# GitHub Enterprise

*/Software/GitHub_Enterprise*

## Solution Overview

The agent operates directly inside self-hosted GitHub Enterprise environments to automatically triage issues, backport security patches across legacy release branches, and resolve Dependabot alerts. It generates and submits verified, test-passing pull requests, attaching a localized blast-radius analysis to the description of each proposed code change.

Engineering managers and DevSecOps leads deploy this digital worker to eliminate the persistent backlog of low-severity vulnerabilities and routine dependency updates. Instead of pulling senior developers off core feature work to resolve merge conflicts on minor version bumps, the organization delegates this daily repository maintenance to an asynchronous process.

Functioning as a persistent GitHub App, the agent consumes webhooks from the enterprise repository and internal CI/CD pipelines to monitor build states and trigger remediation workflows. Because automated dependency updates can introduce subtle regressions in legacy systems, a human tech lead retains explicit approval authority, acting as a mandatory checkpoint before the agent executes any final merges into the production branch.

## Headless Saas Data Model

**Entities**:
- Name: RemediationJob · Description: An asynchronous process delegating repository maintenance, backporting, or alert resolution
- Name: Workspace · Description: The tenant installation mapping to a GitHub Enterprise organization
- Name: Repository · Description: A tracked code repository receiving automated maintenance and updates
- Name: SecurityAlert · Description: A Dependabot alert or low-severity vulnerability awaiting resolution
- Name: GeneratedPullRequest · Description: A verified code change submitted by the agent for explicit approval
- Name: BlastRadiusAnalysis · Description: A localized risk assessment attached to the proposed code change
**Relations**:
- To: Workspace · From: Repository · Label: belongs to workspace · Cardinality: one-to-many
- To: Workspace · From: RemediationJob · Label: belongs to workspace · Cardinality: one-to-many
- To: Repository · From: RemediationJob · Label: operates on repository · Cardinality: one-to-many
- To: SecurityAlert · From: RemediationJob · Label: resolves security alert · Cardinality: one-to-many
- To: Repository · From: SecurityAlert · Label: found in repository · Cardinality: one-to-many
- To: RemediationJob · From: GeneratedPullRequest · Label: fulfills job · Cardinality: one-to-one
- To: GeneratedPullRequest · From: BlastRadiusAnalysis · Label: analyzes risk for · Cardinality: one-to-one
**Tenant Anchor**: Workspace
**Primary Resource**: RemediationJob

## Api Definition

**Protocols**:
- REST
- SDK
- MCP
- Webhooks
**Consumed By**:
- [DevSecOps Agent](/Agents/DevSecOps_Agent)
- [Release Management Agent](/Agents/Release_Management_Agent)
- [Vulnerability Triage Agent](/Agents/Vulnerability_Triage_Agent)
**Integrations**:
- [GitHub Enterprise](/Products/GitHub_Enterprise)
- [Dependabot](/Products/Dependabot)
- [GitHub Actions](/Products/GitHub_Actions)
- [Jenkins](/Products/Jenkins)
**Consumption Model**: A vulnerability triage agent provisions the MCP server to trigger backport workflows across legacy branches, then subscribes to the pull_request.generated webhook to notify human reviewers for mandatory approval.
**Workflow Wrappers**:
- Name: Resolve Dependency Alert · Wraps: creates a remediation job, analyzes blast radius, and submits a verified pull request
- Name: Backport Security Patch · Wraps: identifies legacy branches, maps the vulnerability, and generates targeted backport pull requests

