OSPO Tooling · 15 minutes

Your Open Source Watches Itself

Supply Chain Analysis with Agentic AI on GitHub Actions
A weekly automated check-up for all the open source your product is built on: what is risky, what is legal, what is abandoned, and what to do about it.

github.com/oscarvalenzuelab/agentic-ai-github-actions

The problem

You chose 9 open source components. You got 120.

Every component your team picks brings its own components along. You are responsible for all of them, legally and operationally.
Each one can quietly carry a problem: a security hole, a license you cannot comply with, a maintainer who walked away, or the new one: AI components regulators ask you to declare.
Real example from this project: a component we "fixed" in March had quietly collected 22 new security advisories by July, one of them serious. Nobody was watching.

120

packages in the tree

reviewed by humans

advisories on one "fixed" pin

The gap

Great signals, raw form. An OSPO needs judgment.

Dependabot and Scorecard are excellent signals. This pipeline builds on them and adds the layers an OSPO still has to cover by hand.

What you need to know	Dependabot	Scorecard	This pipeline adds
Known security holes	Yes	Partial	Yes: every component checked
Licenses that conflict with yours	No	No	Yes: checked against a rulebook
Projects quietly being abandoned	No	No	Yes: activity and maintainer health
Where AI is in your software	No	No	Yes: an inventory, automatically
A summary a person can act on	No	No	Yes: one readable weekly report

The approach

Facts from scripts. Words from AI. Decisions from people.

1 · Collect the facts

Plain scripts gather the component list, security advisories, license checks, and the AI inventory. Same inputs, same outputs, every time. Auditable.

2 · Write the summary

An AI reads those facts and writes the weekly assessment: overall risk, what matters most, what to do. It never invents data; it only summarizes what was collected.

3 · Propose the fix

Where a fix exists, an assistant prepares it as a normal code change for your engineers to review. It proposes; people approve.

A compliance report is only defensible if the facts underneath it are collected the same way every time.

Tools & data sources

Seven sources, all open, all free

Dependency graph

GitHub's own inventory of every component in the product, down to exact versions.

OSV.dev

Google's public database of known security problems. Every component is checked against it.

OSPAC ★

An open rulebook for software licenses: what each of 700+ licenses demands, and which combinations conflict.

ai-finder ★

Finds AI models and AI-related components hiding in the code, and produces the AI inventory (AIBOM) regulators ask for.

OpenSSF Scorecard

An industry-standard security report card for the project itself.

GitHub REST metrics

Who maintains each component, how active they are, and how quickly they respond.

GitHub Models

The AI that writes the summary. It runs inside GitHub, so no data leaves for an outside AI vendor.

Agentic Workflows

The framework behind the optional remediation agent, powered by GitHub Copilot.

Spotlight · OSPAC

Is every license actually compatible with yours?

Every open source license is a contract with conditions. OSPAC encodes those conditions (what each license demands and which licenses conflict) as open, versioned data.
Every week, the license of every single component is checked against your project's license. Verdicts, not vibes: compatible, incompatible, or needs legal review.
When a license cannot be identified, it is flagged for a person, never guessed.

120 packages vs Apache-2.0 ------------------------------ MIT 113 compatible ISC 2 compatible BSD-2-Clause 1 compatible BSD-3-Clause 1 compatible unknown 3 review

Real output from a weekly run of this repository.

Spotlight · ai-finder

Could you list every piece of AI in your product today?

Regulation (starting with the EU AI Act) increasingly expects companies to know and declare where AI sits in their products.
ai-finder scans the code and finds it: AI services, AI libraries, and model files, including ones engineers added without telling anyone.
The result is an AI bill of materials (AIBOM) in the standard format auditors ask for, with licenses filled in automatically.

aibom.json · CycloneDX 1.6 ------------------------------ openai@1.40 Apache-2.0 strands-agents@1.0 Apache-2.0 strands-agents-tools Apache-2.0 strands (SDK usage) MIT strands-agent (code) n/a

Detected from the repo's demo agent app: 5 components, licensed and versioned.

How it runs

One weekly workflow, ten steps

Inventory

List every component and its exact version

Vulnerabilities

Check each against the public OSV database

Licenses

Check every license against your project's

AI inventory

Scan the code and build the AIBOM

Maintainers

Who maintains each component, how active

Health scores

Score each component 0-100

AI assessment

The AI reads it all and writes the summary

Fallback

If the AI is unavailable, a simpler summary

Report

Filed as a GitHub issue, where the team works

Publish

Compliance files at permanent links

If any step fails, the rest still run. There is always a report on Monday.

The output

One issue your team actually reads

# Dependency Analysis - 2026-07-19 Overall risk: Medium Critical findings · chalk: no recent activity, possible abandonment · winston: contribution concentration + stale releases Known vulnerabilities None. 117 versions checked. AI components: 5 detected

Plus permanent links for compliance: refreshed weekly, never expire, no login needed.

aibom.json sbom.json license-analysis.json analysis-report.md

Hand these to auditors, customers, or internal dashboards as-is.

.../releases/download/compliance-latest/

Closing the loop · optional add-on

When something is fixable, the fix arrives pre-made

After each weekly report, an AI assistant reads the findings: it updates components with known security fixes and double-checks the result actually improved things.
GitHub Copilot is the engine, running inside GitHub on models from your Copilot plan. No suitable plan? Swap in an LLM provider API key (OpenAI, Anthropic, Gemini) with a two-line change.
It can only do two things: propose one code change and leave one comment. It cannot merge, cannot touch anything else, and license questions go to legal; it never acts on those.

One-time setup (optional) ------------------------------ 1 Fine-grained PAT (resource owner: your personal account) 2 Add permissions → Copilot Requests 3 gh secret set COPILOT_GITHUB_TOKEN ------------------------------ Requires a paid Copilot plan, or an LLM provider API key.

Full steps in the README. Built on GitHub Agentic Workflows.

The report recommends → the assistant proposes → a person approves.

Making it yours

Tuning it does not require an engineer

The questions are plain text

Five ready-made focuses: comprehensive, security, maintainer burnout, community health, license compliance. Editing one is like editing a document; adding a new focus is adding a file.

The AI model is a dropdown

Choose any model from the GitHub Models catalog when running manually. The default is small and free.

Point it at any project

The component list, checks, and reports follow automatically. The weekly schedule is one line to change.

For the OSPO

What you get on Monday morning

A weekly, readable risk summary covering every component, instead of a wall of alerts nobody reads.
Audit-ready compliance files (the component inventory, the AI inventory, the license verdicts) at permanent links, built the same way every week.
Early warnings the standard tools never send: maintainers burning out, projects going quiet, licenses drifting, AI creeping in.
And when something is fixable, the fix is already proposed and waiting for approval.

This project is a functional demo that can be extended. A professional-grade solution requires enterprise data sources and fine-tuned AI agents.

github.com/oscarvalenzuelab/agentic-ai-github-actions · Apache-2.0