Triage PHP security advisories with GitHub, Gemini, Jira, Slack and Sheets

Quick overview

Youtube Video: https://youtu.be/5Jy5-KMuhtA

This workflow runs every six hours to monitor newly published PHP Composer security advisories from GitHub, enriches them with EPSS scores, uses Google Gemini plus Brave Search to generate a structured developer alert, creates a Jira issue, posts to Slack, and logs notifications in Google Sheets.

How it works

1. Runs on a schedule every six hours.
2. Reads a Google Sheets notification log to collect previously alerted GHSA IDs.
3. Calls the GitHub Security Advisories API for recently published reviewed Composer advisories and filters out withdrawn items, unwanted severities, and advisories already logged.
4. Sorts advisories by publish time, limits processing to a single newest advisory per run, and fetches an EPSS exploitation probability score from first.org using the CVE.
5. Uses Google Gemini with Brave Search tools to analyze the advisory details and return a validated structured alert (risk level, exploit status, fix guidance, and sources).
6. Creates a Jira issue with a formatted summary and description, posts the alert (including the Jira link or failure notice) to the configured Slack channel, and appends the notification details back to Google Sheets.

Setup

1. Add credentials for GitHub API, Google Sheets (Service Account), Google Gemini (PaLM/Google AI), Brave Search, Jira Software Cloud, and Slack.
2. Create or choose a Google Sheets spreadsheet and ensure it has a sheet named like your log sheet (for example, "Notification_Log") with columns matching the fields the workflow appends (such as ghsa_id, cve_id, severity, risk_level, package, and notified_at).
3. Update the configuration values for the Google Sheet ID, Slack channel ID, timezone, lookback window, and allowed severities to match your environment.
4. In Jira, set the correct project and issue type IDs (or select the right project/issue type) where vulnerability tickets should be created.