feat: multi-channel drift alerts (GitHub issues) + cross-package drift digest

Two extensions that span Application/Infrastructure/Presentation without touching Domain.

- GitHub-issue channel (Infrastructure): GitHubIssueDriftNotifier implements the existing
  IDriftNotifier port and opens an issue via POST /repos/{owner}/{repo}/issues; title/body
  from a pure DriftIssue formatter (Application).
- Fan-out, not a switch (Infrastructure): CompositeDriftNotifier composes ALL configured
  channels; AddInfrastructure builds the list from Alerts:SlackWebhookUrl + Alerts:GitHubRepo
  (NullDriftNotifier when none). Adding a channel is one class + one registration —
  RunScanHandler is unchanged. Hosts pass Alerts:GitHubRepo.
- Drift digest (Application + Presentation): DriftDigestBuilder + GetDriftDigestQuery render
  one Markdown report of drift across every tracked root (reusing GetTrackedRootsAsync +
  DriftAnalyzer); served at GET /api/drift/digest. No new persistence.
- Tests (81 green): DriftDigestBuilder + DriftIssue unit tests; an integration test for the
  digest over real Postgres. ADR 0012, README (features, multi-channel config, digest curl).
  Verified live: digest renders the full drift report for a seeded baseline.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: AdrianDeutsch

README.md

@@ -70,7 +70,10 @@ has: **"Is this upgrade worth it — and how risky is it?"**
 - 📈 **Drift over time** — every scan is snapshotted, so the dashboard shows what *rotted
   since you last looked*: a dependency that newly became vulnerable, deprecated or archived.
 - 🔔 **Autonomous monitoring** — an opt-in watchlist re-scans tracked packages on a schedule
-  and **alerts a Slack webhook** the moment a new high-severity CVE (or deprecation) lands.
+  and, the moment a new high-severity CVE (or deprecation) lands, **alerts Slack and/or opens
+  a GitHub issue** (pluggable, multi-channel).
+- 📰 **Drift digest** — a single Markdown report of what changed across *every* tracked
+  package since the last scan (a daily summary you can pipe anywhere).
 - 🏷️ **Health badge** — a shields-style `badge.svg` per package to drop into any README.
 - 🧰 **CLI / CI gate** — `depradar scan` as a `dotnet tool` runs the **whole analysis
   standalone** (no server, no database) and **fails the build** on policy violations.
@@ -215,6 +218,9 @@ curl http://localhost:<api-port>/api/packages/WindowsAzure.Storage/drift
 
 # A shields-style health badge (embed in a README)
 curl http://localhost:<api-port>/api/packages/Serilog.Sinks.Console/badge.svg
+
+# A Markdown drift digest across every tracked package
+curl http://localhost:<api-port>/api/drift/digest
 ```
 
 ### Health badge
@@ -232,12 +238,16 @@ Set two config values and DepRadar watches your dependencies for you:
 ```jsonc
 // appsettings / environment / Aspire parameters
 "Watch": { "IntervalHours": 24 },                 // re-scan every tracked package daily
-"Alerts": { "SlackWebhookUrl": "https://hooks.slack.com/services/…" }
+"Alerts": {
+  "SlackWebhookUrl": "https://hooks.slack.com/services/…",  // optional channel
+  "GitHubRepo": "owner/name"                                // optional channel (uses GitHub:Token)
+}
 ```
 
 The worker re-scans every previously-scanned package on the interval; when a re-scan
-introduces a **new high-severity** issue (CVE, deprecation, archival) it posts a drift
-alert to the Slack webhook. Both are off by default — no webhook, no schedule, no noise.
+introduces a **new high-severity** issue (CVE, deprecation, archival) it fans the alert out
+to **every configured channel** — Slack, a GitHub issue, or both. Everything is off by
+default: no webhook, no repo, no schedule, no noise.
 
 ### CLI — scan and gate a build, with no server or database
 
@@ -377,6 +387,9 @@ dotnet test           # unit + architecture + integration (needs Docker)
 - [x] **Autonomous monitoring:** bounded snapshot retention, an opt-in **watchlist** that
       re-scans on a schedule, **Slack drift alerts** on new high-severity issues, and a
       shields-style **health badge** ([ADR 0011]).
