Campaign: Security Alert Burndown

[mnkiefer]

Original Request

Write a campaign that burns down the code security alerts backlog. Focus on file write issues first, cluster alerts if possible (up to 3), and add comments generated code for fixes. Use Claude for codegen, copilot for campaign manager.

---

🎯 Campaign Details

Campaign ID: security-alert-burndown
Campaign Name: Security Alert Burndown
Project Board: View Project (will be updated after compilation)
Risk Level: Medium
State: Planned

📋 Workflows

Existing Workflows (Ready to Use)

1. code-scanning-fixer (Agentic)

Automatically fixes high severity code scanning alerts by creating pull requests with remediation. Runs every 30 minutes, uses cache memory to avoid duplicates, and generates secure fixes following security best practices.

Key Features:

• Prioritizes file write vulnerabilities
• Uses Claude for intelligent code generation
• Creates detailed security documentation
• Tracks fixed alerts to prevent duplicate work

2. security-scan (Regular)

Daily security scanning using multiple tools (Gosec, govulncheck, Trivy) to identify new vulnerabilities and upload results to GitHub Security.

Key Features:

• Comprehensive coverage across Go, dependencies, and filesystem
• Runs daily at 6:00 AM UTC
• Creates code scanning alerts for discovered issues

3. codeql (Regular)

Advanced semantic code analysis for Go, JavaScript, and GitHub Actions workflows using CodeQL security-and-quality query suites.

Key Features:

• Deep semantic analysis of code patterns
• Identifies complex security vulnerabilities
• Runs daily at 6:00 AM UTC

🎯 Campaign Goals

Primary Objectives

1. Eliminate high-severity alerts: Burn down the backlog of high-severity code security alerts
2. Prioritize file write issues: Focus first on file write vulnerabilities (path traversal, unsafe file creation)
3. Cluster related alerts: Group up to 3 similar alerts for comprehensive fixes
4. Generate documented fixes: All fixes include clear explanations and security best practice guidance
5. Reduce manual workload: Automate security remediation while maintaining quality

Success Metrics

• High-severity alert count reduction (target: zero)
• File write vulnerability count (target: zero)
• Average time to fix (from alert creation to PR merge)
• Fix quality (% of PRs merged without changes)

⏱️ Timeline

• Start Date: 2026-01-15
• Initial Burndown Target: 30 days for high-severity backlog
• Ongoing: Continuous security improvement and maintenance

🎨 Campaign Strategy

Alert Prioritization

1. P0 - Critical: High severity + file write issues (path traversal, unsafe file creation)
2. P1 - High: High severity + other (command injection, SQL injection, XSS)
3. P2 - Medium: Medium severity + file write issues
4. P3 - Medium: Medium severity + other categories

Clustering Guidelines

• Same vulnerability type (CWE/rule)
• Same file or related module
• Similar fix pattern
• Maximum of 3 alerts per PR
• Document all alert numbers in PR description

AI Configuration

• Claude: Code generation and security analysis
• Copilot: Campaign management and orchestration
• Memory: Persistent learning from fix patterns and review feedback

📊 Project Board Configuration

The project board includes custom fields for tracking:

• Worker/Workflow: Which workflow is handling the alert
• Priority: High/Medium/Low based on severity and type
• Status: Todo → In Progress → Review Required → Done/Closed
• Start/End Date: Timeline tracking
• Effort: Size estimation (Small/Medium/Large)

Three views are configured:

• Campaign Roadmap: Timeline view of all alerts
• Task Tracker: Table view with all fields
• Progress Board: Kanban board by status

---

🤖 Instructions for Copilot Coding Agent

The campaign specification file has been created at .github/workflows/security-alert-burndown.campaign.md.

Your Task

Compile the campaign using the gh-aw CLI:

gh aw compile security-alert-burndown

This will generate the compiled workflow files based on the campaign specification.