## Api Function Cascade

**Ai Role**: Operating as a fully digital headless primitive, the workflow leverages deterministic execution and generative adaptation straight-through to draft and test security backports, stopping at pull request creation where consuming agents handle human approval.
**Cascade**:
- Kind: Code · Note: Queries GitHub Enterprise to identify legacy branches needing the patch. · Step: Discover Target Branches · Verb: discover · Realizes: Identify Software Versions · Oversight: none
- Kind: Generative · Note: Maps the vulnerability impact against branch-specific code drift. · Step: Analyze Vulnerability Context · Verb: analyze · Realizes: Analyze Software Vulnerabilities · Oversight: none
- Kind: Generative · Note: Adapts the original security patch to fit legacy branch structures. · Step: Draft Backport Patch · Verb: draft · Realizes: Develop Software Updates · Oversight: none
- Kind: Code · Note: Triggers GitHub Actions and Jenkins pipelines to test the adaptation. · Step: Verify Patch Integrity · Verb: test · Realizes: Execute Automated Tests · Oversight: none
- Kind: Code · Note: Creates targeted backport pull requests for mandatory approval. · Step: Submit Pull Requests · Verb: submit · Realizes: Manage Version Control · Oversight: none
- Kind: Code · Note: Emits webhook events to notify consuming triage agents. · Step: Emit Completion Webhook · Verb: notify · Realizes: Dispatch System Notifications · Oversight: none
**Optimizes**:
- [Mean Time to Remediation](/Metrics/Mean_Time_to_Remediation)
- [Backport Success Rate](/Metrics/Backport_Success_Rate)
- [First-Pass Build Yield](/Metrics/First-Pass_Build_Yield)
- [Vulnerability Exposure Window](/Metrics/Vulnerability_Exposure_Window)

## Headless Saas Representative Offer

**Warranty**: Maintains a 99.9% API uptime SLA with service credits issued for degraded availability, plus automatic workflow suspension if error rates exceed defined thresholds.
**Price Band**: ~$0.10 to $1.50 per triggered vulnerability remediation or backport workflow, depending on blast radius complexity
**Pricing Kind**: UsageMeter
**Deliverables**:
- Access to the core REST API and MCP server endpoints
- Execution of automated 'Resolve Dependency Alert' remediation jobs
- Generation of targeted 'Backport Security Patch' pull requests
- Real-time state change subscriptions via webhooks
**Delivery Mode**: Instant-provision API and MCP access where an agent authenticates via self-serve credentials and consumption is metered per automated workflow execution.
**Business Function**: ProvideService
**Agent Checkout Support**:
- agentic-commerce-protocol
- stored-credential

## Headless Saas Crud Surface

**Auth Model**: Service Account
**Endpoints**:
- GET /remediation-jobs — list remediation jobs
- GET /remediation-jobs/{id} — fetch a specific remediation job
- POST /remediation-jobs — create a new remediation job
- PATCH /remediation-jobs/{id} — update a remediation job
- POST /remediation-jobs/{id}/execute — execute the asynchronous remediation process
- GET /remediation-jobs/{id}/generated-pull-request — fetch the pull request generated to fulfill this job
- GET /workspaces — list tenant installations
- GET /workspaces/{id} — fetch a specific workspace
- POST /workspaces — provision a new workspace
- PATCH /workspaces/{id} — update workspace configuration
- GET /workspaces/{id}/repositories — list repositories belonging to this workspace
- GET /workspaces/{id}/remediation-jobs — list remediation jobs scoped to this workspace
- GET /repositories — list tracked repositories
- GET /repositories/{id} — fetch a specific repository
- POST /repositories — register a new repository for automated maintenance
- PATCH /repositories/{id} — update repository settings
- GET /repositories/{id}/security-alerts — list security alerts found in this repository
- GET /repositories/{id}/remediation-jobs — list remediation jobs operating on this repository
- GET /security-alerts — list security alerts
- GET /security-alerts/{id} — fetch a specific security alert
- POST /security-alerts — ingest a new security vulnerability alert
- PATCH /security-alerts/{id} — update the status or severity of a security alert
- GET /security-alerts/{id}/remediation-jobs — list remediation jobs attempting to resolve this alert
- GET /generated-pull-requests — list generated pull requests
- GET /generated-pull-requests/{id} — fetch a specific generated pull request
- POST /generated-pull-requests — submit a verified code change for explicit approval
- PATCH /generated-pull-requests/{id} — update a generated pull request
- POST /generated-pull-requests/{id}/merge — merge the approved code change into the target branch
- GET /generated-pull-requests/{id}/blast-radius-analysis — fetch the risk assessment attached to this pull request
- GET /blast-radius-analyses — list blast radius risk assessments
- GET /blast-radius-analyses/{id} — fetch a specific blast radius analysis
- POST /blast-radius-analyses — create a localized risk assessment
- PATCH /blast-radius-analyses/{id} — update a risk assessment score or summary
**Multitenancy**: Row-level isolation
**Webhook Events**:
- remediation_job.started
- remediation_job.completed
- generated_pull_request.submitted
- blast_radius_analysis.completed

