Continuous monitoring and automated remediation

A CI/CD gate checks the state of the code at deployment time but cannot respond to new vulnerabilities that emerge afterward. Combining Dependabot·Renovate with scheduled scans lets you continuously detect vulnerabilities in production and automatically generate patch PRs.

The configuration below is an example — a fully working implementation lives in the reference repository

The YAML and commands on this page are examples that show the essentials. For a complete, copy-and-run pipeline (including policy files and a sample app), see the Best Practice repository.

Why post-deployment monitoring is necessary

A CI/CD gate only checks a snapshot taken at deployment time

The pipeline cannot detect a new CVE discovered after deployment.

Nature of new CVEs: Code deployed today may become vulnerable to a new CVE tomorrow. Log4Shell is a classic example, where a library used for years turned into a Critical vulnerability overnight. Scan results taken at deployment time lose their meaning over time.

Limits of a pipeline without monitoring: Even code that passed the PR stage may have vulnerabilities 30 days later. Without continuous scanning, your service runs unaware of the risks in production.

Need for automation: Manually tracking hundreds of dependencies is not realistic. The key is to minimize human intervention and accelerate patching with automated tools like Dependabot·Renovate.

---

Dependabot setup

Basic configuration

Adding .github/dependabot.yml to a GitHub repository automatically opens dependency-update and security-patch PRs.

YAML

# .github/dependabot.yml

version: 2
updates:
  # npm dependencies
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
      day: monday
      time: '09:00'
    open-pull-requests-limit: 10
    groups:
      # Group minor/patch updates to reduce PR count
      minor-and-patch:
        update-types:
          - minor
          - patch

  # Python dependencies
  - package-ecosystem: pip
    directory: /
    schedule:
      interval: weekly
    ignore:
      # major updates require manual review
      - dependency-name: django
        update-types: [version-update:semver-major]

  # Docker base images
  - package-ecosystem: docker
    directory: /
    schedule:
      interval: weekly

  # GitHub Actions self-updates
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly

Enable security alerts

GitHub's Dependabot has two separate settings to enable. Security Alerts notify you of vulnerable dependencies based on the GitHub Advisory Database; to have fix PRs opened automatically as well, you must additionally enable Dependabot security updates. Both are enabled in the Code security menu of the repository Settings.

---

Renovate setup

Renovate allows finer-grained policy configuration than Dependabot and supports GitHub·GitLab·Bitbucket alike. It can also be run self-hosted on GitLab.

JSON

// renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "schedule": ["every weekend"],
  "vulnerabilityAlerts": {
    "enabled": true,
    "schedule": ["at any time"],
    "automerge": true,
    "automergeType": "pr"
  },
  "packageRules": [
    {
      "matchUpdateTypes": ["patch"],
      "automerge": true,
      "automergeType": "pr"
    },
    {
      "matchUpdateTypes": ["major"],
      "enabled": true,
      "automerge": false,
      "addLabels": ["major-update", "needs-review"]
    }
  ]
}

Item	Dependabot	Renovate
Platform	GitHub only	GitHub·GitLab·Bitbucket
Setup complexity	Low	High (very flexible)
Auto-merge	Limited	Configurable with detailed policy
Grouped PRs	Supported	Supported (more granular)
Cost	Free	Free (self-hosted)

---

Automate scheduled scans

Beyond the PR phase, run a separate scheduled workflow that periodically scans deployed code.

YAML

# .github/workflows/scheduled-scan.yml

name: Scheduled Security Scan

on:
  schedule:
    - cron: '0 2 * * *' # daily 2 AM
  workflow_dispatch: # manual run available

jobs:
  sca-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          format: cyclonedx-json
          output-file: sbom.cdx.json

      - name: Scan for new CVEs
        uses: anchore/scan-action@v7
        with:
          sbom: sbom.cdx.json
          fail-build: true
          severity-cutoff: critical

      - name: Upload SBOM
        uses: actions/upload-artifact@v7
        with:
          name: sbom-scheduled-${{ github.run_id }}
          path: sbom.cdx.json
          retention-days: 365 # retain yearly

  container-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Scan production image
        uses: aquasecurity/trivy-action@0.36.0
        with:
          image-ref: ${{ vars.PROD_IMAGE }}
          exit-code: 1
          severity: CRITICAL
          ignore-unfixed: true

---

Notification and response system

Alerts must reach the responsible owner immediately

Use the GitHub Security tab: Dependabot and code-scan results are automatically aggregated in the repository's Security tab. For critical findings, wiring email and Slack notifications to the owner can greatly shorten response time.

Create issues automatically: When a scheduled scan finds a new vulnerability, automatically open an issue via GitHub Actions so you can assign an owner and track the SLA. Once vulnerabilities are managed as issues, patch progress can be shared across the whole team.

Archive SBOMs by year: Permanently archive the SBOMs produced by scheduled scans, organized by release version. These serve as an audit-response trail for ISO/IEC 18974 and are also useful for reproducing the dependency state at a specific point in time.

---

Self-Study — Level 2 Automation

Build automation workflows with Claude Code

The agents below work in conjunction with the CI/CD pipeline. They generate workflow files that fully automate security analysis.

Prerequisite: Clone the Trusted OSS repository

Automated PR security-analysis comments

Each time a PR is opened, Claude analyzes the security scan results and automatically posts a comment on the PR.

Bash

cd agents/level2-automation/pr-comment
claude

Generated output:

• .github/workflows/pr-security-comment.yml (GitHub Actions)
• gitlab-pr-comment.yml (GitLab CI conversion version)

Automatic issue creation + Dependabot analysis

Generates a workflow that automatically registers findings from security scan results (grype, Semgrep, license violations) at or above a configured severity as GitHub or GitLab Issues. It includes deduplication logic keyed by CVE ID.

Bash

cd agents/level2-automation/issue-tracker
claude

Generated output:

• .github/workflows/security-issue-tracker.yml
• gitlab-issue-tracker.yml (GitLab CI conversion version)
• ISSUE-TRACKER-SETUP.md (guide to token permissions, labels, and cost settings)

GitHub Actions vs GitLab CI

GitHub Actions provides YAML verified to actually work. GitLab CI provides conversion patterns and annotations for the same functionality. Both platforms require ANTHROPIC_API_KEY to be registered as a Secret/Variable.

---

Next steps

• Mapping ISO/IEC 18974 requirements to implementation: ISO Standard Mapping