Check GitHub vulnerability reports (Dependabot, Code Scanning, secret scanning) and create `status:proposed` GitHub issues for each new finding.

## Step 1 — Read project config

Run `bash .darkflow.d/get-config.sh` to pull the latest project settings from the Web UI and refresh the local `.darkflow` cache (silently falls back to cache if the server is unreachable).

Read `.darkflow` in the project root. Extract:
- `language=` → output/issue language (default: English)

If `.darkflow` is missing, continue with the default.

## Step 2 — Fetch vulnerability reports from GitHub

Determine the current repo:

```bash
REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner)
```

Fetch open alerts from all three GitHub vulnerability surfaces. Any of these may return `404` or `403` if the feature is disabled or the token lacks scope — treat those as "no findings from that surface" and continue.

```bash
# Dependabot alerts (dependency vulnerabilities)
gh api -X GET "/repos/${REPO}/dependabot/alerts" \
  -f state=open --paginate 2>/dev/null || echo "[]"

# Code scanning alerts (CodeQL, third-party scanners)
gh api -X GET "/repos/${REPO}/code-scanning/alerts" \
  -f state=open --paginate 2>/dev/null || echo "[]"

# Secret scanning alerts (leaked tokens, keys)
gh api -X GET "/repos/${REPO}/secret-scanning/alerts" \
  -f state=open --paginate 2>/dev/null || echo "[]"
```

## Step 3 — Deduplicate against existing issues

Fetch existing issues created by this routine so you don't re-file the same vulnerability twice:

```bash
gh issue list --label "source:vulnerability-report" --state all \
  --json number,title,body,state --limit 200
```

For each alert, derive a stable identifier:
- Dependabot: `GHSA-xxxx-xxxx-xxxx` from `security_advisory.ghsa_id`, plus the affected package name + version range
- Code scanning: rule ID (`rule.id`) + file path + line number
- Secret scanning: secret type + the locations array (do **not** include the secret value itself)

Skip an alert if any existing issue body already contains that identifier.

## Step 4 — Create one GitHub issue per new finding

**Labels:**
- `status:approved` for `area:deps` (Dependabot version upgrades — auto-approved, see `docs/auto-approve.md`)
- `status:proposed` for `area:code` and `area:secrets` (require human review)
- `source:vulnerability-report`
- Priority from severity:
  - `critical` → `priority:critical`
  - `high`     → `priority:high`
  - `medium`   → `priority:medium`
  - `low`      → **do NOT create an issue** — low-severity findings are skipped (mention them in the run output only)
- Area label:
  - `area:deps` for Dependabot
  - `area:code` for code scanning
  - `area:secrets` for secret scanning

**Title:** action-oriented verb. Examples:
- "Upgrade `lodash` to ≥4.17.21 (GHSA-jf85-cpcp-j695)"
- "Remove leaked Stripe live key from `scripts/seed.ts`"
- "Fix SQL injection in `src/api/users.ts:42` (codeql/js/sql-injection)"

Never just restate the alert ("Vulnerability in X").

**Body (required format):**

```
## Problem
<what the alert reports, why it matters, and the affected file / package / location>

GitHub alert: <html_url from the API response>
Identifier:   <GHSA / rule.id / secret type>
Severity:     <critical | high | medium | low>

## What to do
<concrete remediation — exact package version to upgrade to, code to change, key to rotate>

## Acceptance criteria
- [ ] <verifiable outcome — e.g. "pnpm-lock.yaml lists lodash@4.17.21+">
- [ ] GitHub alert is dismissed or auto-closes after the fix
```

For secret scanning findings, **never** paste the secret value into the issue body. Reference the location only.

## Step 5 — After completing

Save a snapshot the worker can forward to the web UI.

Count the issues you just have open with `source:vulnerability-report`:

```bash
gh issue list --label "source:vulnerability-report" --state open \
  --json number,labels --limit 200
```

- `openIssues` = total
- `criticalOpen` = those with `priority:critical` or `priority:high`
- `status` = `"critical"` if `criticalOpen > 0`, else `"warning"` if `openIssues > 5`, else `"ok"`

Write `.darkflow.d/state/metrics/vulnerabilities.json` (create parent dirs if needed):

```json
{
  "openIssues":   <integer>,
  "criticalOpen": <integer>,
  "status":       "ok" | "warning" | "critical"
}
```

Language for all GitHub issues and console output: the `language=` value from `.darkflow`.
