AI Workflow Automation: Eliminating Recurring Manual Tasks
AI Workflow Automation: Eliminating Recurring Manual Tasks
TL;DR: Manual tasks that repeat on a schedule are automation debt. I’ve spent the last several months converting mine into repeatable AI-native workflows. Here’s the pattern I use, a real example with the actual script, and the security controls you need before you put anything like this into production.
There’s a category of work that doesn’t require judgment — it just requires execution. Pull a report, format it, send it to the right place, log the result. In 25 years of enterprise security work, I’ve watched teams spend enormous amounts of time on exactly these tasks. Daily log reviews, access certification reminders, ticket triage, dependency update checks. Work that is clearly defined, clearly repeatable, and clearly automatable.
The honest reason most of it never gets automated: writing a proper script used to take longer than just doing the task. The amortization math rarely worked out. A task that takes 20 minutes a day could take 8 hours to automate properly — that’s 24 days of break-even. Most people don’t bother.
AI workflow automation changes that math. What used to take 8 hours to build now takes 45 minutes. That changes which tasks are worth automating.
Here’s the pattern I’ve developed, and the specific workflow I used to eliminate one of my most persistent manual tasks.
The Recurring Task That Finally Got Automated
Every week I was manually reviewing my GitHub repositories for dependency drift: packages that had fallen behind, security advisories that had landed, version pins that no longer matched what was current. It took about 30–40 minutes per week. Not hard, just tedious — open each repo, check the package files, cross-reference any Dependabot alerts, make a note of what needed updating.
The problem wasn’t the task itself. It was the context-switching cost. By the time I’d loaded everything into working memory, reviewed it, and written down the action items, I’d broken a full hour of focus time.
The automation goal: generate a structured weekly dependency status report across all repos, flag anything with an open security advisory, and drop it into a file I can act on in 5 minutes instead of 40.
The Pattern: Four Steps That Apply to Almost Any Recurring Task
Before I share the specific implementation, here’s the repeatable AI workflow automation pattern I use. It works for anything from report generation to notification routing to access review reminders.
Step 1: Define the exact input and exact output. Don’t start building until you can finish both sentences: “This automation takes [X] as input” and “This automation produces [Y] as output.” Vague definitions produce brittle automations.
For the dependency review: input is the list of GitHub repos and their package manifests. Output is a markdown file with three sections — current, behind, and security advisory flagged.
Step 2: Write the script as if no AI is involved. Identify what the script needs to do: what APIs it calls, what data it reads, what it writes, what credentials it needs. Build the skeleton manually. This is not the step to skip. AI-generated code that you don’t understand is a security liability.
Step 3: Use AI to fill in the logic and clean up the code. Once the skeleton exists, AI assistance is genuinely useful — handling edge cases, formatting output cleanly, writing the error handling you’d otherwise skip. The difference is that you’re directing the AI against a structure you understand, not asking it to produce something opaque.
Step 4: Add observability and access controls before you schedule it. Any automation that runs unattended needs a log, a failure notification, and the minimum permissions required to do its job. This is the step most automations skip and the reason most automations eventually cause incidents.
The Dependency Review Script — Actual Implementation
This runs weekly via a cron job. It uses the GitHub API and the GitHub Advisory Database.
#!/usr/bin/env python3
"""
Weekly dependency status report.
Checks all repos for outdated packages and open security advisories.
Writes output to ~/reports/dependency-status-YYYY-MM-DD.md
Requires: GITHUB_TOKEN env var (read-only, repo scope only)
"""
import os
import json
import datetime
import subprocess
import requests
GITHUB_TOKEN = os.environ.get("GITHUB_TOKEN")
if not GITHUB_TOKEN:
raise EnvironmentError("GITHUB_TOKEN not set. Aborting.")
