[uk-ai-resilience] Tier C: Prebuilt actionlint/gosec binaries committed to git bypass go install (CodeQL Malicious Code Scanner [Content truncated due to length]

[github-actions]

Tier & Risk-Scoring

• Tier: C — Restricted Pending Review
• Exposure amplification: Medium (opaque ~78MB binary blobs trusted in git history)
• Patchability: High (straightforward removal)
• Detectability: High (already flagged by Malicious Code Scanner)
• Operational fragility: Low
• Ownership confidence: Low (no CODEOWNERS to route review)

Finding

Open code scanning alert #653 (Malicious Code Scanner, rule workflow-out-of-context) flags that commit 9e4de3594991dbd4296799587890c2f15ee4ed9a (PR #48979) committed two large prebuilt Go ELF binaries directly into git as tracked blobs:

• actionlint (~8.45MB)
• gosec (~69.4MB)

The Makefile (lines 649-650) expects these tools to be installed via go install github.com/rhysd/actionlint/cmd/actionlint and go install github.com/securego/gosec/v2/cmd/gosec, not vendored as binaries. Both files are confirmed still present at repository root at HEAD and are not excluded by .gitignore (which only excludes gosec-report.json / gosec-results.sarif).

This bypasses code review for ~78MB of opaque executable code now permanently in git history and is out of context for a source-only Go repository. The scanner assessed this as likely an accidental git add of local build artifacts rather than intentional malicious activity (Threat Score 4/10), but it remains a supply-chain and reproducibility risk.

Remediation Action (SLA: High)

1. Remove actionlint and gosec binaries from the working tree.
2. Add /actionlint and /gosec to .gitignore.
3. Confirm CI/build pipeline relies on go install (per Makefile) rather than any committed binary.
4. Optionally verify sha256 hashes of the removed binaries against upstream releases for independent confirmation, and consider a history-scrub if the blob size is a concern (not urgent for forward remediation).

Related

• Full governance report: see the UK AI Open Code Risk & Resilience discussion report published 2026-08-05 (recent-changes scope).
• This finding was not covered by any existing open issue at time of writing.

Generated by UK AI Operational Resilience · auto · 42.1 AIC · ⌖ 2.57 AIC · ⊞ 8.9K · ◷