+- [x] **Multi-channel alerts & digest:** a pluggable notifier that also **opens GitHub
+      issues** (fan-out to every configured channel), and a Markdown **drift digest**
+      across all tracked packages ([ADR 0012]).
 
 ## License & credits
 
@@ -393,3 +406,4 @@ Data sources: [NuGet V3 API](https://api.nuget.org/v3/index.json) ·
 [ADR 0009]: docs/adr/0009-stateless-analysis-cli-and-policy.md
 [ADR 0010]: docs/adr/0010-scan-history-and-drift.md
 [ADR 0011]: docs/adr/0011-autonomous-monitoring-and-badge.md
+[ADR 0012]: docs/adr/0012-multi-channel-alerts-and-digest.md

docs/adr/0012-multi-channel-alerts-and-digest.md

@@ -0,0 +1,45 @@
+# ADR 0012 — Multi-channel drift alerts & digest
+
+- Status: Accepted
+- Date: 2026-06-26
+- Deciders: Architecture
+
+## Context
+
+Drift alerts ([ADR 0011]) shipped with one channel (Slack). Teams triage in different
+places — some want a **GitHub issue** instead of (or alongside) a Slack ping. And beyond
+event-by-event alerts, a periodic **digest** ("everything that changed across all my
+packages") is its own useful artifact. Both were asked for; both should fit the existing
+seams without reshaping the domain — a good test of the architecture's extensibility.
+
+This is also the answer to "can we keep extending the Application, Infrastructure and
+Presentation layers?": yes — each addition lands cleanly in one or more of them while the
+Domain (the risk + drift model) stays untouched.
+
+## Decision
+
+- **A GitHub-issue channel** (`GitHubIssueDriftNotifier`, **Infrastructure**) implements
+  the existing `IDriftNotifier` port and opens an issue via the REST API
+  (`POST /repos/{owner}/{repo}/issues`). Issue title/body come from a pure `DriftIssue`
+  formatter (**Application**), so wording is unit-tested without the HTTP client.
+- **Fan-out, not a switch** (`CompositeDriftNotifier`, **Infrastructure**): the registered
+  `IDriftNotifier` is composed from *all* configured channels. `AddInfrastructure` builds
+  the list from config (`Alerts:SlackWebhookUrl`, `Alerts:GitHubRepo`) and falls back to
+  the no-op notifier when none are set. Adding a third channel later is one class + one
+  registration — `RunScanHandler` never changes.
+- **Drift digest** (`DriftDigestBuilder` + `GetDriftDigestQuery/Handler`, **Application**):
+  computes drift for every tracked root (reusing `GetTrackedRootsAsync` and the
+  `DriftAnalyzer`) and renders one Markdown report, served at `GET /api/drift/digest`
+  (**Presentation**). No new persistence — it composes parts that already exist.
+
+## Consequences
+
+- The notification side is now genuinely pluggable; channels are independent and
+  best-effort (one flaky channel never blocks the others, and never fails a scan).
+- Each feature demonstrably spans the layers it should and **adds nothing to the Domain**,
+  which is the point of the dependency-inversion boundaries.
+- GitHub issues are created per drift (no de-dup/labels yet); with the opt-in, interval-
+  bounded watchlist that is at most one issue per package per interval — refinement
+  (find-or-update an open issue) is noted as a follow-up.
+
+[ADR 0011]: 0011-autonomous-monitoring-and-badge.md

src/DepRadar.Api/Endpoints/DriftEndpoints.cs

@@ -0,0 +1,26 @@
+using DepRadar.Application.History;
+using DepRadar.Application.Messaging;
+
+namespace DepRadar.Api.Endpoints;
+
+/// <summary>Cross-package drift endpoints (not scoped to a single package id).</summary>
+internal static class DriftEndpoints
+{
+    /// <summary>Registers the <c>/api/drift</c> endpoint group.</summary>
+    public static IEndpointRouteBuilder MapDriftEndpoints(this IEndpointRouteBuilder app)
+    {
+        app.MapGet("/api/drift/digest", GetDigestAsync)
+            .WithTags("Drift")
+            .WithName("GetDriftDigest")
+            .WithSummary("A Markdown digest of what changed across every tracked package since the previous scan.")
