[uk-ai-resilience] Untracked go/bad-redirect-check alert #941 in github_app_requirements.go (Tier B) #64044

Summary

UK AI Open Code Governance review (7-day recent-change scope, since 2026-09-21) identified an open CodeQL alert with no matching tracking issue, in a file modified the same day (2026-09-28) by the automated commit stream:

Alert: #941 — CodeQL go/bad-redirect-check (severity: error)
Location: pkg/workflow/github_app_requirements.go:151

if strings.HasPrefix(name, "/") {
    // Slash command shorthand, e.g. "on: /my-bot".
    addEvents(commandTriggerDefaultWebhookEvents)
    continue
}

Tier: B — Open With Conditions

Assessment

CodeQL's message: "This is a check that this value, which flows into a redirect, has a leading slash, but not that it does not have '/' or '' in its second position." This is the same recurring false-positive pattern already documented in #57472, #59491, and #54037 across pkg/cli and pkg/workflow: a strings.HasPrefix(name, "/") check used purely to detect a slash-command trigger shorthand string (e.g. on: /my-bot) is being misclassified by CodeQL's redirect-check heuristic, because name here never flows into an actual HTTP redirect — it flows into workflow trigger/webhook-event normalization logic.

This alert is the fifth occurrence of the class and, per the pattern established in #57472/#59491, is very likely another false positive rather than a genuine open-redirect vulnerability.

Remediation action

• Triage alert Add MCP logging configuration and artifact upload for all workflows #941 alongside the batch already queued in [uk-ai-resilience] Four untracked go/bad-redirect-check alerts in pkg/cli and pkg/workflow (Tier B) #59491 (alerts #674, [Custom Engine Test] Test Issue Created by Custom Engine #669, Codex fails to report failure if unauthorised #668, [Custom Engine Test] Test Pull Request - Custom Engine Safe Output #667) — confirm it is consistent with the same false-positive pattern.
• If false positive (expected, per prior triage of this class): land the shared isSafeRelativePath-style helper/annotation proposed in [uk-ai-resilience] UK AI Governance: recurring go/bad-redirect-check false positive across path-traversal guards (Tier B) #57472 across pkg/cli and pkg/workflow, covering this occurrence too, then dismiss with that shared rationale.
• If genuine: reject ///\ prefixed inputs in this normalization path as well.
• Fold this alert into the existing batch-triage tracking issue ([uk-ai-resilience] Four untracked go/bad-redirect-check alerts in pkg/cli and pkg/workflow (Tier B) #59491) rather than creating parallel remediation threads for the same recurring class.

SLA urgency: high — untracked alerts in actively-changed files reduce confidence in the classification step of the operational governance loop.

Report

See the full UK AI Open Code Risk & Resilience Governance discussion report generated in this run for asset graph, control verification, and full remediation queue.

Related

• False-positive pattern: [uk-ai-resilience] UK AI Governance: recurring go/bad-redirect-check false positive across path-traversal guards (Tier B) #57472
• Batch of sibling untracked alerts: [uk-ai-resilience] Four untracked go/bad-redirect-check alerts in pkg/cli and pkg/workflow (Tier B) #59491
• Prior single-file precedent: [uk-ai-resilience] UK AI Governance: unreviewed CodeQL go/bad-redirect-check alert in add_package_manifest.go (Tier B) #54037

Generated by UK AI Operational Resilience · copilot · auto · 75.7 AIC · ⌖ 8.88 AIC · ⊞ 7.8K · ◷