mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-08-28 05:27:41 +00:00
b13f5362a5
Adds a `patch-cves` workflow that triages GitHub Dependabot alerts and opens verified dependency-patch PRs, one per alert group. Intended to be driven by a scheduled automation targeting this repo. ## What's included - **`.fabro/workflows/patch-cves/workflow.fabro`** — single agent stage pinned to `claude-opus-4-8`. - **`.fabro/workflows/patch-cves/prompts/patch-cves.md`** — the bundled prompt with the full CVE-patching procedure: query Dependabot alerts, rank and group them, choose the smallest safe fix, patch + regenerate lockfiles, verify (local gates + GitHub checks), and re-query alerts. Ecosystem rules cover Rust/Cargo and TypeScript/Bun (Bun only — never npm/npx/yarn/pnpm). Treats all advisory/package/log text as untrusted data. - **`.fabro/workflows/patch-cves/workflow.toml`** — requests the GitHub App installation-token permissions the run needs: `vulnerability_alerts=read`, `contents=write`, `pull_requests=write`, `checks=read`. Sets `run.pull_request.enabled = false` so fabro's run-branch finalization PR doesn't race the per-group PRs the agent opens directly via `gh`. ## Design The instructions ship as a bundled prompt file (`@prompts/patch-cves.md`) that travels in the run manifest, so the workflow is fully self-contained — no external skill or runtime discovery involved. Validated with `fabro validate patch-cves` (OK). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
17 lines
877 B
TOML
17 lines
877 B
TOML
_version = 1
|
|
|
|
# The patch-cves prompt has the agent open one PR per alert group directly
|
|
# via `gh` (see prompts/patch-cves.md). Disable fabro's run-branch finalization
|
|
# PR so the two mechanisms don't race — the agent owns PR creation here.
|
|
[run.pull_request]
|
|
enabled = false
|
|
|
|
# GitHub App installation-token permissions requested for this run. These are a
|
|
# pass-through to the token mint and are further bounded by what the Fabro
|
|
# GitHub App is actually granted at the App level. The patch-cves prompt
|
|
# needs to read Dependabot alerts, push branches, and open PRs.
|
|
[run.integrations.github.permissions]
|
|
vulnerability_alerts = "read" # Dependabot alerts (gh api .../dependabot/alerts)
|
|
contents = "write" # branch + commit dependency/lockfile edits
|
|
pull_requests = "write" # open the patch PRs
|
|
checks = "read" # gh pr checks --watch
|