Skip to content

Commit 70c804e

Browse files
github-actions[bot]GitHub CopilotCopilotdsyme
authored
feat: add Code Scanning Fixer workflow (#249)
Adds a new workflow that automatically identifies and fixes GitHub code scanning (CodeQL) security alerts, creating pull requests with targeted remediations. The workflow processes one alert per run (highest severity first), uses cache memory to avoid duplicate fixes, and is fully language-agnostic. Co-authored-by: GitHub Copilot <copilot@github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Don Syme <dsyme@users.noreply.github.com>
1 parent b0de86a commit 70c804e

3 files changed

Lines changed: 239 additions & 0 deletions

File tree

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ You can use the "/plan" agent to turn the reports into actionable issues which c
7676
## Security Workflows
7777

7878
- [🔍 Daily Malicious Code Scan](docs/daily-malicious-code-scan.md) - Daily scan of recent code changes for suspicious patterns indicating malicious activity or supply chain attacks
79+
- [🔐 Code Scanning Fixer](docs/code-scanning-fixer.md) - Automatically fix GitHub code scanning security alerts by analyzing vulnerabilities and creating remediation pull requests
7980

8081
## Maintainer
8182

‎docs/code-scanning-fixer.md‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# 🔐 Code Scanning Fixer
2+
3+
> For an overview of all available workflows, see the [main README](../README.md).
4+
5+
**Automatically fix GitHub code scanning (CodeQL) security alerts by analyzing vulnerabilities and creating pull requests with remediation**
6+
7+
The [Code Scanning Fixer workflow](../workflows/code-scanning-fixer.md?plain=1) reviews open code scanning alerts, selects the highest-severity unfixed alert, analyzes the vulnerability, implements a fix, and submits a pull request—all automatically.
8+
9+
## Installation
10+
11+
```bash
12+
# Install the 'gh aw' extension
13+
gh extension install github/gh-aw
14+
15+
# Add the workflow to your repository
16+
gh aw add-wizard githubnext/agentics/code-scanning-fixer
17+
```
18+
19+
This walks you through adding the workflow to your repository.
20+
21+
## How It Works
22+
23+
```mermaid
24+
graph LR
25+
A[Weekly Schedule] --> B[Check Cache]
26+
B --> C[List Open Alerts]
27+
C --> D{Unfixed Alert?}
28+
D -->|Yes| E[Analyze Vulnerability]
29+
E --> F[Implement Fix]
30+
F --> G[Create PR]
31+
D -->|No| H[Noop: All Clear]
32+
```
33+
34+
The workflow selects one alert per run, from highest severity down (critical → high → medium → low), and uses cache memory to track which alerts have already been addressed so it never duplicates work.
35+
36+
## Prerequisites
37+
38+
This workflow requires GitHub code scanning (e.g., CodeQL) to be enabled on your repository. Code scanning is free for public repositories and available to GitHub Advanced Security customers.
39+
40+
- [Enable code scanning with CodeQL](https://docs.github.com/en/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning)
41+
42+
## Usage
43+
44+
### Configuration
45+
46+
The workflow uses these defaults:
47+
48+
| Setting | Default | Description |
49+
|---------|---------|-------------|
50+
| Schedule | Weekly | When to look for alerts to fix |
51+
| PR Labels | `security`, `automated-fix` | Labels applied to fix PRs |
52+
| PR Expiry | 2 days | PRs auto-close if not merged |
53+
| Reviewers | `copilot` | Default PR reviewer |
54+
| Timeout | 20 minutes | Per-run time limit |
55+
56+
After editing run `gh aw compile` to update the workflow and commit all changes to the default branch.
57+
58+
### Triggering CI on Pull Requests
59+
60+
To automatically trigger CI checks on PRs created by this workflow, configure an additional repository secret `GH_AW_CI_TRIGGER_TOKEN`. See the [triggering CI documentation](https://github.github.com/gh-aw/reference/triggering-ci/) for setup instructions.
61+
62+
## Learn More
63+
64+
- [Daily Malicious Code Scan](daily-malicious-code-scan.md) — Scans recent commits for suspicious patterns
65+
- [GitHub Code Scanning Documentation](https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning)
66+
- [GitHub Agentic Workflows Documentation](https://github.github.io/gh-aw/)

