[uk-ai-resilience] Static-analysis scan pipeline instrumentation gap: 6/8 tools produced zero output (Tier C)

[github-actions]

UK AI Governance — Tier C: static-analysis scanning pipeline instrumentation gap (6 of 8 tools produced zero output)

Tier: C — Restricted Pending Review
Source discussion report: see "UK AI Governance: recent-change risk review (2026-08-28 to 2026-09-04)" discussion created by this run.

Risk-scoring breakdown

Dimension	Rating
Exposure amplification	Medium (masks findings from 6 of 8 security tools)
Patchability	Medium (pipeline/CI fix, not a code fix)
Detectability	Low (failed silently — only surfaced via manual comparison to prior runs)
Operational fragility	Medium
Ownership confidence	Medium
Overall	Medium-High

Finding

The 2026-09-04 static-analysis scan (issue #58390) reported that poutine, runner-guard, syft, grype, yamllint, and shellcheck produced zero output lines anywhere in compile-output.txt, while zizmor and actionlint produced normal results (zizmor even flagged 11 high-severity findings for the first time in tracked history). Every prior scan back to 2026-08-22 had non-trivial data from runner-guard and grype in particular. This is very likely a scan-pipeline instrumentation failure, not a genuine "0 findings" result for those 6 tools.

This matters operationally because it silently degrades detection coverage for supply-chain (poutine/syft/grype), taint-analysis (runner-guard), and lint (yamllint/shellcheck) findings without any explicit failure signal — the run reported as "completed" rather than "degraded."

Remediation action

• Investigate the compile step configuration for the static-analysis workflow to determine why 6 of 8 tools produced no output this run (check tool invocation, working directory, or output-capture wiring changes).
• Add an explicit guard/assertion in the scan pipeline so that "zero output" from a tool that historically produces non-trivial output triggers a hard failure or flagged warning, rather than being silently reported as a clean pass.
• Do not treat the 2026-09-04 run as confirming "0 findings" for poutine/runner-guard/syft/grype/yamllint/shellcheck; re-run before closing out any prior findings from those tools.

SLA urgency

High — this is a detection/observability control failure affecting 75% of the configured security-scanning toolchain, and it went unnoticed until manual cross-run comparison.

Discussion report

See the "UK AI Governance: recent-change risk review (2026-08-28 to 2026-09-04)" discussion for full asset-graph, tier classification, and control-verification context.

Generated by UK AI Operational Resilience · copilot · auto · 50.7 AIC · ⌖ 8.47 AIC · ⊞ 8.1K · ◷