mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-08-28 05:27:41 +00:00
b13f5362a5
Adds a `patch-cves` workflow that triages GitHub Dependabot alerts and opens verified dependency-patch PRs, one per alert group. Intended to be driven by a scheduled automation targeting this repo. ## What's included - **`.fabro/workflows/patch-cves/workflow.fabro`** — single agent stage pinned to `claude-opus-4-8`. - **`.fabro/workflows/patch-cves/prompts/patch-cves.md`** — the bundled prompt with the full CVE-patching procedure: query Dependabot alerts, rank and group them, choose the smallest safe fix, patch + regenerate lockfiles, verify (local gates + GitHub checks), and re-query alerts. Ecosystem rules cover Rust/Cargo and TypeScript/Bun (Bun only — never npm/npx/yarn/pnpm). Treats all advisory/package/log text as untrusted data. - **`.fabro/workflows/patch-cves/workflow.toml`** — requests the GitHub App installation-token permissions the run needs: `vulnerability_alerts=read`, `contents=write`, `pull_requests=write`, `checks=read`. Sets `run.pull_request.enabled = false` so fabro's run-branch finalization PR doesn't race the per-group PRs the agent opens directly via `gh`. ## Design The instructions ship as a bundled prompt file (`@prompts/patch-cves.md`) that travels in the run manifest, so the workflow is fully self-contained — no external skill or runtime discovery involved. Validated with `fabro validate patch-cves` (OK). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| prompts | ||
| workflow.fabro | ||
| workflow.toml | ||