review-security-issue

Automating security reviews for GitHub issues involves fetching issues via the gh CLI, analyzing content with a sub-agent, posting structured comments, and applying the state:review-ready label to guide remediation.

A structured security review evaluates GitHub issue claims to determine if a legitimate security risk exists, using label checks, agent-marker verification, and sub-agent analysis before posting remediation guidance.

Yes, the gh CLI is required to fetch GitHub issues for the security review workflow, which then uses an automated sub-agent to analyze the issue content and post remediation comments.

An automated agent determines legitimacy by applying marker-guided workflows, verifying labels, and running stepwise analysis via a principal-engineer-reviewer sub-agent to evaluate the security risk claim.

After a GitHub security issue is reviewed, the workflow posts structured remediation comments to the issue and updates its state by applying the state:review-ready label for further action.

Yes, this security review process applies to any GitHub issue with a potential security risk, evaluating the claim and guiding the reviewer through verification and remediation steps.