How we made vulnerability fixes review-ready with Agentic Pipelines
Atlassian automated routine vulnerability fixes using agentic pipelines to reduce interruptions, with 120+ vulnerabilities resolved and 95% of pull requests merged without rework in three months.
Routine vulnerability fixes often create workflow interruptions despite being straightforward tasks. Atlassian addressed this by automating the process using agentic pipelines, which handle ticket tracing, dependency updates, file regeneration, testing, and pull request creation. The system starts with Jira Automation scheduling the work, while a dispatcher identifies eligible tickets and groups related ones. Agentic Pipelines then executes the coding agent within the repository’s build environment, applying changes and running checks before opening a pull request for engineer review.
The coding agent follows codebase-specific instructions stored alongside the repository, applying version bumps, dependency upgrades, or platform-managed package flags as needed. It regenerates generated files, runs the full build and test suite, and stops if checks fail or the fix deviates from encoded patterns. If successful, the agent creates a branch and opens a pull request, with the pipeline definition, prompt, and reusable skill versioned in the repository. The agent operates within the same delivery system as the build, using only the necessary Bitbucket permissions for that step.
After deployment, the closer verifies that the pull request was merged and the deployed build contains the expected commit before transitioning the ticket for scanner verification. The closer can run repeatedly without duplicating actions, ensuring the ticket remains open if evidence is incomplete. This automation streamlines the entire process from investigation to implementation, testing, and ticket updates, leaving engineers to focus on reviewing and approving changes.
The initial system evolved through real-world runs, with reliability improving by treating prompts and skills as production assets. Atlassian emphasized making instructions specific to the codebase, storing dependency patterns, file locations, build commands, and known exceptions to avoid generic fixes. The result was a workflow where engineering judgment is reserved for critical decisions, while routine tasks are handled efficiently by the agentic pipelines.