HEADERS = {
"Authorization": f"Bearer {GITHUB_TOKEN}",
"Accept": "application/vnd.github+json",
}
def get_repos(org_or_user: str) -> list:
url = f"https://api.github.com/users/{org_or_user}/repos?per_page=100"
response = requests.get(url, headers=HEADERS)
response.raise_for_status()
return [r["name"] for r in response.json()]
def get_dependabot_alerts(owner: str, repo: str) -> list:
url = f"https://api.github.com/repos/{owner}/{repo}/dependabot/alerts?state=open"
response = requests.get(url, headers=HEADERS)
if response.status_code == 404:
return [] # Dependabot not enabled on this repo
response.raise_for_status()
return response.json()
def format_report(owner: str, repos: list) -> str:
today = datetime.date.today().isoformat()
lines = [f"# Dependency Status Report — {today}\n"]
flagged = []
clean = []
for repo in repos:
alerts = get_dependabot_alerts(owner, repo)
if alerts:
flagged.append((repo, alerts))
else:
clean.append(repo)
lines.append("## Security Advisories Open\n")
if flagged:
for repo, alerts in flagged:
lines.append(f"### {repo}")
for alert in alerts:
pkg = alert["dependency"]["package"]["name"]
severity = alert["security_advisory"]["severity"].upper()
summary = alert["security_advisory"]["summary"]
lines.append(f"- [{severity}] `{pkg}`: {summary}")
lines.append("")
else:
lines.append("_No open advisories._\n")
lines.append("## Clean Repos\n")
for repo in clean:
lines.append(f"- {repo}")
return "\n".join(lines)
if __name__ == "__main__":
owner = "your-github-username" # Replace before use
repos = get_repos(owner)
report = format_report(owner, repos)
output_dir = os.path.expanduser("~/reports")
os.makedirs(output_dir, exist_ok=True)
filename = f"{output_dir}/dependency-status-{datetime.date.today().isoformat()}.md"
with open(filename, "w") as f:
f.write(report)
print(f"Report written to {filename}")Scheduled via crontab:
0 8 * * 1 /usr/bin/python3 /home/user/scripts/dep-review.py >> /home/user/logs/dep-review.log 2>&1The GitHub token is stored in AWS Secrets Manager and injected at runtime via a wrapper that handles retrieval — it is never in the crontab, never in a dotfile, never in the script itself.
Security Controls for Unattended AI Workflow Automation
This is where most automation guides stop short. An automation running unattended with standing credentials and no logging is a privilege escalation waiting to happen. Here’s the minimum control set I apply to anything running on a schedule.
Least-privilege credentials. The GitHub token this script uses has exactly one permission: read-only access to repository metadata and Dependabot alerts. It cannot push code, cannot modify settings, cannot access private org data beyond what’s needed. Create a dedicated token per automation. Never reuse.
Credential injection at runtime. The token is never stored where the script lives. It’s in AWS Secrets Manager. The wrapper script pulls it at execution time using the instance’s IAM role. If someone reads the crontab or the script file, they get nothing useful.
Execution log with timestamps. Every run appends to a log file. If the script fails, the error goes to the same log. I review it weekly — 30 seconds, just checking that the most recent entry isn’t an error.
Failure alerting. The cron wrapper sends a message to my Telegram bot if the exit code is non-zero. I don’t find out about broken automations by noticing I haven’t seen output recently.
Blast radius review. Before scheduling anything, I ask: what’s the worst this script can do if the credentials are compromised or the logic has a bug? Read-only scripts that write local files have a small blast radius. Scripts that send emails, modify cloud resources, or push to repositories need more scrutiny before they go unattended.
What 30 Hours of Annual Manual Work Looks Like Automated
The dependency review takes me about 5 minutes now instead of 35–40. That’s roughly 25–30 hours a year returned to focused work. More importantly, it runs whether I remember to do it or not, which means nothing slips between busy weeks.
The same pattern — define inputs and outputs, build the skeleton yourself, use AI for logic and cleanup, add observability before scheduling — applies to a wide range of recurring security tasks: access certification reminders, log anomaly summaries, certificate expiration checks, cloud cost anomaly reports.
The prerequisite is clarity about what the task actually is. If you can’t describe the exact input and exact output, the automation will be fragile. If you can, you’re probably 45 minutes from never doing it manually again.
Key Takeaways
- AI workflow automation is economical now. The build time is low enough that tasks taking 20+ minutes per week are worth automating.
- Build the skeleton yourself. AI fills in logic cleanly, but you need to understand the structure before you trust the output.
- Unattended automations need security controls. Least-privilege credentials, runtime injection, execution logging, and failure alerting are not optional for anything running in production.
- Start with read-only. Automations that only read and write local files carry minimal blast radius. That’s the right place to start before you build anything that modifies systems.
- 30 hours a year is real. Even a single 30-minute weekly task, automated reliably, returns meaningful capacity. Multiply that across five tasks.
Comments