Automate a weekly dependency and vulnerability watch

GitHub raises a Dependabot alert for a vulnerable dependency. The alert waits in the repository's security tab. Nobody is asked to look, so the list grows and the severe ones hide among the minor ones. A weekly ranked list turns that tab into a short agenda: what is critical, what has a fix available, and what has been open longest.

You add the job and the repository owner grants read access to its alerts. Each week the scheduled agent lists the open Dependabot alerts through the GitHub REST API, which can filter by severity and ecosystem. It groups them as critical, high, medium and low, and for each shows the package, the vulnerable range, the patched version if one exists, and the age of the alert. For a package without a patched version it queries the public OSV database for other advisories and notes them. It reads and reports; it never opens a pull request, merges or dismisses an alert.

Before the list reaches you, the department head agent checks it: does every count match the lines, is a dismissed or fixed alert still listed, and is a patched version marked as available when the advisory names one. Then you approve, edit or skip it, and nothing is delivered until you do. Ignore rules in the notes field keep known, accepted risks off the list.

Work the list top down. Start with the critical and high packages that have a patched version, since those are the quickest wins. For alerts with no fix, decide whether to pin, replace the package or accept the risk and write that down. Compare the counts week to week: a falling critical count means the habit is working.