Track container CVE burn-down Critical-first with a consolidated parent issue

[Copilot]

The daily container image scan files one issue per image, which leaves the aggregate Critical/High backlog (67 Critical / 438 High across 10 images) untriaged as a whole and spreads duplicate triage across six open per-image issues. This updates the workflow prompt so severity ordering and consolidated tracking are explicit, and records the remediation SLA.

Changes to .github/workflows/daily-squid-image-scan.md

• Severity ordering: findings in each per-image issue are ordered Critical → High → Medium → Low → Unknown, so the Critical backlog surfaces first. Lower-severity findings are still never omitted.
• Consolidated parent issue: when any image has Critical or High findings, the agent creates one Container CVE burn-down issue (deduplicated by title, so it persists across daily runs) linking every per-image issue with a per-image Critical/High/total summary table. It stays a summary — detail remains in the per-image issues.
• SLA cadence: the burn-down issue states Critical remediated or risk-accepted within 7 days, High within 30 days, and weekly base-image refresh; the existing daily gh aw compile --force-refresh-container-pins run is named as the default remediation path.
• Eval: added critical_burn_down_tracked to check the consolidated issue is produced when Critical/High findings exist.

The .lock.yml is regenerated. Since the prompt body is a runtime-import of the markdown, the lock diff is limited to the metadata hashes and the evals question list.

No change to the scan itself, the safe-output surface (create-issue only, max: 25), or the post-step Critical/license gate.

• Fixes [uk-ai-resilience] Prioritize burn-down of container CVE backlog (67 Critical / 438 High across 10 scanned images) #52322

[github-actions]

Hey @github/gh-aw-maintainers 👋 — thanks for this contribution! The workflow enhancement looks solid:

What's working well:

• ✅ Clear severity ordering (Critical → High → Medium → Low → Unknown) ensures the most urgent CVEs surface first
• ✅ Consolidated burn-down issue deduplicates triage across per-image issues, keeping one parent summary
• ✅ SLA cadence is explicit (7 days Critical, 30 days High, weekly image refresh) — this sets clear accountability
• ✅ New eval question (critical_burn_down_tracked) confirms the consolidated issue is actually produced
• ✅ Lock file regeneration is automatic and correct (just metadata/hashes)
• ✅ No change to scan behavior or safe-output surface — focused scope

This directly addresses the governance finding in #52322 (67 Critical / 438 High across 10 images). The PR is still in draft — when ready for review, this should be good to merge.

Generated by ✅ Contribution Check · auto · 56.8 AIC · ⌖ 4.08 AIC · ⊞ 8.8K · ◷

[github-actions]

PR Triage

Category: chore · Risk: low · Priority: low · Score: 33/100

Impact	Urgency	Quality
15/50	8/30	10/20

Recommended action: batch_review (batch: wf-tooling-drafts)

Updates the daily container-scan workflow prompt to consolidate CVE triage into a single parent issue with explicit severity ordering. Draft, no CI yet. Not OpenTelemetry-related. Grouped with other draft workflow/tooling PRs for a combined review pass.

Generated by 🔧 PR Triage Agent · auto · 58.4 AIC · ⌖ 2.92 AIC · ⊞ 7.8K · ◷

[Copilot]

Pull request overview

Updates the daily container scan workflow to prioritize severe CVEs and introduce consolidated remediation tracking.

Changes:

• Orders findings Critical-first.
• Adds a burn-down issue with severity totals and remediation SLAs.
• Adds evaluation coverage and regenerates workflow metadata.

Show a summary per file

File	Description
.github/workflows/daily-squid-image-scan.md	Adds severity ordering, consolidated tracking, SLAs, and evaluation criteria.
.github/workflows/daily-squid-image-scan.lock.yml	Regenerates hashes and evaluation configuration.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced