Software Supply Chain Security Tooling

Camper, a system for running security campaigns, has been enhanced by migrating its core logic to Temporal Workflows. This provides durability, allowing campaigns to resume after restarts, retry failed API calls, and easily accept new instructions. Camper orchestrates security campaigns by integrating with tools like Jira, GitHub, and Deputy (for automated code transformations) or Codex (for AI-assisted code generation). Campaigns are defined by specifications outlining objectives, scope, and remediation strategies. The system supports manual approval workflows and allows for dynamic updates to campaign scope and targets. Review remains with repository maintainers, with Camper facilitating interactions like rebasing and retrying through GitHub commands. The system has successfully executed campaigns across Temporal repositories and has been used for cross-repository credential migrations.