# DevSecOps AI Workflow Prompt

> Source: <https://gist.github.com/srujanpadala/1dd48b690177d87659b9c0bbb0769e13>
> Published: 2026-08-11 11:21:20+00:00

Goal: Build an automated AI workflow that performs security analysis on every GitHub Pull Request and posts a summarized report back as a PR comment.

Workflow Steps:

```
Setup Trigger:

Configure GitHub Pull Request trigger

Events:
    opened
    synchronize
    reopened

Ensure webhook is registered with the repository

Extract PR Data:
From webhook payload:

Repository owner
Repository name
Pull Request number

Fetch Changed Files:

Use GitHub API:
GET /repos/{owner}/{repo}/pulls/{pull_number}/files

Authentication:
    Retrieve GitHub PAT securely from workspace secrets
    Example: GITHUB_TOKEN

For each file:
    Filename
    Patch (diff)
    Status (added/modified/removed)

Skip:
    Binary files
    Files exceeding size threshold

AI Security Analysis:
Analyze each changed file for:

Hardcoded secrets (API keys, tokens, credentials)
Injection vulnerabilities (SQL, command, etc.)
Unsafe deserialization
Authentication/authorization flaws
Sensitive data leaks
OWASP Top 10 risks
```

For each issue, produce:

```
Severity (Low / Medium / High / Critical)
Description
Affected snippet (from diff)
Recommended fix

Aggregate Results:

Total issues by severity
File-wise breakdown
Highlight critical/high issues

Generate PR Comment (Markdown):
```

🔐 AI Security Scan Report

Summary:

```
Critical: X
High: X
Medium: X
Low: X
```

Findings:

```
File: <filename>
    Issue: <description>
    Severity: <level>
    Recommendation: <fix>
```

Overall Recommendation:

```
✅ Approve
⚠️ Needs Fixes
❌ Block Merge

Post Comment to PR:

GitHub API:
POST /repos/{owner}/{repo}/issues/{pull_number}/comments

Authentication:
    Use GitHub PAT from workspace secrets (GITHUB_TOKEN)
    Do NOT hardcode or expose the token
```

Constraints:

```
Never expose secrets in logs or outputs
Ensure idempotency (avoid duplicate comments)
Handle large PRs efficiently
Respect API rate limits
```

Output: "Security scan completed and comment posted successfully."