+            .Produces(StatusCodes.Status200OK, contentType: "text/markdown");
+
+        return app;
+    }
+
+    private static async Task<IResult> GetDigestAsync(ISender sender, CancellationToken cancellationToken)
+    {
+        var markdown = await sender.Send(new GetDriftDigestQuery(), cancellationToken);
+        return Results.Text(markdown, "text/markdown");
+    }
+}

src/DepRadar.Api/Program.cs

@@ -30,7 +30,8 @@
     builder.Configuration["Anthropic:ApiKey"],
     builder.Configuration["Anthropic:Model"],
     builder.Configuration["GitHub:Token"],
-    builder.Configuration["Alerts:SlackWebhookUrl"]);
+    builder.Configuration["Alerts:SlackWebhookUrl"],
+    builder.Configuration["Alerts:GitHubRepo"]);
 
 builder.Services.AddOpenApi();
 builder.Services.AddProblemDetails();
@@ -69,6 +70,7 @@
 app.MapPackageEndpoints();
 app.MapScanEndpoints();
 app.MapProjectEndpoints();
+app.MapDriftEndpoints();
 app.MapHub<ScanHub>("/hubs/scan");
 
 await app.RunAsync();

src/DepRadar.Application/History/DriftDigestBuilder.cs

@@ -0,0 +1,57 @@
+using System.Globalization;
+using System.Text;
+using DepRadar.Domain.History;
+
+namespace DepRadar.Application.History;
+
+/// <summary>
+/// Renders a Markdown drift digest across every tracked package — a single, shareable
+/// "what changed in my dependencies" report (e.g. a daily summary).
+/// </summary>
+public static class DriftDigestBuilder
+{
+    /// <summary>Builds the digest from per-root drift reports, taken at <paramref name="generatedAt"/>.</summary>
+    public static string Render(IReadOnlyList<DriftReport> reports, DateTimeOffset generatedAt)
+    {
+        var withDrift = reports
+            .Where(r => r.Events.Count > 0)
+            .OrderBy(r => r.NetHealthDelta) // worst (most negative) first
+            .ToList();
+
+        var builder = new StringBuilder();
+        builder.AppendLine("# DepRadar drift digest").AppendLine();
+        builder.Append("_Generated ")
+            .Append(generatedAt.ToString("yyyy-MM-dd HH:mm 'UTC'", CultureInfo.InvariantCulture))
+            .Append(" · ")
+            .Append(reports.Count.ToString(CultureInfo.InvariantCulture))
+            .AppendLine(" package(s) tracked_").AppendLine();
+
+        if (withDrift.Count == 0)
+        {
+            builder.AppendLine("No drift detected since the previous scan. :tada:");
+            return builder.ToString();
+        }
+
+        foreach (var report in withDrift)
+        {
+            var delta = report.NetHealthDelta.ToString("+0;-0;0", CultureInfo.InvariantCulture);
+            builder.Append("## ").Append(report.Root.Value).Append(" (net health ").Append(delta).AppendLine(")").AppendLine();
+
+            foreach (var change in report.Events)
+            {
+                builder.Append("- **").Append(change.Package).Append("** ")
+                    .Append(change.Kind).Append(": ").AppendLine(change.Detail);
+            }
+
+            builder.AppendLine();
+        }
+
+        var unchanged = reports.Count - withDrift.Count;
+        if (unchanged > 0)
+        {
+            builder.Append('_').Append(unchanged.ToString(CultureInfo.InvariantCulture)).AppendLine(" package(s) unchanged._");
+        }
+
+        return builder.ToString();
+    }
+}

src/DepRadar.Application/History/DriftIssue.cs

@@ -0,0 +1,37 @@
+using System.Globalization;
+using System.Text;
+using DepRadar.Domain.History;
+
+namespace DepRadar.Application.History;
+
+/// <summary>
+/// Formats an actionable drift report into a GitHub issue (title + Markdown body).
+/// Pure, so the wording is testable independently of the GitHub client.
