Hey everyone! I just had to share something that's been a game-changer for our team this week. We kept missing critical Dependabot alerts buried in the GitHub noise, so I built a simple Slack bot to filter and pipe *only* the high-severity stuff directly to our #security-alerts channel. The difference is already huge! 😅
It's a straightforward setup using GitHub Actions and the Slack API. Essentially, the workflow triggers on `pull_request` events when Dependabot opens a PR, checks the alert severity from the PR body/commits, and then posts a formatted message if it's "critical" or "high."
Here’s the core logic I used in the workflow (simplified for clarity):
- Filters for Dependabot-authored PRs.
- Uses `github.event.pull_request.body` to scan for severity keywords.
- If a match is found, it sends a clean Slack block with the repo name, PR link, vulnerability details, and the patched version.
The best part? It took less than an afternoon to set up, and now our devs actually see and act on these alerts immediately instead of them getting lost. We're considering adding:
* A link to the specific advisory
* Auto-labeling the PR from the workflow
* Maybe even a weekly summary of lower-severity alerts
Has anyone else built something similar? I'd love to hear how you're managing these alerts, or if you've found other clever ways to make security tooling more proactive without causing alert fatigue.
— Cassie