Skip to content

Commit 4d83b09

Browse files
meysholdtona-agent
meysholdt
and
ona-agent
committed
Add Ona automations for Dependabot and code scanning alerts
- fix-dependabot-alert: fetches highest-severity Dependabot alert, upgrades the dependency, verifies in dev environment, opens a PR - fix-codescan-alert: fetches highest-severity code scanning alert, applies fix, verifies in dev environment, opens a PR - deploy-se-demo.sh: helper to update registered automations Co-authored-by: Ona <no-reply@ona.com>
1 parent 943e678 commit 4d83b09

3 files changed

Lines changed: 176 additions & 0 deletions

File tree

‎.ona/deploy-se-demo.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
#!/bin/bash
2+
3+
ona ai automation update 019cced7-1341-78dc-a3c6-00fb0ae2ba6a fix-codescan-alert.yaml
4+
ona ai automation update 019cced7-4625-733f-91f0-e278738d9ec8 fix-dependabot-alert.yaml

‎.ona/fix-codescan-alert.yaml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
name: fix-codescan-alert
2+
description: >-
3+
Picks the highest-severity open code scanning alert, applies a fix,
4+
verifies tests pass, and opens a pull request.
5+
triggers:
6+
- context:
7+
projects: {}
8+
manual: {}
9+
action:
10+
limits:
11+
maxParallel: 1
12+
maxTotal: 10
13+
steps:
14+
# Step 1: Install gh CLI if not present
15+
- task:
16+
command: |
17+
command -v gh && exit 0
18+
curl -sL https://github.com/cli/cli/releases/latest/download/gh_2.74.0_linux_amd64.tar.gz | tar xz -C /tmp
19+
sudo mv /tmp/gh_2.74.0_linux_amd64/bin/gh /usr/local/bin/gh
20+
# Step 2: Fetch the highest-severity open code scanning alert
21+
- task:
22+
command: |
23+
export GITHUB_TOKEN=$(printf 'protocol=https\nhost=github.com\n\n' | git credential fill | awk -F= '/password/{print $2}')
24+
gh api repos/{owner}/{repo}/code-scanning/alerts \
25+
--jq '[.[] | select(.state=="open")] | sort_by(.rule.security_severity_level // "low") | reverse | .[0]' \
26+
> /tmp/codescan-alert.json
27+
cat /tmp/codescan-alert.json
28+
- agent:
29+
prompt: |
30+
Read /tmp/codescan-alert.json which contains the highest-severity open
31+
code scanning alert. Extract the alert number, HTML URL, rule ID, severity,
32+
file path and line number, tool name, and message.
33+
34+
If the file is empty, null, or contains no alert, output
35+
"NO_ALERT: No open code scanning alerts found." and stop.
36+
37+
Read the affected source file. If the issue described in the alert is
38+
already fixed in the current code, output
39+
"ALREADY_FIXED: <rule-id> in <file>:<line> is already resolved." and stop.
40+
41+
Otherwise, apply the fix:
42+
- **CodeQL alerts:** Apply the minimal code change. Follow the project's
43+
code style. Use the suggested fix pattern if one is provided.
44+
- **Dependency alerts (Trivy / OSV-Scanner):** Upgrade the vulnerable
45+
dependency to a patched version. If inherited from a parent BOM, add
46+
an explicit version override in `pom.xml`.
47+
48+
Do NOT commit or run tests yet.
49+
50+
- agent:
51+
prompt: |
52+
Verify the fix from the previous step:
53+
54+
1. Identify the project's build tool, test runner, and linter from the
55+
repo config files.
56+
2. Compile the project. If it fails, read the errors, fix them, and retry.
57+
3. Find all test suites and verification commands that could exercise the
58+
modified code. Run them.
59+
4. If any check fails, determine whether the failure is caused by your
60+
change or is pre-existing. Fix what you broke and rerun.
61+
5. Repeat until all checks pass.
62+
63+
- pullRequest:
64+
branch: codescan-fix/
65+
title: 'CodeScan-Fix: '
66+
description: |
67+
## Code Scanning Alert
68+
69+
| Field | Value |
70+
|-------|-------|
71+
| **Alert** | [View alert](<alert-html-url>) |
72+
| **Rule** | `<rule-id>` |
73+
| **Severity** | <severity> |
74+
| **Tool** | <tool-name> |
75+
| **File** | `<file-path>:<line-number>` |
76+
| **Message** | <alert-message> |
77+
78+
## What changed
79+
80+
<one-or-two-sentence explanation of the fix and why it resolves the alert>
81+
82+
## Verification
83+
84+
<List each build, test, and lint command that was run and its outcome.>

