ENGINEERING
Confirm CVE reachability against Sentry runtime traces on PR
Enriches a dependency-bump risk gate with real evidence: it checks whether the vulnerable transitive package actually appears in recent Sentry stack traces.
How it runs
The automated pipeline, trigger to output.
- TriggerDependency-bump PR openedGitHub
- ActionResolve transitive set and fetch advisoriesGitHub
- ActionQuery Sentry traces for vulnerable module framesSentry
- LogicConfirm reachability and decide check result
- OutputPost reachability-evidenced check to PRGitHub
What it does
Cuts false positives in CVE gating. Many advisories flag code paths your app never executes. This flow cross-checks each flagged transitive package against module frames seen in recent Sentry events, so a CVE only counts toward a block if the package actually runs in your stack.
When to use it
Use it when your gate blocks too aggressively and reviewers have learned to ignore it. Reachability evidence from production traces makes each block credible and rare.
How it works
- 1A GitHub pull_request event fires on a bump PR.
- 2The flow resolves the transitive packages and pulls their CVE advisories.
- 3For each flagged package it queries Sentry for recent events whose stack frames reference that module.
- 4A logic step marks a CVE reachable only when matching frames exist and reachable severity exceeds threshold.
- 5It posts a PR check showing each CVE as reachable-confirmed or theoretical, with the linking Sentry events.
- 6The check fails only on reachable-confirmed criticals.
Set it up
What you configure once, before turning it on.
- 1Connect GitHubRepos, issues, pull requests, actions.
- 2Connect SentryErrors, performance, releases.
- 3Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 4Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 5Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More Engineering workflows
Gate breaking API PRs behind downstream consumer acknowledgement
When a PR introduces a breaking contract change, comments the impact summary back on the PR, applies a blocking label.
Publish a versioned API changelog to Confluence on each release tag
On a new semver release tag, gathers the contract changes since the last release and writes a clean.
Agent reviews model-license fit and suggests compliant swaps on the PR
When a PR adds a Hugging Face model, an agent reads the model card and license, judges fit against your commercial-use policy.
Upgrade Impact Router to Module Code Owners
Maps a dependency-bump PR's affected modules to their CODEOWNERS, then DMs each owner on Slack with only the changelog slice that touches code they own.
Re-Voice IVR Prompts on Phone-Tree Config Merge
When a phone-tree config change merges in GitHub, regenerates the ElevenLabs audio for any prompt whose script changed in the diff and opens a follow-up PR adding the new audio…
Upstream Release to Notion Upgrade Brief
When a watched package publishes a new release, fetches the release notes, maps them to the internal modules that depend on it.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.