ghas-secret-fixer
Advanced tools
A powerful CLI tool that automatically fixes code scanning alerts in your GitHub repositories using GitHub Advanced Security's autofix feature.
--yes flag--dry-run flagnpm install -g ghas-secret-fixer
You need a GitHub Personal Access Token with the following scopes:
repo (for repository access)security_events (for reading code scanning alerts)Set your token as an environment variable:
export GITHUB_TOKEN=your_token_here
ghas-secret-fixer
The tool will guide you through:
For automation and CI/CD integration:
# Fix all alerts in a specific repository
ghas-secret-fixer --org myorg --repo myrepo --yes
# Fix alerts in multiple repositories
ghas-secret-fixer --org myorg --repos "repo1,repo2,repo3" --yes
# Fix only critical and high severity alerts
ghas-secret-fixer --org myorg --repo myrepo --severity "critical,high" --yes --create-pr
# Preview changes without applying them
ghas-secret-fixer --org myorg --repo myrepo --dry-run
USAGE
ghas-secret-fixer [OPTIONS]
OPTIONS
-h, --help Show help message
-v, --version Show version number
-y, --yes Skip all prompts and use defaults
-t, --token <token> GitHub personal access token
-o, --org <org> GitHub organization name
-r, --repo <repo> Single repository name
--repos <repos> Comma-separated list of repositories
-b, --branch <branch> Branch name for fixes (default: autofixes)
-a, --alerts <alerts> Comma-separated list of alert IDs to fix
-s, --severity <severity> Filter by severity (critical,high,medium,low,warning,note,error)
--state <state> Filter by state (open,dismissed,fixed)
--tool <tool> Filter by tool name
--create-pr Automatically create pull request
--no-pr Skip pull request creation
--pr-title <title> Pull request title
--pr-body <body> Pull request body
--timeout <seconds> Timeout for autofix operations (default: 60)
--verbose Enable verbose logging
--quiet Suppress non-error output
--config <file> Load configuration from file
--dry-run Show what would be fixed without making changes
# Interactive mode
ghas-secret-fixer
# Fix all alerts in a repository (headless)
ghas-secret-fixer -o myorg -r myrepo -y
# Fix only critical severity alerts
ghas-secret-fixer -o myorg -r myrepo -s critical -y
# Fix specific alerts by ID
ghas-secret-fixer -o myorg -r myrepo -a "1,2,3" -y
# Fix alerts from specific tool
ghas-secret-fixer -o myorg -r myrepo --tool CodeQL -y
# Fix alerts in multiple repositories
ghas-secret-fixer -o myorg --repos "api,frontend,backend" -y
# With custom branch name
ghas-secret-fixer -o myorg --repos "api,frontend" -b security-fixes -y
# Automatically create PR with custom title and body
ghas-secret-fixer -o myorg -r myrepo -y --create-pr --pr-title "Security fixes" --pr-body "Automated security fixes"
# Skip PR creation
ghas-secret-fixer -o myorg -r myrepo -y --no-pr
# Preview what would be fixed
ghas-secret-fixer -o myorg -r myrepo --dry-run
# Verbose logging
ghas-secret-fixer -o myorg -r myrepo -y --verbose
# Quiet mode (errors only)
ghas-secret-fixer -o myorg -r myrepo -y --quiet
# GitHub token
export GITHUB_TOKEN=your_token_here
# Default organization
export GITHUB_ORG=myorg
# Default repository
export GITHUB_REPO=myrepo
Create a configuration file to store common settings:
{
"org": "myorg",
"repos": ["api", "frontend", "backend"],
"severity": ["critical", "high"],
"createPr": true,
"branch": "security-fixes",
"timeout": 120
}
Use with --config config.json
Perfect for automated security workflows:
# GitHub Actions example
name: Auto-fix Security Alerts
on:
schedule:
- cron: '0 2 * * *' # Daily at 2 AM
jobs:
autofix:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: '18'
- run: npm install -g ghas-secret-fixer
- run: ghas-secret-fixer --org ${{ github.repository_owner }} --repos "repo1,repo2" --yes --create-pr
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
npm run build
npm test
npm start
npm run dev
git checkout -b feature/amazing-feature)git commit -m 'Add some amazing feature')git push origin feature/amazing-feature)This project is licensed under the MIT License - see the LICENSE file for details.
If you encounter any issues or have questions, please open an issue on GitHub.
--yes flag--dry-run flagCreated by Austen Stone
FAQs
GitHub Advanced Security autofix CLI tool for code scanning alerts
We found that ghas-secret-fixer demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A network of 152 Chrome live wallpaper extensions hid ad tracking and made extension-driven traffic look like Google search clicks.
Company News
Socket’s first CISO brings deep experience securing high-growth SaaS companies as open source supply chain threats accelerate.
Company News
Replit is integrating Socket Firewall into its AI-powered development experience to help protect builders from malicious open source packages.