## Headless Saas Erd

```mermaid
erDiagram
    Workspace {
        UUID id PK "tenant key"
        VARCHAR githubEnterpriseUrl
        VARCHAR name
        BOOLEAN isActive
    }
    RemediationJob {
        UUID id PK
        UUID workspaceId FK
        UUID repositoryId FK
        UUID securityAlertId FK
        VARCHAR jobType
        VARCHAR status
    }
    Repository {
        UUID id PK
        UUID workspaceId FK
        VARCHAR githubIdentifier
        VARCHAR defaultBranch
        BOOLEAN enforceHumanApproval
    }
    SecurityAlert {
        UUID id PK
        UUID repositoryId FK
        VARCHAR dependencyName
        VARCHAR severity
        VARCHAR status
    }
    GeneratedPullRequest {
        UUID id PK
        UUID remediationJobId FK
        DECIMAL prNumber
        VARCHAR targetBranch
        VARCHAR mergeState
    }
    BlastRadiusAnalysis {
        UUID id PK
        UUID generatedPullRequestId FK
        DECIMAL riskScore
        JSONB impactedComponents
        TEXT summary
    }
    Repository }o--|| Workspace : "belongs to workspace"
    RemediationJob }o--|| Workspace : "belongs to workspace"
    RemediationJob }o--|| Repository : "operates on repository"
    RemediationJob }o--|| SecurityAlert : "resolves security alert"
    SecurityAlert }o--|| Repository : "found in repository"
    GeneratedPullRequest ||--|| RemediationJob : "fulfills job"
    BlastRadiusAnalysis ||--|| GeneratedPullRequest : "analyzes risk for"
```

## Neighborhood

### What it uses

- [Atlassian JIRA](/Products/Atlassian_JIRA) — uses · Products
- [GitHub Actions](/Products/GitHub_Actions) — uses · Products
- [Dependabot](/Products/Dependabot) — uses · Products
- [Jenkins](/Software/Jenkins) — uses · Software
- [GitHub Enterprise](/Products/GitHub_Enterprise) — uses · Products
- [Jama Connect](/Products/Jama_Connect) — uses · Products
- [Workday](/Software/Workday) — uses · Software
- [Amazon Web Services](/Products/Amazon_Web_Services) — uses · Products
- [NetSuite](/Software/NetSuite) — uses · Software
- [Oracle NetSuite](/Products/Oracle_NetSuite) — uses · Products
- [ADP Workforce Now](/Products/ADP_Workforce_Now) — uses · Products

### Optimizes

- [First-Pass Build Yield](/Metrics/First-Pass_Build_Yield) — optimizes · Metrics
- [Mean Time to Remediation](/Metrics/Mean_Time_to_Remediation) — optimizes · Metrics
- [Backport Success Rate](/Metrics/Backport_Success_Rate) — optimizes · Metrics
- [Vulnerability Exposure Window](/Metrics/Vulnerability_Exposure_Window) — optimizes · Metrics
- [Orphaned Commit Ratio](/Metrics/Orphaned_Commit_Ratio) — optimizes · Metrics
- [Requirements Traceability Index](/Metrics/Requirements_Traceability_Index) — optimizes · Metrics
- [Pipeline Gating Latency](/Metrics/Pipeline_Gating_Latency) — optimizes · Metrics
- [Semantic Link Match Confidence](/Metrics/Semantic_Link_Match_Confidence) — optimizes · Metrics
- [Engineering Churn Rate](/Metrics/Engineering_Churn_Rate) — optimizes · Metrics
- [Development Cost Per Product](/Metrics/Development_Cost_Per_Product) — optimizes · Metrics
- [Capitalization Accuracy Rate](/Metrics/Capitalization_Accuracy_Rate) — optimizes · Metrics
- [Administrative Overhead Time](/Metrics/Administrative_Overhead_Time) — optimizes · Metrics
- [OpEx Overstatement Rate](/Metrics/OpEx_Overstatement_Rate) — optimizes · Metrics
- [Capitalized Research Ratio](/Metrics/Capitalized_Research_Ratio) — optimizes · Metrics
- [Timesheet Reconciliation Time](/Metrics/Timesheet_Reconciliation_Time) — optimizes · Metrics

