bifrost-secupdate

What problem does it solve?

Manually triaging and resolving GitHub security artifacts (Dependabot PRs, Dependabot alerts, CodeQL findings, secret-scanning alerts) for the Bifrost open-source integration platform is time-consuming and prone to policy inconsistencies, especially as the volume of security artifacts grows.

Core Features & Use Cases

• Dependabot PR Automation: Auto-merge eligible patch/minor/security dependency PRs with passing CI, label major and Docker base-image bumps for manual review, and handle transient CI failures with automatic reruns.
• Security Alert Triage: Process Dependabot alerts without associated PRs, triage CodeQL findings using severity-first prioritization and subagent fan-out for class-level rules, and coordinate secret rotation for real secret-scanning alerts while dismissing false positives.
• Use Case: A Bifrost maintainer with 30+ open security artifacts can use this skill to resolve all low-risk items automatically and surface only edge cases requiring human input, reducing security queue resolution time from hours to minutes.

Quick Start

Use the bifrost-secupdate skill to drain the Bifrost repository's security queue by processing all open Dependabot PRs, security alerts, CodeQL findings, and secret-scanning alerts per the project's defined policies.