[uk-ai-resilience] Missing .github/CODEOWNERS for security-sensitive compiler/CLI paths (Tier B) #61637
Description
Summary
UK AI Open Code Risk & Resilience Governance sweep (2026-09-17, 7-day lookback) found that github/gh-aw has no .github/CODEOWNERS file, despite ~95% of recent commit volume (162 commits in the 7-day window) being authored by automation (Copilot bot: 101, github-actions[bot]: 38, dependabot[bot]: 15) touching security-sensitive surfaces such as the Go workflow compiler (pkg/workflow/), CLI package-manifest tooling (pkg/cli/), and generated GitHub Actions workflows.
Tier and risk-scoring breakdown
- Tier: B — Open With Conditions
- Exposure amplification: 2/5
- Patchability: 5/5 (trivial to add a CODEOWNERS file)
- Detectability: 2/5 (not surfaced by code scanning; found via governance review)
- Operational fragility: 2/5
- Ownership confidence: 2/5
Evidence
- All 162 commits in the lookback window are GPG-verified, and Copilot-authored PRs carry human
Co-authored-bytrailers (predominantlypelikhan), providing an informal review control. - However, there is no formal, enforceable per-path ownership mapping (
.github/CODEOWNERSdoes not exist), so review coverage currently depends on one individual's availability rather than a documented, redundant ownership model. - This is a governance/process gap rather than a code vulnerability — no immediate exploit path, but it weakens resilience if the primary reviewer is unavailable.
Remediation action
Add a .github/CODEOWNERS file mapping high-risk paths (pkg/workflow/, pkg/cli/, .github/workflows/*.md sources, Dockerfile) to accountable maintainers/teams, ensuring redundant review coverage for security-sensitive compiler and CLI code.
SLA urgency
Medium — low technical complexity, meaningful improvement to review-redundancy and bus-factor resilience.
Discussion report
See the full "UK AI Open Code Risk & Resilience Governance — Weekly Review (2026-09-17)" discussion for full asset graph, control verification, and risk-scoring detail.
Generated by UK AI Operational Resilience · copilot · auto · 83.3 AIC · ⌖ 12.5 AIC · ⊞ 8.3K · ◷
Activity
github-actions commentedon Sep 23, 2026
🍪 Issue Monster selected this for Copilot
I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.
If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪
github-actions commentedon Sep 24, 2026
🍪 Issue Monster selected this for Copilot
I identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.
If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪
github-actions commentedon Sep 24, 2026
🍪 Issue Monster selected this for Copilot
I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.
If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪
github-actions commentedon Sep 24, 2026
🍪 Issue Monster selected this for Copilot
I’ve identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.
If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪
github-actions commentedon Sep 25, 2026
🍪 Issue Monster selected this for Copilot
Ive identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.
If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪
github-actions commentedon Sep 25, 2026
🍪 Issue Monster selected this for Copilot
I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.
If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪
github-actions commentedon Sep 25, 2026
🍪 Issue Monster selected this for Copilot
I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.
If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪
github-actions commentedon Sep 28, 2026
🍪 Issue Monster selected this for Copilot
I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.
If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪
github-actions commentedon Sep 28, 2026
🍪 Issue Monster selected this for Copilot
I’ve identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.
If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪
github-actions commentedon Sep 30, 2026
🍪 Issue Monster selected this for Copilot
I have identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.
If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪
github-actions commentedon Sep 30, 2026
🍪 Issue Monster selected this for Copilot
I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.
If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