+/// </summary>
+public static class DriftIssue
+{
+    /// <summary>The issue title.</summary>
+    public static string Title(DriftReport report) =>
+        string.Create(
+            CultureInfo.InvariantCulture,
+            $"DepRadar: drift in {report.Root.Value} ({DriftAlert.Actionable(report).Count} new high-severity issue(s))");
+
+    /// <summary>The issue body in GitHub-flavored Markdown.</summary>
+    public static string Body(DriftReport report)
+    {
+        var delta = report.NetHealthDelta.ToString("+0;-0;0", CultureInfo.InvariantCulture);
+
+        var builder = new StringBuilder();
+        builder.Append("DepRadar detected drift in `").Append(report.Root.Value)
+            .Append("` since the previous scan (net health ").Append(delta).AppendLine(").").AppendLine();
+        builder.AppendLine("**New high-severity issues:**").AppendLine();
+
+        foreach (var change in DriftAlert.Actionable(report))
+        {
+            builder.Append("- **").Append(change.Package).Append("** — ").AppendLine(change.Detail);
+        }
+
+        builder.AppendLine().AppendLine("_Reported automatically by DepRadar._");
+        return builder.ToString();
+    }
+}

src/DepRadar.Application/History/GetDriftDigestHandler.cs

@@ -0,0 +1,31 @@
+using DepRadar.Application.Abstractions;
+using DepRadar.Application.Messaging;
+using DepRadar.Domain.History;
+
+namespace DepRadar.Application.History;
+
+/// <summary>
+/// Handles <see cref="GetDriftDigestQuery"/>: computes drift for every tracked root and
+/// renders the combined Markdown digest.
+/// </summary>
+public sealed class GetDriftDigestHandler(IScanSnapshotRepository snapshots, TimeProvider timeProvider)
+    : IRequestHandler<GetDriftDigestQuery, string>
+{
+    /// <inheritdoc />
+    public async Task<string> Handle(GetDriftDigestQuery request, CancellationToken cancellationToken)
+    {
+        var roots = await snapshots.GetTrackedRootsAsync(cancellationToken);
+
+        var reports = new List<DriftReport>();
+        foreach (var root in roots)
+        {
+            var recent = await snapshots.GetRecentAsync(root, 2, cancellationToken);
+            if (recent.Count == 2)
+            {
+                reports.Add(DriftAnalyzer.Compare(recent[1], recent[0]));
+            }
+        }
+
+        return DriftDigestBuilder.Render(reports, timeProvider.GetUtcNow());
+    }
+}

src/DepRadar.Application/History/GetDriftDigestQuery.cs

@@ -0,0 +1,9 @@
+using DepRadar.Application.Messaging;
+
+namespace DepRadar.Application.History;
+
+/// <summary>
+/// Query: a Markdown drift digest across every tracked package (those with at least
+/// two scans). Always returns Markdown — an empty digest when nothing has drifted.
+/// </summary>
+public sealed record GetDriftDigestQuery : IRequest<string>;

src/DepRadar.Infrastructure/DependencyInjection.cs

@@ -40,6 +40,7 @@ public static class DependencyInjection
     /// <param name="anthropicModel">Anthropic model id (defaults to a current Claude model).</param>
     /// <param name="gitHubToken">GitHub token (optional) to raise the repo-health API rate limit.</param>
     /// <param name="slackWebhookUrl">Slack incoming-webhook URL (optional) for drift alerts.</param>
+    /// <param name="gitHubAlertRepo">GitHub <c>owner/name</c> (optional) to open drift-alert issues in.</param>
     public static IServiceCollection AddInfrastructure(
         this IServiceCollection services,
         string? depsDevBaseUrl = null,
@@ -48,7 +49,8 @@ public static IServiceCollection AddInfrastructure(
         string? anthropicApiKey = null,
         string? anthropicModel = null,
         string? gitHubToken = null,
-        string? slackWebhookUrl = null)
+        string? slackWebhookUrl = null,
+        string? gitHubAlertRepo = null)
     {
         // Caches external API responses (NuGet/OSV/deps.dev) so repeated scans don't
         // burn quota; an idempotent re-scan hits the cache, not the network.
