[advisory:uk-ai-resilience] [Advisory] UK AI operational resilience review for githubnext/gh-aw-workshop

[github-actions]

Advisory Status

INCOMPLETE

Executive Summary

Seven-day window reviewed: 2026-08-21T21:34:19.952Z to 2026-08-28T21:34:21.009Z UTC. This repository appears to be an actively updated public workshop/documentation repository with recent changes concentrated in workshop content, workflow definitions, and supporting scripts. The current UK guidance published 14 May 2026 says code should remain open by default, with risk driven primarily by underlying weaknesses and the ability to remediate quickly rather than by source visibility alone.

This advisory is incomplete by design and incomplete in execution because required security-alert evidence was inaccessible: code scanning, secret scanning, and Dependabot alerts returned 403 in the prefetch, while repository metadata did not affirmatively establish whether those features are disabled or merely unreadable. Under the workflow rules, that prevents a complete minimum-standard verification and blocks a material conclusion.

Scope and Evidence

Observed in repository evidence

• Target repository: githubnext/gh-aw-workshop
• Visibility: public; archived: false; disabled: false; default branch: main
• Latest observed push: 2026-08-28T20:02:04Z
• Available checkout is a shallow snapshot with a single reachable commit (1c8ae9ee56d532ff3ce4c69e00f9a7ce5572c161), so recent-change analysis relied primarily on prefetch commit metadata and current-tree inspection.
• Recent seven-day changes were heavily documentation- and workflow-oriented, including workshop content, .github/workflows/*, .github/skills/*, scripts, and static assets.
• GitHub Actions workflows exist for pages deployment, markdown linting, image-link validation, SVG contrast checking, and agentic maintenance.
• deploy-pages.yml publishes built workshop content to GitHub Pages.
• markdown-lint.yml, image-link-check.yml, and svg-contrast-check.yml provide some automated hygiene for content quality/accessibility.
• No SECURITY.md, no visible CODEOWNERS, and no visible .github/dependabot.yml were found in the checked-out tree.
• Root package-lock.json is effectively empty (packages: {}), which weakens dependency evidence for workflows that install packages ad hoc during CI.
• Workshop content includes explicit material on resilience, self-hosted runners, audit/observability, and cost management, which is a positive ownership/training signal but not proof of operational controls for any deployed service.

Inaccessible evidence required for this advisory

• Code scanning alerts API status: 403
• Secret scanning alerts API status: 403
• Dependabot alerts API status: 403
• Repository metadata did not affirmatively mark those features disabled, so alert hygiene could not be classified as observed-pass or observed-fail.

Out-of-repository evidence not available here

• Named service owner or maintenance rota
• Patch SLAs and measured remediation performance
• Incident response process and inbound report triage metrics
• Deployment inventory, runtime monitoring, rollback playbooks, and recovery testing
• Any closure-exception approval record

Asset Graph

Observed changed surfaces and provisional concern areas

Surface	Observed evidence	Ownership/dependency signal	Provisional concern area
Public workshop content	Multiple recent commits affecting workshop/*.md and images	Active authoring cadence	Low direct runtime exposure, but content can influence user actions and setup guidance
GitHub Actions workflows	Multiple recent commits touching .github/workflows/*	Repository automates linting, publishing, and agentic maintenance	CI/workflow integrity, action pinning consistency, ad hoc dependency installs
GitHub Pages publishing path	deploy-pages.yml builds and deploys generated HTML to Pages	Public-facing artifact publishing exists	Build-time dependency hygiene and rollback/recovery evidence not observed
Workshop support scripts	scripts/*.js, static assets changed recently	Local build tooling present	Tooling changes could affect published docs output
Agentic workflow training material	Security/resilience/audit/cost modules present	Strong educational intent	Guidance content does not establish repo operational controls

Proposed Tier Classification

Provisional classification

Proposed tier	Status	Evidence basis	Constraint
B — Open With Conditions candidate	Provisional only	Public repository, active maintenance signals, some automation, no evidence that closure is justified	Capped at B because required security-alert evidence was inaccessible and minimum-standard verification is incomplete

This is a workflow prioritization label only. It does not authorize opening, restricting, hiding, or decommissioning code.

Control Verification Gaps

• Ownership: No visible CODEOWNERS or equivalent machine-readable ownership file in the inspected tree.
• Security contact / intake route: No visible SECURITY.md or repository-level reporting instructions in the inspected tree.
• Automated dependency and vulnerability hygiene: Some workflow/content automation is present, but Dependabot configuration was not visible and alert APIs were inaccessible.
• Patch SLA / remediation capability: No SLA evidence or measured remediation-age data available.
• Secret exposure prevention: Secret scanning evidence unavailable; no conclusion possible.
• Runtime observability and recovery: Repository contains educational material about audit/observability and resilience, but no authoritative evidence of monitoring, rollback drills, or service recovery controls for an actual deployed service.
• Branch/trunk protections: Not evidenced from available repository files.

