Tier and Risk-Scoring Summary
Tier: C — Restricted Pending Review (process gap, not a live vulnerability)
| Dimension |
Score |
| Exposure Amplification |
Low |
| Patchability |
High (process fix only) |
| Detectability |
Low (masked by noise — 40 open security-labeled issues, mostly recurring automated bot reports) |
| Operational Fragility |
Medium (alert fatigue risk) |
| Ownership Confidence |
Low (no clear alert-lifecycle owner) |
Finding
Code-scanning alert #653 (workflow-out-of-context, Malicious Code Scanner) remains open, but it references ~78MB of actionlint/gosec binaries originally committed via PR #48979. These binaries were verified (via git ls-files) to no longer exist in the current tree, and at least 6 remediation issues addressing this exact finding are already closed: #52527, #53738, #50602, #50617, #52540, #53764.
This indicates the code-scanning alert was never dismissed/closed after the underlying issue was remediated — a triage/dismissal process gap, not a security defect. Left unaddressed, this contributes to alert fatigue: with 40 open security-labeled issues (many recurring automated reports from sighthound, vulnhunter, static-analysis, container-image-scan, domains-audit workflows), stale alerts like this dilute signal-to-action ratio and risk masking genuinely new findings.
Remediation Action
- Dismiss/close alert #653 as fixed (binaries removed, confirmed via
git ls-files).
- Add a process check (e.g., in the code-scanning-fixer or a periodic housekeeping workflow) to auto-verify and dismiss alerts once their linked remediation issue is closed, to prevent recurrence of stale open alerts.
SLA Urgency: Medium
Discussion Report
Full UK AI Open Code Risk & Resilience governance report: see the linked discussion "UK AI Governance: Weekly Resilience Report — 2026-09-01" created in this same workflow run.
Generated by UK AI Operational Resilience · copilot · auto · 65.5 AIC · ⌖ 8.45 AIC · ⊞ 8.1K · ◷
Tier and Risk-Scoring Summary
Tier: C — Restricted Pending Review (process gap, not a live vulnerability)
Finding
Code-scanning alert #653 (
workflow-out-of-context, Malicious Code Scanner) remains open, but it references ~78MB ofactionlint/gosecbinaries originally committed via PR #48979. These binaries were verified (viagit ls-files) to no longer exist in the current tree, and at least 6 remediation issues addressing this exact finding are already closed: #52527, #53738, #50602, #50617, #52540, #53764.This indicates the code-scanning alert was never dismissed/closed after the underlying issue was remediated — a triage/dismissal process gap, not a security defect. Left unaddressed, this contributes to alert fatigue: with 40 open security-labeled issues (many recurring automated reports from sighthound, vulnhunter, static-analysis, container-image-scan, domains-audit workflows), stale alerts like this dilute signal-to-action ratio and risk masking genuinely new findings.
Remediation Action
git ls-files).SLA Urgency: Medium
Discussion Report
Full UK AI Open Code Risk & Resilience governance report: see the linked discussion "UK AI Governance: Weekly Resilience Report — 2026-09-01" created in this same workflow run.