@@ -67,7 +69,7 @@ public static IServiceCollection AddInfrastructure(
         services.AddScoped<IUnitOfWork>(provider => provider.GetRequiredService<DepRadarDbContext>());
 
         AddLanguageModel(services, anthropicApiKey, anthropicModel);
-        AddDriftNotifier(services, slackWebhookUrl);
+        AddDriftNotifier(services, slackWebhookUrl, gitHubToken, gitHubAlertRepo);
 
         services.AddHttpClient<IPackageMetadataSource, DepsDevPackageMetadataSource>(client =>
             {
@@ -129,17 +131,58 @@ public static IServiceCollection AddDepRadarDbContext(this IServiceCollection se
 
     // Wires Claude when an API key is present; otherwise a null model so the upgrade
     // advisor falls back to a deterministic templated narrative (works keyless).
-    /// <summary>Wires the Slack drift webhook when configured, else a no-op notifier.</summary>
-    private static void AddDriftNotifier(IServiceCollection services, string? slackWebhookUrl)
+    /// <summary>
+    /// Composes the configured drift channels (Slack webhook, GitHub issues). With none
+    /// configured it falls back to a no-op notifier — alerting stays opt-in.
+    /// </summary>
+    private static void AddDriftNotifier(IServiceCollection services, string? slackWebhookUrl, string? gitHubToken, string? gitHubAlertRepo)
     {
-        if (string.IsNullOrWhiteSpace(slackWebhookUrl))
+        var hasSlack = !string.IsNullOrWhiteSpace(slackWebhookUrl);
+        var hasGitHub = !string.IsNullOrWhiteSpace(gitHubAlertRepo);
+
+        if (hasSlack)
         {
-            services.AddScoped<IDriftNotifier, NullDriftNotifier>();
-            return;
+            services.AddHttpClient<SlackDriftNotifier>(client => client.BaseAddress = new Uri(slackWebhookUrl!))
+                .AddStandardResilienceHandler();
         }
 
-        services.AddHttpClient<IDriftNotifier, SlackDriftNotifier>(client => client.BaseAddress = new Uri(slackWebhookUrl))
-            .AddStandardResilienceHandler();
+        if (hasGitHub)
+        {
+            services.AddSingleton(new GitHubAlertOptions(gitHubAlertRepo!));
+            services.AddHttpClient<GitHubIssueDriftNotifier>(client =>
+                {
+                    client.BaseAddress = new Uri("https://api.github.com/");
+                    client.DefaultRequestHeaders.UserAgent.ParseAdd("DepRadar");
+                    client.DefaultRequestHeaders.Accept.ParseAdd("application/vnd.github+json");
+                    client.DefaultRequestHeaders.Add("X-GitHub-Api-Version", "2022-11-28");
+                    if (!string.IsNullOrWhiteSpace(gitHubToken))
+                    {
+                        client.DefaultRequestHeaders.Authorization = new("Bearer", gitHubToken);
+                    }
+                })
+                .AddStandardResilienceHandler();
+        }
+
+        services.AddScoped<IDriftNotifier>(provider =>
+        {
+            var channels = new List<IDriftNotifier>();
+            if (hasSlack)
+            {
+                channels.Add(provider.GetRequiredService<SlackDriftNotifier>());
+            }
+
+            if (hasGitHub)
+            {
+                channels.Add(provider.GetRequiredService<GitHubIssueDriftNotifier>());
+            }
+
+            return channels.Count switch
+            {
+                0 => new NullDriftNotifier(),
+                1 => channels[0],
+                _ => new CompositeDriftNotifier(channels),
+            };
+        });
     }
 
     private static void AddLanguageModel(IServiceCollection services, string? apiKey, string? model)

src/DepRadar.Infrastructure/Notifications/CompositeDriftNotifier.cs

@@ -0,0 +1,15 @@
+using DepRadar.Application.History;
+using DepRadar.Domain.History;
+
+namespace DepRadar.Infrastructure.Notifications;
+
+/// <summary>
+/// Fans a drift alert out to every configured channel (Slack, GitHub, …). Each channel
+/// is attempted; the aggregate is awaited so one flaky channel never blocks the others.
+/// </summary>
+internal sealed class CompositeDriftNotifier(IReadOnlyList<IDriftNotifier> channels) : IDriftNotifier
+{
+    /// <inheritdoc />
+    public Task NotifyAsync(DriftReport report, CancellationToken cancellationToken) =>
+        Task.WhenAll(channels.Select(channel => channel.NotifyAsync(report, cancellationToken)));
+}