Add daily VulnHunter security scan workflow

[Copilot]

This adds a scheduled agentic workflow to run Capital One’s VulnHunter methodology inside the sandbox against this repository. The workflow is designed to surface only verified, falsified-resistant findings and to stay quiet when nothing actionable is found.

• New workflow

  • Adds .github/workflows/daily-vulnhunter-scan.md
  • Triggers on schedule: daily and workflow_dispatch
  • Uses the Claude engine to perform the scan inside the sandbox

• VulnHunter execution model

  • Downloads and extracts capitalone/VulnHunter
  • Loads the upstream vulnhunt instructions (README, SKILL.md, and phase files)
  • Treats those instructions as the scan playbook for analyzing ${{ github.workspace }}

• Output contract

  • Uses create-issue safe output with a single consolidated issue
  • Requires noop when no verified exploitable findings are present
  • Limits reporting to high-confidence findings that survive VulnHunter’s falsification/disproof flow

• Guardrails

  • Keeps the job read-only apart from safe outputs
  • Restricts network access to the minimum needed to fetch the upstream scanner
  • Persists intermediate notes and structured findings under /tmp/gh-aw/agent/vulnhunter/out/

on:
  schedule: daily
  workflow_dispatch:

safe-outputs:
  create-issue:
    title-prefix: "[vulnhunter] "
    labels: [security, vulnhunter]
    max: 1
  noop:

[pelikhan]

@copilot Run vulnhunter in separate job and package results in artifact to be analyzed

[Copilot]

@copilot Run vulnhunter in separate job and package results in artifact to be analyzed

Addressed in 8073dd6. The workflow now stages a separate vulnhunter_bundle job that packages the repo snapshot and upstream VulnHunter materials as an artifact, and the Claude job downloads that artifact before doing the analysis and safe-output reporting.

[pelikhan]

@copilot resolve the merge conflicts on this branch.

[Copilot]

Pull request overview

Adds a daily agentic VulnHunter security scan using Claude and safe issue output.

Changes:

• Packages the repository and VulnHunter methodology for sandbox analysis.
• Configures verified finding reports, no-op handling, telemetry, and evaluations.
• Regenerates compiled workflows and the auto-upgrade schedule.

Show a summary per file

File	Description
.github/workflows/daily-vulnhunter-scan.md	Defines the scan workflow and reporting contract.
.github/workflows/daily-vulnhunter-scan.lock.yml	Compiled GitHub Actions workflow.
.github/workflows/agentic-auto-upgrade.yml	Updates the generated weekly schedule.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/2 changed files
• Comments generated: 5
• Review effort level: Medium

[github-actions]

🤖 PR Triage - run 29724276600

Field	Value
Category	feature
Risk	Medium
Score	57 / 100
Action	fast_track

Score breakdown: Impact 30/50 - Urgency 15/30 - Quality 12/20

Rationale: New daily VulnHunter security scan workflow. Human (pelikhan) approved. CI in progress. 2197 additions.

Next: Await CI completion then merge.

Generated by 🔧 PR Triage Agent · 45.9 AIC · ⌖ 5.33 AIC · ⊞ 5.6K · ◷

[Copilot]

@copilot resolve the merge conflicts on this branch.

Addressed in 24a0009. The branch now includes a clean merge from origin/main, and I committed the regenerated daily-vulnhunter-scan.lock.yml produced by the current toolchain after the merge.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.82.14