### Who consumes this

- [Vulnerability Triage Agent](/Agents/Vulnerability_Triage_Agent) — consumed by · Agents
- [DevSecOps Agent](/Agents/DevSecOps_Agent) — consumed by · Agents
- [Release Management Agent](/Agents/Release_Management_Agent) — consumed by · Agents
- [Certification Audit Agent](/Agents/Certification_Audit_Agent) — consumed by · Agents
- [Compliance Review Agent](/Agents/Compliance_Review_Agent) — consumed by · Agents
- [Deployment Gating Agent](/Agents/Deployment_Gating_Agent) — consumed by · Agents
- [Corporate Controller Agent](/Agents/Corporate_Controller_Agent) — consumed by · Agents
- [FinOps Reporting Agent](/Agents/FinOps_Reporting_Agent) — consumed by · Agents
- [Tax Substantiation Agent](/Agents/Tax_Substantiation_Agent) — consumed by · Agents
- [Capitalization Audit Agent](/Agents/Capitalization_Audit_Agent) — consumed by · Agents
- [R&D FinOps Agent](/Agents/R&D_FinOps_Agent) — consumed by · Agents

### Similar Agents

- [Technical Debt Agent](/Agents/Technical_Debt_Agent) — similar · Agents
- [Merge Sentinel](/Agents/Merge_Sentinel) — similar · Agents
- [Deployment Gatekeeper Agent](/Agents/Deployment_Gatekeeper_Agent) — similar · Agents
- [Release Gating Agent](/Agents/Release_Gating_Agent) — similar · Agents
- [Autonomous Defect Triage Agent](/Agents/Autonomous_Defect_Triage_Agent) — similar · Agents
- [Release Approval Agent](/Agents/Release_Approval_Agent) — similar · Agents

### Similar Software

- [GitHub](/Competitors/Jira_Software/Software/GitHub) — similar · Software
- [GitHub](/Competitors/Datafold/Software/GitHub) — similar · Software
- [Slack](/Competitors/Jira_Software/Software/Slack) — similar · Software
- [Pluralsight Flow](/Software/Pluralsight_Flow) — similar · Software
- [Application Lifecycle Management](/Software/Application_Lifecycle_Management) — similar · Software
- [GitLab](/Competitors/Jira_Software/Software/GitLab) — similar · Software
- [Atlassian Jira](/Software/Atlassian_Jira) — similar · Software
- [IT Service Management Platforms](/Metrics/Number_of_unplanned_outages_per_critical_application_not_hosted_in_cloud/Software/IT_Service_Management_Platforms) — similar · Software

### Similar Startups

- [Figis](/Occupations/Software_Developers/Problems/Software_Vulnerability_Remediation/Startups/Figis) — similar · Startups
- [Astralpatch](/Startups/Astralpatch) — similar · Startups
- [Abhor](/Startups/Abhor) — similar · Startups

### Similar Channels

- [GitHub repositories](/Channels/GitHub_repositories) — similar · Channels

### Similar Customers

- [Enterprise IT Departments](/Products/GitHub/Customers/Enterprise_IT_Departments) — similar · Customers

### Similar Competitors

- [Dependabot](/Competitors/Dependabot) — similar · Competitors