UK AI Governance — Tier C: Opaque prebuilt binaries committed to git history
Tier: C — Restricted Pending Review
Source: CodeQL alert #653 (workflow-out-of-context, severity: warning)
Introduced by: PR #48979
Risk-scoring breakdown
| Dimension |
Score |
| Exposure amplification |
Medium (supply-chain opacity, ~78MB of unverifiable compiled code in history) |
| Patchability |
High (delete binaries, rely on go install) |
| Detectability |
Medium (CodeQL caught it, but no preventive guard exists) |
| Operational fragility |
Medium (dead weight in git history, no recovery path without manual hash verification) |
| Ownership confidence |
Low (appears to be an accidental commit, unnoticed until this scan) |
Finding
Two compiled Go ELF binaries — actionlint (8,452,012 bytes, sha256 4e6adea4de17cd3787c28f3031962f4109d6bfde66a84aa9fe6977f7e3772f5c) and gosec (69,372,088 bytes, sha256 0905b2df37caaf21faeead23a632a7d86d0e52958823c437f8ed8c347249fc98) — were committed directly as tracked git blobs in commit 9e4de3594991dbd4296799587890c2f15ee4ed9a (PR #48979). The Makefile expects these tools via go install (github.com/rhysd/actionlint/cmd/actionlint, github.com/securego/gosec/v2/cmd/gosec), not vendored binaries. This bypasses code review for ~78MB of opaque executable code now permanently in git history, and is not excluded by .gitignore (which only excludes gosec-report.json/gosec-results.sarif). No evidence of malicious intent — likely an accidental local-build-artifact commit — but it represents a supply-chain/recovery-capability gap.
Remediation action
- Remove the
actionlint and gosec binaries from the working tree.
- Add
/actionlint and /gosec to .gitignore to prevent recurrence.
- Confirm CI relies on
go install rather than any committed binary.
- Optionally verify the recorded sha256 hashes against upstream releases for independent confirmation before purging history (history rewrite is not required to close this finding — removal from HEAD is sufficient for CodeQL closure).
SLA urgency: High
Governance report
Full context, asset graph, and control-verification findings are in the linked governance discussion report (UK AI Open Code Risk & Resilience Governance — 2026-08-18).
Generated by UK AI Operational Resilience · auto · 51.6 AIC · ⌖ 2.27 AIC · ⊞ 9.3K · ◷
UK AI Governance — Tier C: Opaque prebuilt binaries committed to git history
Tier: C — Restricted Pending Review
Source: CodeQL alert #653 (
workflow-out-of-context, severity: warning)Introduced by: PR #48979
Risk-scoring breakdown
go install)Finding
Two compiled Go ELF binaries —
actionlint(8,452,012 bytes, sha2564e6adea4de17cd3787c28f3031962f4109d6bfde66a84aa9fe6977f7e3772f5c) andgosec(69,372,088 bytes, sha2560905b2df37caaf21faeead23a632a7d86d0e52958823c437f8ed8c347249fc98) — were committed directly as tracked git blobs in commit9e4de3594991dbd4296799587890c2f15ee4ed9a(PR #48979). TheMakefileexpects these tools viago install(github.com/rhysd/actionlint/cmd/actionlint,github.com/securego/gosec/v2/cmd/gosec), not vendored binaries. This bypasses code review for ~78MB of opaque executable code now permanently in git history, and is not excluded by.gitignore(which only excludesgosec-report.json/gosec-results.sarif). No evidence of malicious intent — likely an accidental local-build-artifact commit — but it represents a supply-chain/recovery-capability gap.Remediation action
actionlintandgosecbinaries from the working tree./actionlintand/gosecto.gitignoreto prevent recurrence.go installrather than any committed binary.SLA urgency: High
Governance report
Full context, asset graph, and control-verification findings are in the linked governance discussion report (UK AI Open Code Risk & Resilience Governance — 2026-08-18).