Open Jira tickets for exploited vulnerabilities in your dependencies

from clickruntime import on_trigger, credentials, http, state

def gh(method, path, **kw):
    resp = http.request(method, f"https://api.github.com{path}", headers={
        "Authorization": f"Bearer {credentials.connection('github', 'work')}", "Accept": "application/vnd.github+json"}, **kw)
    return resp.raise_for_status() or (resp.json() if resp.content else None)
JIRA = "https://api.atlassian.com/ex/jira/your-cloud-id"

def jira(method, path, **kw):
    resp = http.request(method, JIRA + path, headers={"Authorization": f"Bearer {credentials.connection('jira', 'work')}", "Accept": "application/json"}, **kw)
    return resp.raise_for_status() or (resp.json() if resp.content else None)

def adf(text):
    return {"type": "doc", "version": 1, "content": [{"type": "paragraph", "content": [{"type": "text", "text": text}]}]}

REPOS, PROJECT = ["acme/app", "acme/api"], "SEC"

@on_trigger
def run(event):
    seen, created = set(state.get("ticketed") or []), []
    for repo in REPOS:
        pkgs = gh("GET", f"/repos/{repo}/dependency-graph/sbom")["sbom"]["packages"]
        purls = [r["referenceLocator"] for p in pkgs for r in p.get("externalRefs", []) if r["referenceType"] == "purl" and "@" in r["referenceLocator"]]
        results = http.post("https://api.osv.dev/v1/querybatch", json={"queries": [{"package": {"purl": u}} for u in purls[:1000]]}).json()["results"]
        for purl, res in zip(purls, results):
            for v in res.get("vulns", []):
                key = f"{repo}|{purl}|{v['id']}"
                if key in seen:
                    continue
                t = jira("POST", "/rest/api/3/issue", json={"fields": {"project": {"key": PROJECT}, "issuetype": {"name": "Task"},
                         "summary": f"{v['id']} in {purl.split('/')[-1]} ({repo})"[:250], "labels": ["dependency-vuln"],
                         "description": adf(f"Repository: {repo}\nPackage: {purl}\nAdvisory: https://osv.dev/vulnerability/{v['id']}")}})
                seen.add(key)
                created.append(t["key"])
    state.set("ticketed", sorted(seen))
    return {"created": created}