Expected Outputs

After compilation, the following files should be created/updated:

• .github/workflows/security-alert-burndown.campaign.md (already exists)
• Any generated workflow lock files or compiled configurations
• Updated project board URL in the campaign file

Next Steps

1. Run gh aw compile security-alert-burndown
2. Review the compiled output files
3. Commit all changes (campaign spec + compiled files) with a clear commit message
4. Create a pull request titled: [campaign] Add Security Alert Burndown Campaign
5. Include a summary of the campaign goals and workflows in the PR description

PR Description Template

# Campaign: Security Alert Burndown

This PR adds a new campaign to systematically address code security alerts in the repository backlog.

## Campaign Overview
- **ID**: security-alert-burndown
- **Risk Level**: Medium
- **Primary Goal**: Eliminate high-severity code security alerts
- **Focus Area**: File write vulnerabilities (path traversal, unsafe file creation)

## Workflows Included
- `code-scanning-fixer`: Automated fix generation (runs every 30m)
- `security-scan`: Daily vulnerability scanning
- `codeql`: Daily semantic code analysis

## Key Features
- Prioritizes file write issues
- Clusters up to 3 related alerts per fix
- Uses Claude for intelligent code generation
- Maintains fix history in campaign memory
- All fixes reviewed by security team

## Testing
- [ ] Campaign compiles successfully
- [ ] Workflow definitions are valid
- [ ] Project board is configured with custom fields
- [ ] Safe outputs are properly restricted

Closes #10114

Important Notes

• The project board has been created but needs the final URL updated in the campaign file
• All workflow executions will require approval due to medium risk level
• The code-scanning-fixer workflow will start automatically after merge
• Monitor the project board for progress tracking

---

Status: Ready for Copilot Coding Agent to compile and create PR

[github-actions]

✅ Campaign setup complete! Campaign Generator has successfully coordinated your campaign creation. Your project is ready! 📊

[github-actions]

✅ Campaign Specification Created!

I've generated the complete campaign specification and configured the project infrastructure. Now assigning the Copilot Coding Agent to compile and create a pull request.

📊 What's Been Set Up

1. Project Board

✅ Created project: Campaign: Security Alert Burndown
✅ Custom fields configured:

• Worker/Workflow (code-scanning-fixer, security-scan, codeql, manual-review)
• Priority (High, Medium, Low)
• Status (Todo, In Progress, Review required, Blocked, Done, Closed)
• Start Date & End Date
• Effort (Small, Medium, Large)

✅ Views automatically configured:

• Campaign Roadmap: Timeline view for planning
• Task Tracker: Comprehensive table view
• Progress Board: Kanban board for workflow

2. Campaign Specification File

📁 Created: .github/workflows/security-alert-burndown.campaign.md

Key Features:

• Comprehensive security alert burndown strategy
• File write vulnerability prioritization
• Alert clustering (up to 3 related alerts)
• AI-powered fix generation using Claude
• Campaign memory for learning from fixes
• Detailed documentation and guidelines

3. Workflows Included

code-scanning-fixer (Agentic)

• Runs every 30 minutes
• Automatically generates fixes for high-severity alerts
• Creates PRs with detailed security documentation
• Uses cache to prevent duplicate work

security-scan (Regular)

• Daily vulnerability scanning
• Multiple tools: Gosec, govulncheck, Trivy
• Uploads SARIF results to GitHub Security

codeql (Regular)

• Daily semantic code analysis
• Covers Go, JavaScript, GitHub Actions
• Advanced security pattern detection

🎯 Campaign Goals

1. Burn down high-severity alert backlog (target: zero)
2. Prioritize file write vulnerabilities (path traversal, unsafe file creation)
3. Cluster related alerts for comprehensive fixes
4. Generate well-documented fixes with security best practices
5. Reduce manual security review workload

⏱️ Timeline

• Start: 2026-01-15
• Initial burndown target: 30 days for high-severity backlog
• Ongoing: Continuous security maintenance

📝 Next Steps

The Copilot Coding Agent will now:

1. ✅ Read the campaign specification
2. ⏳ Compile the campaign using gh aw compile security-alert-burndown
3. ⏳ Create a pull request with compiled files
4. ⏳ Update the project board URL in the campaign file

Once the PR is merged, the code-scanning-fixer workflow will begin running every 30 minutes to systematically address security alerts!

---

Campaign ID: security-alert-burndown
Risk Level: Medium (requires security team approval)
State: Planned → Compiling

AI generated by Campaign Generator