Analyze code scanning security issues and dependency updates if vulnerable

[IMPROVED_PROMPT]

SUBJECT: Comprehensive Security Analysis of GitHub Actions Runs

INSTRUCTIONS:

1. Analyze Code Scanning Security Issues

   • Examine the most recent code scanning results from all repositories in the organization.
   • Identify and list all security vulnerabilities, categorized by severity level (Critical, High, Medium, Low).
   • For each vulnerability, provide the following details:
     • Vulnerable library/dependency name and version
     • Description of the issue
     • Exploitability and potential impact if left unpatched
     • Affected files or lines of code
     • First detected at timestamp

2. Analyze Dependency and Base Image Issues

   • Review all GitHub Actions workflow files across the organization.
   • Identify any dependencies or base images used in the workflows.
   • Check if any of these dependencies or images have known security vulnerabilities:
     • If vulnerable, list the dependency/imaged name, vulnerability details, and severity level
     • If not vulnerable, confirm the latest patch version is in use
   • Determine the root cause of security issues: whether they arise from dependencies, base images, or custom code

3. Detect Repeated Vulnerability Patterns

   • Analyze the security issue data from step 1.
   • Identify if any vulnerabilities are occurring repeatedly across multiple repositories.
   • If patterns are found:
     • List the common vulnerable dependencies or libraries
     • Identify the common severity levels
     • Count the number of occurrences of each pattern
     • Suggest potential root causes for the repeated issues

4. Prioritize Remediation

   • Based on the analyzed data, create a remediation plan.
   • Prioritize security issues to address, considering the following:
     • Severity level (Critical > High > Medium > Low)
     • Number of affected repositories
     • Exposure level (public vs private repositories)
     • Ease of patching (single dependency vs multiple)
   • For each prioritized issue:
     • Provide a clear description
     • Suggest a specific patch solution (update version, apply fix, etc.)
     • Estimate the time required to resolve
     • Recommend the order to address the issue

5. Format Output

   • Organize the output in a structured format (e.g., a markdown table).
   • Make it easy to scan and understand the security status quickly.
   • Include clear section headers for each analysis category.

6. Constraints

   • Assume you have read-only access to the GitHub Actions logs and repository code.
   • Do not modify any files or trigger any actions.
   • Use only public information available through the GitHub API or UI.
   • If private repository access is required, state the limitations clearly.

Deliver a well-structured, informative, and actionable security report based on these instructions.