Security playbook
Dependency Vulnerability Triage
Weekly scan that runs the ecosystem audit, then checks whether each CVE is actually reachable in your code before filing a ticket.
Weekly, clones each registered repository, runs the ecosystem's native audit command, and triages every advisory for reachability. Reachable and undetermined findings become a single ticket grouped by severity with the call path quoted; unreachable findings are recorded in the run output so they are not re-triaged by hand. Set the target repositories on the Identify step and the ticket integration on the Create step after importing.
- Identifier
dependency-vulnerability-triage- Version
- 1.0.1
- Steps
- 5
- Triggers
- 1
- dependencies
- vulnerabilities
- security
- scheduled
- reachability
- automated
When it runs
schedule.weekly- Schedule
- Every Monday at 06:00 UTC
0 6 * * 1 - Timezone
- UTC
The pipeline
The graph below is the one the workflow opens with in the builder, same steps, same layout, drawn on the same canvas. The run playing through it is a simulation; the branches and conditions are real.
- 01Weekly Schedule (Monday 06:00 UTC)
triggerThe event that starts the run.
- 02Identify Target Repositories ⚠️ SET YOUR REPOS
repo.identifyResolves the event to a registered repository.
- 03Clone Primary Repository
git.cloneShallow-clones the repository at the right ref.
- 04Triage Vulnerable Dependencies
agent.runOne agent works the task with its toolkit.
- 05File Vulnerability Ticket
ticket.createOpens a ticket on the connected tracker.
Branches
- triage_agent to file_ticket: runs only if outputs.triage_agent.message contains RESULT: FINDINGS
The agent
Vulnerability Triage Agent
- Base type
- Senior Developer
- Temperature
- 0.1
- Max iterations
- 40
- Tools
- 5
Filesystem · 2
read_fileRead File · readlist_dirList Directory · read
Terminal · 1
run_terminal_cmdRun Terminal Command · write
Code search · 1
code_searchCode Search · read
Status · 1
update_statusUpdate Status · write