Skip to content
Tentacular Tentacular

GitHub Vulnerability Triage

FieldValue
Namegithub-vuln-triage
Categoryautomation
Complexityadvanced
Tagsgithub-security, dependabot, codeql, llm-triage, fan-out-pattern, auto-remediation, postgres-state, s3-storage
Authorrandybias
Min Version0.1.0

Description

Section titled “Description”

Aggregate Dependabot and CodeQL alerts across a GitHub org, enrich with repo context (customer-facing status, environment, owning team), triage with AI, and auto-create GitHub issues for actionable findings. Uses a fan-out/fan-in DAG pattern for parallel alert fetching and a second fan-out for response actions.

DAG Structure

Section titled “DAG Structure”
fetch-dependabot ─┐                          ┌→ create-issues ─┐
                  ├→ deduplicate → enrich-context → triage ─┼→ alert-critical ←┘
fetch-codescan ───┘                          └→ log-all
NodePurpose
fetch-dependabotFetch Dependabot alerts from GitHub API
fetch-codescanFetch CodeQL code scanning alerts from GitHub API
deduplicateMerge and deduplicate alerts from both sources
enrich-contextAdd repo context (environment, team, customer exposure)
triageAI-powered severity triage and action recommendations
create-issuesAuto-create GitHub issues for actionable findings
alert-criticalSend critical alerts to Slack with issue links
log-allLog all triage results to Postgres and S3

Triggers

Section titled “Triggers”
  • manual
  • cron — daily at 7:00 AM (0 7 * * *)

Dependencies

Section titled “Dependencies”
ServiceTypeRequired
GitHub APIExternalYes
Anthropic APIExternalYes
Slack webhookExternalYes
tentacular-postgresExoskeletonYes
tentacular-rustfsExoskeletonYes

Config

Section titled “Config”
KeyDefaultDescription
timeout180sPer-node timeout
retries1Retry count per node
github_orgmy-orgGitHub organization to scan
repo_context(example map)Per-repo context: customer_facing, environment, team

Secrets

Section titled “Secrets”
  • github.token — GitHub personal access token with security and issues permissions
  • anthropic.api_key — Claude API key for triage analysis
  • slack.webhook_url — Slack webhook for critical alerts

Usage

Section titled “Usage”
Terminal window
tntc scaffold init github-vuln-triage
tntc scaffold init github-vuln-triage my-custom-name
tntc scaffold info github-vuln-triage

Source

Section titled “Source”

Scaffold source: quickstarts/github-vuln-triage/