DevSecOps AI Workflow Prompt

A developer has outlined a workflow that automates AI-powered security analysis on GitHub pull requests, posting summarized reports as comments. The process fetches changed files, scans for vulnerabilities like hardcoded secrets and injection flaws, and generates a Markdown report with severity ratings and recommendations. The workflow emphasizes secure handling of GitHub tokens and idempotent comment posting.

Goal: Build an automated AI workflow that performs security analysis on every GitHub Pull Request and posts a summarized report back as a PR comment. Workflow Steps: Setup Trigger: Configure GitHub Pull Request trigger Events: opened synchronize reopened Ensure webhook is registered with the repository Extract PR Data: From webhook payload: Repository owner Repository name Pull Request number Fetch Changed Files: Use GitHub API: GET /repos/{owner}/{repo}/pulls/{pull number}/files Authentication: Retrieve GitHub PAT securely from workspace secrets Example: GITHUB TOKEN For each file: Filename Patch diff Status added/modified/removed Skip: Binary files Files exceeding size threshold AI Security Analysis: Analyze each changed file for: Hardcoded secrets API keys, tokens, credentials Injection vulnerabilities SQL, command, etc. Unsafe deserialization Authentication/authorization flaws Sensitive data leaks OWASP Top 10 risks For each issue, produce: Severity Low / Medium / High / Critical Description Affected snippet from diff Recommended fix Aggregate Results: Total issues by severity File-wise breakdown Highlight critical/high issues Generate PR Comment Markdown : 🔐 AI Security Scan Report Summary: Critical: X High: X Medium: X Low: X Findings: File: <filename Issue: <description Severity: <level Recommendation: <fix Overall Recommendation: ✅ Approve ⚠️ Needs Fixes ❌ Block Merge Post Comment to PR: GitHub API: POST /repos/{owner}/{repo}/issues/{pull number}/comments Authentication: Use GitHub PAT from workspace secrets GITHUB TOKEN Do NOT hardcode or expose the token Constraints: Never expose secrets in logs or outputs Ensure idempotency avoid duplicate comments Handle large PRs efficiently Respect API rate limits Output: "Security scan completed and comment posted successfully."