Summary
CodeQL identified a critical-severity actions/untrusted-checkout/critical finding (alerts #662 and #633) in the compiled privileged workflow .github/workflows/q.lock.yml (lines ~578-583 and ~2135-2142). The workflow checks out untrusted code from needs.activation.outputs.pre_created_pull_request_branch — a value influenced by an issue_comment trigger — inside a privileged execution context, with later potential execution of that checked-out code.
This was introduced by this week's PR-steering / pre-create-pull-request feature work (#55285, #55250, #55249, #55171, #55287) and is not yet tracked by any existing governance issue.
Tier and risk-scoring breakdown
- Tier: C — Restricted Pending Review
- Exposure amplification: High (attacker-influenced branch ref reaches privileged context)
- Patchability: High (add ref/branch validation or restrict checkout scope before privileged execution)
- Detectability: Medium (CodeQL flagged it; no additional runtime detection observed)
- Operational fragility: High (privileged workflow,
issue_comment trigger is broadly reachable)
- Ownership confidence: Medium (new feature, multiple recent contributors, not yet security-triaged)
Remediation action
Add branch/ref validation (e.g., verify the pre-created branch belongs to a trusted app-created PR, pin to a known SHA, or gate execution behind an explicit maintainer approval) before checking out pre_created_pull_request_branch in the privileged job. Regenerate q.lock.yml via gh aw compile after fixing the source workflow.
SLA urgency
Critical
Reference
Full governance report: see the linked discussion "UK AI Open Code Risk & Resilience Governance — Weekly Report (2026-08-24)" created in this same run.
Generated by UK AI Operational Resilience · copilot · auto · 39.6 AIC · ⌖ 7.78 AIC · ⊞ 8.1K · ◷
Summary
CodeQL identified a critical-severity
actions/untrusted-checkout/criticalfinding (alerts #662 and #633) in the compiled privileged workflow.github/workflows/q.lock.yml(lines ~578-583 and ~2135-2142). The workflow checks out untrusted code fromneeds.activation.outputs.pre_created_pull_request_branch— a value influenced by anissue_commenttrigger — inside a privileged execution context, with later potential execution of that checked-out code.This was introduced by this week's PR-steering / pre-create-pull-request feature work (#55285, #55250, #55249, #55171, #55287) and is not yet tracked by any existing governance issue.
Tier and risk-scoring breakdown
issue_commenttrigger is broadly reachable)Remediation action
Add branch/ref validation (e.g., verify the pre-created branch belongs to a trusted app-created PR, pin to a known SHA, or gate execution behind an explicit maintainer approval) before checking out
pre_created_pull_request_branchin the privileged job. Regenerateq.lock.ymlviagh aw compileafter fixing the source workflow.SLA urgency
Critical
Reference
Full governance report: see the linked discussion "UK AI Open Code Risk & Resilience Governance — Weekly Report (2026-08-24)" created in this same run.