Security triage agent that turns Dependabot CVEs into Jira tickets

ensure_jira_project(jira, cfg.jira_project_key)          # jira_projects_list
issue_type = ensure_issue_type(jira, cfg.jira_project_key, cfg.jira_issue_type)
# jira_issue_create_meta_issue_types_list -> falls back to Bug / Task if the
# configured type is not on this project's create screen

for severity in ("critical", "high", "medium", "low"):
    data = self.execute_tool(
        "github_dependabot_alerts_list",
        owner=owner, repo=repo, state="open", per_page=per_page,
        severity=severity, sort="created", direction="desc",
    )
    batch = _as_list(data, "alerts")
    if len(batch) >= per_page:                # this bucket alone hit the cap
        truncated.append(f"{severity} ({len(batch)})")
    for alert in batch:
        collected.setdefault(alert.get("number", id(alert)), alert)

@property
def dedup_key(self) -> str:
    """The identity of one ticketable finding: advisory AND package."""
    return f"{self.cve_id}::{self.package_name}"

score = _dig(advisory, "cvss", "score")
cvss_score = float(score) if score is not None else None
if cvss_score == 0.0:            # "no scored vector", not a genuine CVSS of 0
    cvss_score = None

ticketable = filter_by_severity(cves, cfg.min_ticket_severity)   # default: high

if cached := state.get_ticket(owner, repo, cve.dedup_key):
    continue                                  # already ticketed (local state)

existing = jira.find_issues_by_label(cfg.jira_project_key, label)   # jira_issues_search
if existing:                                  # durable guard, survives state loss
    state.mark_ticketed(owner, repo, cve.dedup_key, existing[0]["key"])
    continue

result = jira.create_issue(
    project_key=cfg.jira_project_key, summary=build_ticket_summary(cve, repo),
    description=build_ticket_description(cve, owner, repo, cfg.engineer_email),
    issue_type=issue_type, labels=cve.labels,
    priority_name=SEVERITY_TO_JIRA_PRIORITY.get(cve.severity),
)
state.mark_ticketed(owner, repo, cve.dedup_key, result["key"])

datadog.create_event(
    title=f"{cve.severity.upper()} {cve.cve_id} in {cve.package_name}",
    text=cve.remediation, alert_type=SEVERITY_TO_DD_ALERT_TYPE[cve.severity],
    aggregation_key=cve.dedup_key,       # one event stream per CVE::package
    tags=cfg.datadog_monitor_tags,       # JSON-encoded string upstream, not a list
)

channel_id = slack.resolve_channel_id(cfg.slack_channel)   # slackmcp_slack_search_channels
slack.send_message(channel_id, build_slack_digest(...))    # slackmcp_slack_send_message