‎.ona/fix-dependabot-alert.yaml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
name: fix-dependabot-alert
2+
description: >-
3+
Picks the highest-severity open Dependabot alert, upgrades the
4+
vulnerable dependency, verifies tests pass, and opens a pull request.
5+
triggers:
6+
- context:
7+
projects: {}
8+
manual: {}
9+
action:
10+
limits:
11+
maxParallel: 1
12+
maxTotal: 10
13+
steps:
14+
# Step 1: Install gh CLI if not present
15+
- task:
16+
command: |
17+
command -v gh && exit 0
18+
curl -sL https://github.com/cli/cli/releases/latest/download/gh_2.74.0_linux_amd64.tar.gz | tar xz -C /tmp
19+
sudo mv /tmp/gh_2.74.0_linux_amd64/bin/gh /usr/local/bin/gh
20+
# Step 2: Fetch the highest-severity open Dependabot alert
21+
- task:
22+
command: |
23+
export GITHUB_TOKEN=$(printf 'protocol=https\nhost=github.com\n\n' | git credential fill | awk -F= '/password/{print $2}')
24+
gh api repos/{owner}/{repo}/dependabot/alerts \
25+
--jq '[.[] | select(.state=="open")] | sort_by(.security_advisory.cvss.score) | reverse | .[0]' \
26+
> /tmp/dependabot-alert.json
27+
cat /tmp/dependabot-alert.json
28+
- agent:
29+
prompt: |
30+
Read /tmp/dependabot-alert.json which contains the highest-severity open
31+
Dependabot alert. Extract the alert number, package name, vulnerable and
32+
patched versions, CVE ID, CVSS score, and manifest file path.
33+
34+
If the file is empty, null, or contains no alert, output
35+
"NO_ALERT: No open Dependabot alerts found." and stop.
36+
37+
Check whether the dependency is already at or above the patched version.
38+
If so, output "ALREADY_FIXED: <package> is already at <version>." and stop.
39+
40+
Otherwise, apply the fix:
41+
1. Read the manifest file to understand how the dependency is declared.
42+
2. Upgrade the vulnerable dependency to the patched version (or newer).
43+
- If the version is in `pom.xml` properties or directly, update it there.
44+
- If inherited from a parent BOM, add an explicit version override.
45+
3. Follow the project's existing conventions.
46+
47+
Do NOT commit or run tests yet.
48+
49+
- agent:
50+
prompt: |
51+
Verify the fix from the previous step:
52+
53+
1. Identify the project's build tool, test runner, and linter from the
54+
repo config files.
55+
2. Compile the project. If it fails, read the errors, fix them, and retry.
56+
3. Find all test suites and verification commands that could exercise the
57+
modified code. Run them.
58+
4. If any check fails, determine whether the failure is caused by your
59+
change or is pre-existing. Fix what you broke and rerun.
60+
5. Repeat until all checks pass.
61+
6. For dependency upgrades, confirm the vulnerable version is no longer
62+
in the resolved dependency tree.
63+
64+
- pullRequest:
65+
branch: dependabot-fix/
66+
title: 'Dependabot-Fix: '
67+
description: |
68+
## Dependabot Alert
69+
70+
| Field | Value |
71+
|-------|-------|
72+
| **Alert** | [View alert](https://github.com/ona-samples/github-security/security/dependabot/<alert-number>) |
73+
| **CVE** | `<cve-id>` |
74+
| **CVSS** | <cvss-score> |
75+
| **Package** | `<package-name>` |
76+
| **Vulnerable** | `<vulnerable-version>` |
77+
| **Fixed** | `<patched-version>` |
78+
| **Advisory** | <advisory-summary> |
79+
80+
## What changed
81+
82+
<one-or-two-sentence explanation of the dependency upgrade and why it resolves the vulnerability>
83+
84+
## Verification
85+
86+
<List each build, test, and lint command that was run and its outcome.
87+
For dependency upgrades, state how you confirmed the vulnerable version
88+
is no longer in the resolved dependency tree.>

0 commit comments

Comments
 (0)