stacklok / toolhive-studio / 23740158080

60%

push

github

ci(on-pr): trigger security fix agent on check failure (#1839)

* chore: add security-vuln-remediation agent skill

* ci: add Cursor agent workflow for security vulnerability remediation

* ci(on-pr): trigger security fix agent on check failure

* chore: format

* fix(ci): install grype via official script instead of scan-action sub-action

* fix(ci): address review — gate on security result, tolerate missing files

* fix(ci): prevent duplicate agent runs and PRs

* fix(ci): use correct cursor model name for phase 2

* fix(ci): skip agent when open PR matches dep fingerprint, ensure label exists

* fix(ci): use force push for agent-managed branch

* chore: add it back in PR for testing

* ci: move security fix agent to main push + daily cron schedule

* refactor: trying opus

* fix(ci): use GITHUB_TOKEN for PR creation, add pull-requests write permission

* fix(ci): revert to app token for PR creation

* ci: revert phase 1 model to gpt-5.4-high-fast

* fix(ci): exclude remediation artifacts from commit

* fix(ci): always checkout latest main for security remediation

* chore: format

* ci: generate concise PR description separate from full analysis

* chore: format

* chore(skill): make override instructions more prescriptive with project examples

* ci: use opus for planning, sonnet for implementation

* fix(ci): add --dangerously-skip-permissions for non-interactive CI

* chore(skill): require parent-scoped overrides when multiple majors coexist

* ci(on-pr): remove security fix agent trigger

* ci(on-pr): remove security fix agent trigger

* ci(security-agent): use pnpm instead of npm

* chore: format

2809 of 5044 branches covered (55.69%)

Branch coverage included in aggregate %.

4654 of 7594 relevant lines covered (61.29%)

115.38 hits per line