run.
Generated by UK AI Operational Resilience · copilot · auto · 19 AIC · ⌖ 8.37 AIC · ⊞ 7.8K · ◷
Activity
github-actions commentedon Oct 1, 2026
🍪 Issue Monster selected this for Copilot
I identified this as a strong automated-fix candidate in the CLI GraphQL/query-construction area and requested assignment to the Copilot coding agent.
If assignment succeeds, Copilot will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