Adds a `patch-cves` workflow that triages GitHub Dependabot alerts and
opens verified dependency-patch PRs, one per alert group. Intended to be
driven by a scheduled automation targeting this repo.
## What's included
- **`.fabro/workflows/patch-cves/workflow.fabro`** — single agent stage
pinned to `claude-opus-4-8`.
- **`.fabro/workflows/patch-cves/prompts/patch-cves.md`** — the bundled
prompt with the full CVE-patching procedure: query Dependabot alerts,
rank and group them, choose the smallest safe fix, patch + regenerate
lockfiles, verify (local gates + GitHub checks), and re-query alerts.
Ecosystem rules cover Rust/Cargo and TypeScript/Bun (Bun only — never
npm/npx/yarn/pnpm). Treats all advisory/package/log text as untrusted
data.
- **`.fabro/workflows/patch-cves/workflow.toml`** — requests the GitHub
App installation-token permissions the run needs:
`vulnerability_alerts=read`, `contents=write`, `pull_requests=write`,
`checks=read`. Sets `run.pull_request.enabled = false` so fabro's
run-branch finalization PR doesn't race the per-group PRs the agent
opens directly via `gh`.
## Design
The instructions ship as a bundled prompt file
(`@prompts/patch-cves.md`) that travels in the run manifest, so the
workflow is fully self-contained — no external skill or runtime
discovery involved.
Validated with `fabro validate patch-cves` (OK).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
