Conversation
There was a problem hiding this comment.
Pull request overview
Introduces a new agentic workflow specification that bundles Dependabot alerts into grouped “parent” issues and delegates them to a Copilot agent for remediation. The workflow is scoped with minimal permissions, uses cache-memory to track parent issues, and leverages safe-outputs for creating/updating issues and assigning to an agent.
Changes:
- Add
dependabot-burner.mdagent spec with frontmatter defining schedule, permissions, tools (GitHub + cache-memory), safe-outputs (create-issue,update-issue,assign-to-agent,noop), tracker-id, and network restrictions. - Document detailed behavior for fetching Dependabot alerts, grouping them by ecosystem and manifest, maintaining a single parent issue per group, and structuring the issue body into managed and human-owned sections.
- Define assignment semantics to a
copilotagent and fallback behavior (noopormissing-data) together with safety constraints (no auto-merge or PR creation).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
PR titles:
|
Uh oh!
There was an error while loading. Please reload this page.