Get Slack alerts for risky dependencies

from clickruntime import on_trigger, credentials, http, notify, state, ai

def gh(method, path, **kw):
    resp = http.request(method, f"https://api.github.com{path}", headers={
        "Authorization": f"Bearer {credentials.connection('github', 'work')}", "Accept": "application/vnd.github+json"}, **kw)
    return resp.raise_for_status() or (resp.json() if resp.content else None)

ORG, LEVELS = "acme", ("critical", "high")
ORDER = {"critical": 0, "high": 1, "medium": 2, "low": 3}

@on_trigger
def run(event):
    alerts = gh("GET", f"/orgs/{ORG}/dependabot/alerts", params={"state": "open", "severity": ",".join(LEVELS), "per_page": 100})
    seen = set(state.get("seen") or [])
    new = sorted((a for a in alerts if a["html_url"] not in seen), key=lambda a: ORDER[a["security_advisory"]["severity"]])
    if not new:
        return {"new": 0}
    lines = [f"[{a['security_advisory']['severity']}] {a['dependency']['package']['name']} in {a['repository']['name']}: "
             f"{a['security_advisory']['summary']} (fixed in {(a['security_vulnerability'].get('first_patched_version') or {}).get('identifier', 'no fix yet')})"
             for a in new]
    text = f"{len(new)} new dependency alerts\n" + "\n".join(lines)
    try:
        text += "\n\n" + ai.generate("\n".join(lines[:5]), system="In two plain sentences, explain the biggest risk here.", max_output_tokens=120).text
    except (ai.AINotIncluded, ai.AILimitReached):
        pass
    notify.slack(text, channel="#security")
    state.set("seen", sorted(seen | {a["html_url"] for a in new}))
    return {"new": len(new)}