Risk Scoring and Rationale

Evidence-backed advisory scoring

Factor	Observed reading	Rationale
Exposure amplification	Medium	Repository is public and publishes Pages artifacts; open code can marginally reduce attacker uncertainty per UK guidance.
Patchability	Unknown-to-medium	Active commit cadence suggests maintainability, but no patch SLA or alert/remediation data was available.
Detectability	Unknown	No accessible alert inventory or runtime monitoring evidence.
Operational fragility	Medium	CI/build/deploy paths exist; workflows install dependencies at runtime, but recovery/rollback evidence is absent.
Ownership confidence	Low-to-medium	Active maintenance signals exist, but no visible CODEOWNERS or explicit owner evidence.

Overall rationale: the UK guidance says openness should remain the default and that the dominant risk driver is weak remediation capability, not source visibility itself. This repository shows current activity and some automated hygiene, which argues against a dormant or abandoned posture. However, missing ownership/security-contact artifacts and inaccessible alert evidence prevent confirming the minimum operational standard. That supports a provisional B rather than A, and it leaves the advisory status incomplete.

Prioritized Remediation Queue

1. Add a repository security contact and disclosure route
   • Urgency: high
   • Remediation: add SECURITY.md with an inbound vulnerability reporting path and triage expectations.
   • Validation evidence: committed SECURITY.md plus repository security settings confirming the route in use.
   • Human owner: owner gap
   • Review trigger: once added, reassess minimum-standard compliance.
2. Establish explicit repository ownership evidence
   • Urgency: high
   • Remediation: add CODEOWNERS or equivalent explicit maintainer record for workshop, workflow, and script areas.
   • Validation evidence: committed ownership file and confirmation that maintainers are current.
   • Human owner: owner gap
   • Review trigger: ownership change or annual review.
3. Restore verifiable alert hygiene evidence
   • Urgency: high
   • Remediation: provide human-reviewed evidence of whether code scanning, secret scanning, and Dependabot alerts are enabled, intentionally disabled, or inaccessible to this workflow; if enabled, review open-alert age against stated SLAs.
   • Validation evidence: authoritative repository security settings and alert summaries.
   • Human owner: owner gap
   • Review trigger: immediately, because current advisory is blocked on this evidence.
4. Document patch/remediation expectations for public artifacts and workflow dependencies
   • Urgency: medium
   • Remediation: define patch SLAs for critical/high vulnerabilities and how workflow-installed packages are updated/reviewed.
   • Validation evidence: published maintenance standard or runbook plus historical remediation samples.
   • Human owner: owner gap
   • Review trigger: next material workflow or dependency change.
5. Document rollback and recovery posture for Pages publishing
   • Urgency: medium
   • Remediation: record how broken content deployments are detected and rolled back.
   • Validation evidence: deployment/runbook evidence and last successful rollback or restore exercise.
   • Human owner: owner gap
   • Review trigger: any Pages pipeline change.

Open-Code Exception Register

none

No closure recommendation is made. The repository is public, and the evidence here does not establish the required exception record fields showing a specific, credible route to harm from publication.

Operational Metrics Baseline

• Open-alert age against stated patch SLA: not observable; alert APIs inaccessible and no patch SLA evidence provided
• Inbound vulnerability reporting route: not observed in checked-out tree
• Ownership coverage: not observed in checked-out tree
• Unsupported dependency ratio: not observable from available lockfile/config evidence
• Exception aging: none observed
• Exposure without recovery capability: partially observed; public Pages publication exists, but recovery/rollback capability was not evidenced

Human Review Required

• Determine whether code scanning, secret scanning, and Dependabot alerts are enabled, disabled, or access-restricted for githubnext/gh-aw-workshop.
• Confirm whether a repository security reporting route exists outside the checked-out tree.
• Confirm the named owner and maintenance commitment for the workshop, Pages deployment, and workflow automation.
• Verify whether any public-facing service beyond documentation hosting depends on this repository.
• If any consideration is given to restricting visibility, require a complete closure-exception record with attacker, publication delta, path to harm, narrow scope, duration, compensating controls, expiry, and re-approval owner; absent that evidence, do not recommend closure.

Control Plane

• Correlation ID: 33212788499-4
• Central repository: githubnext/central-agentic-ops
• Control plane run URL: https://github.com/githubnext/central-agentic-ops/actions/runs/33212788499

Generated by 🛡️ Advisory / UK AI Operational Resilience · pi · gpt54 · 22.3 AIC · ⌖ 8.73 AIC · ⊞ 6.9K · ◷

• expires on Sep 27, 2026, 9:38 PM UTC

[pelikhan]

@copilot add the missing permissions to the workers to access the security services