> ## Documentation Index
> Fetch the complete documentation index at: https://opensre.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Fix GitHub security and quality findings

> Use OpenSRE to remediate Dependabot, code-scanning, and Code Quality findings, then open a pull request.

OpenSRE can turn one GitHub security or quality finding into a local fix and,
when approved, a pull request. It supports Dependabot alerts, code-scanning/
CodeQL alerts, and GitHub Code Quality standard findings.

<Warning>
  This is mutating. OpenSRE asks before editing files, then asks again before
  committing, pushing, and opening a PR.
</Warning>

## Set it up

```bash theme={null}
export CODING_WORKSPACE=/path/to/repo  # optional; defaults to cwd
export GITHUB_TOKEN=... # repo write access plus security-alert read access
```

OpenSRE has built-in local fixers for some Code Quality findings, such as
unused imports and unused local variables. For findings that need broader code
reasoning, it automatically uses the first coding agent CLI it finds installed
and logged in: Pi, Claude Code, or Codex. No configuration is needed when one
of those CLIs already works on your machine.

To pin a specific agent instead of auto-detection:

```bash theme={null}
export CODING_AGENT=claude-code  # pi | claude-code | codex (default: auto)
export CODING_MODEL=...          # optional model override for that agent
```

## Required access

| Need                        | GitHub access                                                                                                                            |
| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| Read Dependabot alerts      | `security_events` on classic PATs for private repos, `public_repo` for public-only use, or Dependabot alerts read on fine-grained tokens |
| Read code-scanning alerts   | Code scanning alerts read                                                                                                                |
| Read Code Quality findings  | `repo` on classic PATs, `public_repo` for public-only use, or Code quality read on fine-grained tokens                                   |
| Push a branch and open a PR | Contents write and pull requests write, or equivalent `repo` access                                                                      |

## Use it

In the interactive shell:

```text theme={null}
hey fix the security issues
fix the code quality findings on https://github.com/Tracer-Cloud/opensre/security/quality
fix the security issues in Tracer-Cloud/opensre and raise a PR
```

For a broad repo request, OpenSRE selects one open supported finding by severity.
If you do not name a repo, it uses the current checkout's GitHub `origin`.
For a specific alert, include the alert URL or say the alert type and number:

```text theme={null}
fix Dependabot alert 12 in this repo
fix https://github.com/acme/app/security/code-scanning/7 and open a PR
fix Code Quality finding 42 in Tracer-Cloud/opensre and raise a PR
```

OpenSRE asks before editing files, then asks again before committing, pushing,
and opening the PR.

## What happens

1. OpenSRE reads the GitHub alert or Code Quality finding details.
2. It verifies the local checkout's `origin` matches the finding repository.
3. OpenSRE first tries a built-in local fixer when one safely applies.
4. If no built-in fixer applies, OpenSRE runs the auto-detected (or pinned)
   coding agent CLI to implement the fix in the local checkout.
5. If PR shipping is requested and approved, OpenSRE commits only the files the
   fix run changed, pushes an `opensre/github-security-fix-*` branch, and opens
   a PR into the default branch.

Secret-scanning alerts are not auto-fixed. Revoke or rotate the secret first,
then plan repository cleanup separately.