Skip to content

Commit 171423d

Browse files
meysholdtona-agent
meysholdt
and
ona-agent
committed
Add Ona automations for Dependabot and code scanning alerts
- fix-dependabot-alert: picks highest-severity Dependabot alert, upgrades the dependency, runs tests, opens a PR - fix-codescan-alert: picks highest-severity code scanning alert (CodeQL, Trivy, OSV-Scanner), applies fix, runs tests, opens a PR Co-authored-by: Ona <no-reply@ona.com>
1 parent 6839482 commit 171423d

2 files changed

Lines changed: 175 additions & 0 deletions

File tree

‎.ona/fix-codescan-alert.yaml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
name: fix-codescan-alert
2+
description: >-
3+
Picks the highest-severity open code scanning alert, applies a fix,
4+
verifies tests pass, and opens a pull request.
5+
triggers:
6+
- context:
7+
projects: {}
8+
manual: {}
9+
action:
10+
limits:
11+
maxParallel: 1
12+
maxTotal: 10
13+
steps:
14+
- agent:
15+
prompt: |
16+
Query the GitHub code scanning alerts for this repository using the GitHub CLI:
17+
18+
gh api repos/{owner}/{repo}/code-scanning/alerts \
19+
--jq '[.[] | select(.state=="open")] | sort_by(.rule.security_severity_level // "low") | reverse | .[0]'
20+
21+
From the highest-severity open alert, extract:
22+
1. Alert number and HTML URL
23+
2. Rule ID and description
24+
3. Severity level
25+
4. File path and line number (from `most_recent_instance.location`)
26+
5. The tool that reported it (CodeQL, Trivy, OSV-Scanner, etc.)
27+
6. The alert message
28+
29+
Read the affected source file and surrounding context to understand the issue.
30+
31+
If the alert is about a vulnerable dependency (from Trivy or OSV-Scanner),
32+
identify the dependency, its current version, and the fixed version from the
33+
alert details.
34+
35+
Do NOT make any code changes yet.
36+
37+
- agent:
38+
prompt: |
39+
Using the alert identified in the previous step, apply the fix:
40+
41+
**For code quality / CodeQL alerts:**
42+
1. Apply the minimal code change that resolves the alert.
43+
2. Follow the project's code style and conventions.
44+
3. If the alert suggests a specific fix pattern, follow it.
45+
46+
**For dependency vulnerability alerts (Trivy / OSV-Scanner):**
47+
1. Upgrade the vulnerable dependency to a patched version.
48+
2. If the version is inherited from a parent BOM, add an explicit
49+
version override in `pom.xml` properties or `<dependencyManagement>`.
50+
51+
Do NOT commit or run tests yet.
52+
53+
- agent:
54+
prompt: |
55+
Verify the fix from the previous step:
56+
57+
1. Run `./mvnw compile test` to compile and run all tests.
58+
2. If compilation or tests fail:
59+
a. Read the error output carefully.
60+
b. Identify whether the failure is caused by the fix or a pre-existing issue.
61+
c. If caused by the fix, adjust the code and retry.
62+
d. Rerun `./mvnw compile test`.
63+
e. Repeat until all tests pass.
64+
3. Once tests pass, confirm the fix is complete.
65+
66+
- pullRequest:
67+
branch: codescan-fix/
68+
title: 'CodeScan-Fix: '
69+
description: |
70+
## Code Scanning Alert
71+
72+
| Field | Value |
73+
|-------|-------|
74+
| **Alert** | [View alert](<alert-html-url>) |
75+
| **Rule** | `<rule-id>` |
76+
| **Severity** | <severity> |
77+
| **Tool** | <tool-name> |
78+
| **File** | `<file-path>:<line-number>` |
79+
| **Message** | <alert-message> |
80+
81+
## What changed
82+
83+
<one-or-two-sentence explanation of the fix and why it resolves the alert>
84+
85+
## Verification
86+
87+
- [x] `./mvnw compile test` passes
88+
- [x] Fix is minimal and preserves existing behavior

‎.ona/fix-dependabot-alert.yaml‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
name: fix-dependabot-alert
2+
description: >-
3+
Picks the highest-severity open Dependabot alert, upgrades the
4+
vulnerable dependency, verifies tests pass, and opens a pull request.
5+
triggers:
6+
- context:
7+
projects: {}
8+
manual: {}
9+
action:
10+
limits:
11+
maxParallel: 1
12+
maxTotal: 10
13+
steps:
14+
- agent:
15+
prompt: |
16+
Query the GitHub Dependabot alerts for this repository using the GitHub CLI:
17+
18+
gh api repos/{owner}/{repo}/dependabot/alerts \
19+
--jq '[.[] | select(.state=="open")] | sort_by(.security_advisory.cvss.score) | reverse | .[0]'
20+
21+
From the highest-severity open alert, extract:
22+
1. Alert number
23+
2. Package name and ecosystem
24+
3. Vulnerable version range
25+
4. Patched version (from `security_advisory.vulnerabilities[].first_patched_version`)
26+
5. CVE ID and CVSS score
27+
6. Advisory summary
28+
7. The manifest file path (e.g. `pom.xml`)
29+
30+
Read the manifest file to understand how the dependency is declared.
31+
Determine whether the version is pinned directly or inherited from a parent BOM.
32+
33+
Do NOT make any code changes yet.
34+
35+
- agent:
36+
prompt: |
37+
Using the alert identified in the previous step:
38+
39+
1. Upgrade the vulnerable dependency to the patched version (or newer).
40+
- If the version is declared in `pom.xml` properties or directly, update it there.
41+
- If it is inherited from a parent BOM (e.g. Spring Boot parent), check whether
42+
upgrading the parent resolves the vulnerability. If not, add an explicit
43+
version override in the `<properties>` or `<dependencyManagement>` section.
44+
2. Follow the project's existing conventions for dependency management.
45+
46+
Do NOT commit or run tests yet.
47+
48+
- agent:
49+
prompt: |
50+
Verify the fix from the previous step:
51+
52+
1. Run `./mvnw compile test` to compile and run all tests.
53+
2. If compilation or tests fail:
54+
a. Read the error output carefully.
55+
b. Identify whether the failure is caused by the upgrade or a pre-existing issue.
56+
c. If caused by the upgrade, check for breaking API changes and adapt the code.
57+
d. Rerun `./mvnw compile test`.
58+
e. Repeat until all tests pass.
59+
3. Run `./mvnw dependency:tree -Dincludes=<groupId>:<artifactId>` to confirm
60+
the vulnerable version is no longer in the dependency tree.
61+
4. Once tests pass and the old version is gone, confirm the fix is complete.
62+
63+
- pullRequest:
64+
branch: dependabot-fix/
65+
title: 'Dependabot-Fix: '
66+
description: |
67+
## Dependabot Alert
68+
69+
| Field | Value |
70+
|-------|-------|
71+
| **Alert** | [View alert](https://github.com/ona-samples/github-security/security/dependabot/<alert-number>) |
72+
| **CVE** | `<cve-id>` |
73+
| **CVSS** | <cvss-score> |
74+
| **Package** | `<package-name>` |
75+
| **Vulnerable** | `<vulnerable-version>` |
76+
| **Fixed** | `<patched-version>` |
77+
| **Advisory** | <advisory-summary> |
78+
79+
## What changed
80+
81+
<one-or-two-sentence explanation of the dependency upgrade and why it resolves the vulnerability>
82+
83+
## Verification
84+
85+
- [x] `./mvnw compile test` passes
86+
- [x] `./mvnw dependency:tree` confirms vulnerable version is removed
87+
- [x] Upgrade is minimal and preserves existing behavior

0 commit comments

Comments
 (0)