ENGINEERING
CVE Blast-Radius Mapper with Scoped Bump MRs
When a new CVE lands for a package, this maps every repository and service that depends on the affected version.
How it runs
The automated pipeline, trigger to output.
- TriggerCVE alert webhook or manual package + CVE inputGitLab
- ActionFetch lockfiles across projects and resolve installed versionsGitLab
- LogicFilter to repos whose pinned version is in the vulnerable range
- ActionBranch, bump dependency, and open a scoped MR per affected repoGitLab
- OutputPost consolidated MR list with versions and links to SlackSlack
What it does
Turns a single CVE alert into a precise, repo-by-repo remediation plan. It resolves which of your GitLab projects actually pull in the vulnerable package version, then drafts a narrowly scoped merge request that bumps only that dependency in each affected repo.
When to use it
Use it the moment a CVE is published for a package you ship — instead of broadcasting "everyone check if you use lodash" and hoping for the best. Ideal for platform and security teams who own dependency hygiene across many services.
How it works
- 1A GitLab webhook (or a manual run with a package + CVE id) fires the workflow.
- 2The agent fetches each project's lockfile and resolves the installed version, filtering to repos whose pinned version falls inside the vulnerable range.
- 3For every matched repo it creates a branch, bumps the dependency to the fixed version, and opens a merge request titled with the CVE id and a short risk note.
- 4A consolidated Slack message lists every MR with its repo, current vs. target version, and direct link so reviewers can triage in one place.
Set it up
What you configure once, before turning it on.
- 1Connect GitLabRepos, MRs, pipelines, registry.
- 2Connect SlackChannels, DMs, threads, mentions.
- 3Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 4Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 5Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More Engineering workflows
Gate breaking API PRs behind downstream consumer acknowledgement
When a PR introduces a breaking contract change, comments the impact summary back on the PR, applies a blocking label.
Publish a versioned API changelog to Confluence on each release tag
On a new semver release tag, gathers the contract changes since the last release and writes a clean.
Agent reviews model-license fit and suggests compliant swaps on the PR
When a PR adds a Hugging Face model, an agent reads the model card and license, judges fit against your commercial-use policy.
Upgrade Impact Router to Module Code Owners
Maps a dependency-bump PR's affected modules to their CODEOWNERS, then DMs each owner on Slack with only the changelog slice that touches code they own.
Re-Voice IVR Prompts on Phone-Tree Config Merge
When a phone-tree config change merges in GitHub, regenerates the ElevenLabs audio for any prompt whose script changed in the diff and opens a follow-up PR adding the new audio…
Upstream Release to Notion Upgrade Brief
When a watched package publishes a new release, fetches the release notes, maps them to the internal modules that depend on it.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.