mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-08-28 05:27:41 +00:00
b13f5362a5
Adds a `patch-cves` workflow that triages GitHub Dependabot alerts and opens verified dependency-patch PRs, one per alert group. Intended to be driven by a scheduled automation targeting this repo. ## What's included - **`.fabro/workflows/patch-cves/workflow.fabro`** — single agent stage pinned to `claude-opus-4-8`. - **`.fabro/workflows/patch-cves/prompts/patch-cves.md`** — the bundled prompt with the full CVE-patching procedure: query Dependabot alerts, rank and group them, choose the smallest safe fix, patch + regenerate lockfiles, verify (local gates + GitHub checks), and re-query alerts. Ecosystem rules cover Rust/Cargo and TypeScript/Bun (Bun only — never npm/npx/yarn/pnpm). Treats all advisory/package/log text as untrusted data. - **`.fabro/workflows/patch-cves/workflow.toml`** — requests the GitHub App installation-token permissions the run needs: `vulnerability_alerts=read`, `contents=write`, `pull_requests=write`, `checks=read`. Sets `run.pull_request.enabled = false` so fabro's run-branch finalization PR doesn't race the per-group PRs the agent opens directly via `gh`. ## Design The instructions ship as a bundled prompt file (`@prompts/patch-cves.md`) that travels in the run manifest, so the workflow is fully self-contained — no external skill or runtime discovery involved. Validated with `fabro validate patch-cves` (OK). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
19 lines
646 B
Text
19 lines
646 B
Text
digraph PatchCves {
|
|
graph [
|
|
goal="Triage GitHub Dependabot alerts and open verified dependency-patch PRs",
|
|
model_stylesheet="
|
|
* { model: claude-opus-4-8; }
|
|
"
|
|
]
|
|
rankdir=LR
|
|
|
|
start [shape=Mdiamond, label="Start"]
|
|
exit [shape=Msquare, label="Exit"]
|
|
|
|
// Single agent stage. The CVE-patching instructions live in a bundled prompt
|
|
// file (@prompts/patch-cves.md) that travels in the run manifest, keeping the
|
|
// workflow self-contained — no external skill or runtime discovery required.
|
|
patch [label="Patch CVEs", prompt="@prompts/patch-cves.md"]
|
|
|
|
start -> patch -> exit
|
|
}
|