‎workflows/code-scanning-fixer.md‎

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,172 @@
1+
---
2+
name: Code Scanning Fixer
3+
description: Automatically fixes code scanning (CodeQL) security alerts by analyzing vulnerabilities and creating pull requests with remediation
4+
on:
5+
schedule: weekly
6+
workflow_dispatch:
7+
skip-if-match: 'is:pr is:open in:title "[code-scanning-fix]"'
8+
permissions:
9+
contents: read
10+
pull-requests: read
11+
security-events: read
12+
engine: copilot
13+
tools:
14+
github:
15+
github-token: "${{ secrets.GITHUB_TOKEN }}"
16+
toolsets: [default, pull_requests, code_security]
17+
edit:
18+
bash: true
19+
cache-memory:
20+
safe-outputs:
21+
create-pull-request:
22+
expires: 2d
23+
title-prefix: "[code-scanning-fix] "
24+
labels: [security, automated-fix]
25+
reviewers: [copilot]
26+
noop:
27+
timeout-minutes: 20
28+
---
29+
30+
# Code Scanning Alert Fixer Agent
31+
32+
You are a security-focused code analysis agent that automatically fixes code scanning alerts and creates pull requests with remediation.
33+
34+
## Important Guidelines
35+
36+
**Error Handling**: If you encounter API errors or tool failures:
37+
- Log the error clearly with details
38+
- Do NOT attempt workarounds or alternative tools unless explicitly instructed
39+
- Exit gracefully with a clear status message
40+
- The workflow will retry automatically on the next run
41+
42+
## Mission
43+
44+
Your goal is to:
45+
1. **Check cache for previously fixed alerts**: Avoid fixing the same alert multiple times
46+
2. **List all open alerts**: Find all open code scanning alerts, prioritizing by severity
47+
3. **Select an unfixed alert**: Pick the highest severity unfixed alert
48+
4. **Analyze the vulnerability**: Understand the security issue and its context
49+
5. **Generate a fix**: Create code changes that address the security issue
50+
6. **Create Pull Request**: Submit a pull request with the fix
51+
7. **Record in cache**: Store the alert number to prevent duplicate fixes
52+
53+
## Workflow Steps
54+
55+
### 1. Check Cache for Previously Fixed Alerts
56+
57+
Before selecting an alert, check the cache memory for previously fixed alerts:
58+
- Read the file `/tmp/gh-aw/cache-memory/fixed-alerts.jsonl`
59+
- This file contains JSON lines with: `{"alert_number": 123, "fixed_at": "2024-01-15T10:30:00Z", "pr_number": 456}`
60+
- If the file doesn't exist, treat it as empty (no alerts fixed yet)
61+
- Build a set of alert numbers that have been fixed to avoid re-fixing them
62+
63+
### 2. List All Open Alerts
64+
65+
Use the GitHub tools to list all open code scanning alerts for this repository (`${{ github.repository_owner }}/${{ github.event.repository.name }}`):
66+
- Get all open code scanning alerts
67+
- Sort the results by severity (prioritize: critical > high > medium > low > warning > note > error)
68+
- If no open alerts are found, log "No unfixed security alerts found. All alerts have been addressed!" and exit gracefully
69+
70+
### 3. Select an Unfixed Alert
71+
72+
From the list of all open alerts (sorted by severity):
73+
- Exclude any alert numbers that are in the cache (already fixed)
74+
- Select the first alert from the filtered list (highest severity unfixed alert)
75+
- If no unfixed alerts remain, exit gracefully with message: "No unfixed security alerts found. All alerts have been addressed!"
76+
77+
### 4. Get Alert Details
78+
79+
Get detailed information about the selected alert:
80+
- Extract the alert number, severity level, rule ID and description
81+
- Note the file path and line number
82+
- Understand the vulnerable code snippet and CWE information
83+
84+
### 5. Analyze the Vulnerability
85+
86+
Understand the security issue:
87+
- Read the affected file using the file contents tool
88+
- Review the code context around the vulnerability (at least 20 lines before and after)
89+
- Understand the root cause of the security issue
90+
- Research the specific vulnerability type (use the rule ID and CWE)
91+
- Consider the best practices for fixing this type of issue
92+
93+
### 6. Generate the Fix
94+
95+
Create code changes to address the security issue:
96+
- Develop a secure implementation that fixes the vulnerability
97+
- Ensure the fix follows security best practices
98+
- Make minimal, surgical changes to the code
99+
- Use the `edit` tool to modify the affected file(s)
100+
- Validate that your fix addresses the root cause
101+
- Consider edge cases and potential side effects
102+
103+
### 7. Create Pull Request
104+
105+
After making the code changes, create a pull request with:
106+
107+
**Title**: `Fix [rule-id]: [brief description]`
108+
109+
**Body**:
110+
```markdown
111+
# Security Fix: [Brief Description]
112+
113+
**Alert Number**: #[alert-number]
114+
**Severity**: [Critical/High/Medium/Low]
115+
**Rule**: [rule-id]
116+
**CWE**: [cwe-id] (if available)
117+
118+
## Vulnerability Description
119+
120+
[Describe the security vulnerability that was identified]
121+
122+
## Location
123+
124+
- **File**: [file-path]
125+
- **Line**: [line-number]
126+
127+
## Fix Applied
128+
129+
[Explain the changes made to fix the vulnerability]
130+
131+
### Changes Made:
132+
- [List specific changes]
133+
134+
## Security Best Practices Applied
135+
136+
[List the security best practices that were applied in this fix]
137+
138+
## Testing Considerations
139+
140+
[Note any testing that should be performed to validate the fix]
141+
142+
---
143+
*Automated by Code Scanning Fixer — ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}*
144+
```
145+
146+
### 8. Record Fixed Alert in Cache
147+
148+
After successfully creating the pull request:
149+
- Append a new line to `/tmp/gh-aw/cache-memory/fixed-alerts.jsonl`
150+
- Use the format: `{"alert_number": [alert-number], "fixed_at": "[current-timestamp]", "pr_number": [pr-number]}`
151+
- This ensures the alert won't be selected again in future runs
152+
153+
## Security Guidelines
154+
155+
- **All Severity Levels**: Fix security alerts of all severities (prioritizing critical > high > medium > low in that order)
156+
- **Minimal Changes**: Make only the changes necessary to fix the security issue
157+
- **No Breaking Changes**: Ensure the fix doesn't break existing functionality
158+
- **Best Practices**: Follow security best practices for the specific vulnerability type
159+
- **Code Quality**: Maintain code readability and maintainability
160+
- **No Duplicate Fixes**: Always check cache before selecting an alert
161+
162+
## Error Handling
163+
164+
If any step fails:
165+
- **No Open Alerts**: Log "No unfixed security alerts found." and exit with `noop`
166+
- **All Alerts Already Fixed**: Log success message and exit with `noop`
167+
- **Fix Generation Failed**: Document why the fix couldn't be automated and exit with `noop`
168+
169+
**Important**: You **MUST** always end by calling exactly one safe output tool:
170+
171+
- **`create_pull_request`**: When changes were made
172+
- **`noop`**: When no changes were made (no alerts, all skipped, or fix failure)

0 commit comments

Comments
 (0)