Workflow Library
Pre-built workflow templates covering auto-fix, admission gates, self-healing, vendor risk, compliance, and operations. One-click install.
Safeguard ships 50+ production-ready workflow templates. Each one is a complete YAML definition you can install with one click, tweak, and promote to your org. The library is versioned; templates pin to an SDK version so upgrades are safe.
Install from Workflows → Library. There is no CLI command for this yet.
| Template | What it does |
|---|
auto-fix-critical-kev-in-prod | Triggers on any new KEV-listed critical finding on production assets; runs reachability; opens Griffin auto-fix PR |
auto-fix-daily-backlog | Runs nightly against the top-N reachable findings and opens up to N PRs |
auto-fix-transitive-only | Restricted to transitive-dependency upgrades only (safer for stable teams) |
griffin-review-assistant | Griffin comments on open security PRs explaining the change and any remaining risk |
remediate-stale-dependency | Opens PRs for dependencies unchanged > 365 days with any open CVE |
| Template | What it does |
|---|
prod-admission-gate | Blocks admission of pods failing the production policy bundle; pages on-call for critical blocks |
sbom-required-at-admission | Denies admission of images without a valid CycloneDX SBOM attestation ≤ 30 days old |
kev-block-prod | Denies admission of images with KEV-listed unpatched CVEs |
unsigned-image-block | Denies images without a valid Cosign / Notation signature |
runtime-drift-alert | Alerts when a running pod's image digest diverges from its admission-time digest |
| Template | What it does |
|---|
self-heal-base-images | Watches container base images and rebuilds when new CVEs land |
self-heal-gold-substitution | When a Gold equivalent exists, swaps the image automatically |
self-heal-staged-rollout | Canary-based self-heal with automatic rollback on metric regression |
self-heal-ai-model-deps | Self-heal for the AI-side dependency chain (transformers, torch, tokenizers) |
| Template | What it does |
|---|
weekly-sbom-freshness-audit | Audits SBOM freshness across assets, emails owners of stale ones |
shadow-asset-sweep | Finds repos / images / workloads missing ownership and opens tickets |
vendor-sbom-freshness-sla | Reminds vendors whose SBOMs are approaching SLA |
deep-scan-on-push | Runs a full 100-level scan on every push to main |
mono-repo-project-split | Emits per-service SBOMs from a monorepo push |
| Template | What it does |
|---|
zero-day-impact-assessment | On any zero_day.affecting_tenant event, produces an impact report and routes to owner |
zero-day-autofix | For zero-days where a patch exists at publication, auto-opens PRs |
zero-day-comms | Drafts customer / exec comms from a template when a CRITICAL zero-day is published |
| Template | What it does |
|---|
fedramp-continuous-monitoring | Generates the monthly FedRAMP evidence pack |
eo-14028-sbom-validation | Runs SBOM minimum-elements validation; blocks non-compliant releases |
cra-readiness-check | Evaluates each product against CRA essential requirements; opens gaps as tickets |
ssdf-evidence-export | Exports NIST SSDF evidence as OSCAL for auditors |
soc2-change-control | Produces SOC2 change-control artifacts for every production push |
iso-27001-control-rollup | Rolls ISO 27001 Annex A control coverage into a dashboard |
dora-register-of-information | Keeps DORA Register of Information current from TPRM data |
| Template | What it does |
|---|
vendor-sbom-intake | Ingests new vendor SBOMs, evaluates policy, assigns risk score |
vendor-sbom-expiry-reminder | Emails vendors whose SBOMs are stale |
vendor-kev-watchlist | Flags vendors with any component on CISA KEV |
vendor-license-diff | Alerts on vendor SBOM license-set changes |
vendor-offboarding | Revokes access, purges data, archives history |
| Template | What it does |
|---|
secret-verify-and-revoke | On verified-live secret, revokes via issuer API and rotates via secret manager |
secret-history-purge | Walks Git history, opens PR with filter-repo plan |
secret-exposure-dashboard | Maintains the secrets dashboard and weekly digest |
| Template | What it does |
|---|
daily-digest-to-leads | Per-team email digest of open urgent findings and this week's remediations |
slack-triage-bot | #sec-triage bot that claims, escalates, or suppresses findings via slash commands |
pagerduty-p0-bridge | Pages on-call for P0 findings in production |
jira-ticket-sync | Keeps Jira and Safeguard in sync: create / update / transition |
metric-export-otel | Exports Safeguard metrics to your OTLP endpoint |
| Template | What it does |
|---|
ai-bom-generate-on-deploy | Generates AI-BOM on every model push to the registry |
model-weight-verify | Verifies model-weight signatures before deployment |
eagle-pickle-scan | Scans every new model for unsafe pickle opcodes |
training-data-license-check | Validates training data licenses against policy |
Every template is editable after you install it from Workflows → Library. There is no CLI command for installing, editing or enabling workflows yet.
Each template has a version; upgrading pulls the new version but keeps any customizations by three-way merge. Conflicts are flagged in the UI for review before apply.
If you want a template added to the library, open an issue at github.com/safeguard-sh/workflow-library or email workflows@safeguard.sh. Safeguard maintains the library — community templates are reviewed, signed, and published under community/ namespace once approved.
