Security triage

Runs a vulnerability scan after implementing, then asks a person to choose: fix the findings now, accept the risk and open the pull request, or abandon the change.

Template	security-triage
Works on	A git repository, cloned into an isolated Docker sandbox
Where a person acts	How should we handle the security scan results? — a person chooses a path, waiting up to 4h

The workflow

Drawn from the template spec at build time. Bookkeeping nodes that only record status are left out; amber nodes are where a person acts.

flowchart TD
  n_validate["Validate"]
  n_implement["Implement"]
  n_vulnScan["Vuln scan"]
  n_securityDecision>"How should we handle the security scan results?<br/><small>person: decision</small>"]
  n_openPR["Open PR"]
  n_fixVulns["Fix vulns"]
  n_terminateAbandoned(["Failed<br/><small>abandoned</small>"])
  n_done(["Done"])
  n_validate --> n_implement
  n_implement --> n_vulnScan
  n_vulnScan --> n_securityDecision
  n_securityDecision -->|"timed out"| n_openPR
  n_securityDecision -->|"Fix vulnerabilities now"| n_fixVulns
  n_securityDecision -->|"Accept risk — open PR as-is"| n_openPR
  n_securityDecision -->|"Abandon — too risky"| n_terminateAbandoned
  n_openPR --> n_done
  n_fixVulns --> n_openPR
  class n_securityDecision gate

Maturity: built from the flagship steps

Ships as a built-in template and reuses the engineering steps the flagship flow runs. This particular arrangement of them is not separately exercised end to end against a real repository. See product overview §8.

Use it

Every built-in template is seeded into the workflow library and can be cloned, edited on the visual canvas, and versioned — see architecture for the node types. The spec lives in packages/shared/src/workflow/templates/securityTriage.ts.