e-volv

Security playbook

DependencyVulnerabilityTriage

Weekly scan that runs the ecosystem audit, then checks whether each CVE is actually reachable in your code before filing a ticket.

Weekly, clones each registered repository, runs the ecosystem's native audit command, and triages every advisory for reachability. Reachable and undetermined findings become a single ticket grouped by severity with the call path quoted; unreachable findings are recorded in the run output so they are not re-triaged by hand. Set the target repositories on the Identify step and the ticket integration on the Create step after importing.

Identifier
dependency-vulnerability-triage
Version
1.0.1
Steps
5
Triggers
1
  • dependencies
  • vulnerabilities
  • security
  • scheduled
  • reachability
  • automated

When it runs

Scheduleschedule.weekly
Schedule
Every Monday at 06:00 UTC 0 6 * * 1
Timezone
UTC

The pipeline

The graph below is the one the workflow opens with in the builder — same steps, same layout, drawn on the same canvas. The run playing through it is a simulation; the branches and conditions are real.

React Flow
  1. 01
    Weekly Schedule (Monday 06:00 UTC)trigger

    The event that starts the run.

  2. 02
    Identify Target Repositories ⚠️ SET YOUR REPOSrepo.identify

    Resolves the event to a registered repository.

  3. 03
    Clone Primary Repositorygit.clone

    Shallow-clones the repository at the right ref.

  4. 04
    Triage Vulnerable Dependenciesagent.run

    One agent works the task with its toolkit.

  5. 05
    File Vulnerability Ticketticket.create

    Opens a ticket on the connected tracker.

Branches

  • triage_agent to file_ticket: runs only if outputs.triage_agent.message contains RESULT: FINDINGS

The agent

Vulnerability Triage Agent

Base type
Senior Developer
Temperature
0.1
Max iterations
40
Tools
5

Filesystem · 2

  • read_fileRead File · read
  • list_dirList Directory · read

Terminal · 1

  • run_terminal_cmdRun Terminal Command · write

Code search · 1

  • code_searchCode Search · read

Status · 1

  • update_statusUpdate Status · write