Skip to content

Add VEX Generator agentic workflow sample#295

Draft
Copilot wants to merge 2 commits intomainfrom
copilot/add-agentic-workflow-sample
Draft

Add VEX Generator agentic workflow sample#295
Copilot wants to merge 2 commits intomainfrom
copilot/add-agentic-workflow-sample

Conversation

Copy link
Contributor

Copilot AI commented Mar 24, 2026

Adds the VEX Generator workflow to the agentics sample library, enabling auto-generation of OpenVEX v0.2.0 statements when Dependabot alerts are dismissed — capturing maintainer security assessments in a machine-readable format consumable by downstream scanners and SBOM tools.

Changes

  • workflows/vex-generator.md — Workflow template with workflow_dispatch trigger accepting 8 inputs (alert details + dismissal reason). Maps Dependabot dismissal reasons to VEX statuses, constructs package purls, generates OpenVEX JSON to .vex/<ghsa-id>.json, and opens a PR via create-pull-request safe output. Moved description: to the top of frontmatter per repo convention.
  • docs/vex-generator.md — Full documentation with mermaid flow diagram, input/dismissal-mapping tables, output format example, and added missing gh aw compile note.
  • README.md — Entry added under Security Workflows.

Dismissal → VEX mapping

Dependabot reason VEX status Justification
not_used not_affected vulnerable_code_not_present
inaccurate not_affected vulnerable_code_not_in_execute_path
tolerable_risk not_affected inline_mitigations_already_exist
no_bandwidth (skipped) Not a security assessment

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

Copilot AI changed the title [WIP] Add new agentic workflow sample from issue 22017 Add VEX Generator agentic workflow sample Mar 24, 2026
Copilot AI requested a review from pelikhan March 24, 2026 14:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants