Triage Dependabot security alerts for a GitHub repo with Jira integration
From arribanpx claudepluginhub nmoinvaz/speedy-gonzales --plugin arriba[owner/repo]/dependabot-triageTriage Dependabot alerts — assess real impact, dismiss noise
Triage Dependabot security alerts for the GitHub repo: $ARGUMENTS
Follow these steps carefully for each open alert. Do not batch — handle them one at a time.
Before any Jira operations, verify that acli is authenticated by running acli jira auth status. If not authenticated, tell the user to run acli jira auth login --web and stop.
Refer to the acli skill for command syntax reference.
Run this command to list every open alert:
gh api repos/<owner>/<repo>/dependabot/alerts --jq '.[] | select(.state == "open") | {number, dependency: .dependency.package.name, severity: .security_advisory.severity, summary: .security_advisory.summary, ghsa_id: .security_advisory.ghsa_id, cve_id: (.security_advisory.identifiers[] | select(.type == "CVE") | .value) // "N/A", published: .security_advisory.published_at}'
If there are no open alerts, tell me and stop.
Search for an open Dependabot pull request that addresses this alert:
gh pr list --repo <owner>/<repo> --state open --author app/dependabot --json number,title,url --jq '.[] | select(.title | test("<package-name>"; "i"))'
Present a brief summary including:
Then ask me what I want to do using AskUserQuestion. The options must be:
First, approve the Dependabot PR (required by branch protection policies):
gh pr review <pr-number> --repo <owner>/<repo> --approve
Then merge using rebase:
gh pr merge <pr-number> --repo <owner>/<repo> --rebase
If the merge succeeds, the Dependabot alert should be automatically resolved by GitHub. Verify by checking the alert state:
gh api repos/<owner>/<repo>/dependabot/alerts/<number> --jq '.state'
Then post a comment on the PR noting it was merged during triage:
gh pr comment <pr-number> --repo <owner>/<repo> --body "Merged via Claude Code dependabot-triage."
If the alert is still open after merging, mark it as fixed:
gh api --method PATCH repos/<owner>/<repo>/dependabot/alerts/<number> \
-f state=fixed
Confirm success or report failure before moving on.
gh api --method PATCH repos/<owner>/<repo>/dependabot/alerts/<number> \
-f state=dismissed \
-f dismissed_reason=<reason> \
-f dismissed_comment="Dismissed via Claude Code triage"
Confirm success or report failure before moving on.
After handling each alert (merged, dismissed, or skipped), search Jira for a related ticket.
IMPORTANT: Use summary ~ instead of text ~ because Jira's text field tokenizes CVE IDs
(hyphens + numbers) incorrectly and returns no results. The summary field works reliably.
First, search for the CVE and repo name together in the summary field. If no results, try a broader search with just the CVE.
Filter the results to find tickets that are not already Resolved/Done/Closed.
Show me the ticket key, summary, and current status. Then ask me if I want to transition it to Resolved.
If I confirm:
Only transition if I confirm.
If a Dependabot PR was merged for this alert, also add a comment on the GitHub PR linking to the Jira ticket:
gh pr comment <pr-number> --repo <owner>/<repo> --body "Associated Jira ticket: <TICKET-KEY> (<ticket-summary>)"
Move to the next open alert and repeat from Step 2. After all alerts are processed, print a final summary table showing: