Repository navigation
[uk-ai-resilience] Static-analysis scan pipeline instrumentation gap: 6/8 tools produced zero output (Tier C) #58562
Description
UK AI Governance — Tier C: static-analysis scanning pipeline instrumentation gap (6 of 8 tools produced zero output)
Tier: C — Restricted Pending Review
Source discussion report: see "UK AI Governance: recent-change risk review (2026-08-28 to 2026-09-04)" discussion created by this run.
Risk-scoring breakdown
| Dimension | Rating |
|---|---|
| Exposure amplification | Medium (masks findings from 6 of 8 security tools) |
| Patchability | Medium (pipeline/CI fix, not a code fix) |
| Detectability | Low (failed silently — only surfaced via manual comparison to prior runs) |
| Operational fragility | Medium |
| Ownership confidence | Medium |
| Overall | Medium-High |
Finding
The 2026-09-04 static-analysis scan (issue #58390) reported that poutine, runner-guard, syft, grype, yamllint, and shellcheck produced zero output lines anywhere in compile-output.txt, while zizmor and actionlint produced normal results (zizmor even flagged 11 high-severity findings for the first time in tracked history). Every prior scan back to 2026-08-22 had non-trivial data from runner-guard and grype in particular. This is very likely a scan-pipeline instrumentation failure, not a genuine "0 findings" result for those 6 tools.
This matters operationally because it silently degrades detection coverage for supply-chain (poutine/syft/grype), taint-analysis (runner-guard), and lint (yamllint/shellcheck) findings without any explicit failure signal — the run reported as "completed" rather than "degraded."
Remediation action
- Investigate the compile step configuration for the static-analysis workflow to determine why 6 of 8 tools produced no output this run (check tool invocation, working directory, or output-capture wiring changes).
- Add an explicit guard/assertion in the scan pipeline so that "zero output" from a tool that historically produces non-trivial output triggers a hard failure or flagged warning, rather than being silently reported as a clean pass.
- Do not treat the 2026-09-04 run as confirming "0 findings" for poutine/runner-guard/syft/grype/yamllint/shellcheck; re-run before closing out any prior findings from those tools.
SLA urgency
High — this is a detection/observability control failure affecting 75% of the configured security-scanning toolchain, and it went unnoticed until manual cross-run comparison.
Discussion report
See the "UK AI Governance: recent-change risk review (2026-08-28 to 2026-09-04)" discussion for full asset-graph, tier classification, and control-verification context.
Generated by UK AI Operational Resilience · copilot · auto · 50.7 AIC · ⌖ 8.47 AIC · ⊞ 8.1K · ◷
Activity