Add vex-generator agentic workflow

[Copilot]

Dependabot alert dismissals represent implicit security assessments that are currently lost. This workflow captures them as machine-readable OpenVEX v0.2.0 statements, making them consumable by downstream vulnerability scanners and SBOM tools.

Changes

• workflows/vex-generator.md — New workflow_dispatch workflow with 8 inputs (alert number, GHSA/CVE IDs, package, ecosystem, severity, summary, dismissal reason). Maps dismissal reasons to VEX statuses, constructs ecosystem-appropriate purls, generates OpenVEX JSON, and opens a labeled PR. Skips no_bandwidth dismissals (not a genuine security assessment).

  Dismissal	VEX Status	Justification
  not_used	not_affected	vulnerable_code_not_present
  inaccurate	not_affected	vulnerable_code_not_in_execute_path
  tolerable_risk	not_affected	inline_mitigations_already_exist
  no_bandwidth	(skipped)	—

• docs/vex-generator.md — Installation, usage, input reference, and example OpenVEX output.

• README.md — Entry added under Security Workflows.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.62.4
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.62.4 --jq .object.sha (http block)
• https://api.github.com/repos/githubnext/agentics
  • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics --jq .visibility (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Add the vex-generator agentic workflow and docs as documented in github/gh-aw#22017

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.