skills.rest
j4hr3n
j4hr3nCOMMUNITY
Explore all skills by this author →
GitHub

fix-grype-tf

Auto-fix Grype scan vulnerabilities by updating dependencies and opening PRs.

Updated Mar 24, 2023
Search Tags:#automation#devops#vulnerability#github#remediation#pull-request#grype
One-click install
npx skills add https://github.com/j4hr3n/dotfiles --skill fix-grype-tf
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: fix-grype-tf
Source: https://github.com/j4hr3n/dotfiles/tree/main/configs/claude-code/skills/fix-grype-tf
Command: npx skills add https://github.com/j4hr3n/dotfiles --skill fix-grype-tf

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Auto-fixes vulnerabilities surfaced by the Grype Org Scan for Techfolk-AS, reducing manual remediation time by automatically applying recommended dependency updates and creating PRs per affected repository while skipping those with an existing fix PR.

Core Features & Use Cases

  • End-to-end remediation: fetches the latest failing Grype run (or a provided run ID), extracts affected repos and fixed_in versions, and prepares per-repo bumps across ecosystems (Go, npm, Python, Java).
  • Automated PR creation and validation: pushes fix branches, runs local/build validations, and opens one PR per repository, excluding repos that already have an open fix PR.
  • Operates on Techfolk-AS GitHub org: tailored to the workflow and naming conventions of Techfolk-AS.

Quick Start

Run the /fix-grype-tf command to start the auto-fix workflow.

Frequently Asked Questions about fix-grype-tf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automatically fix Grype vulnerability scan failures across multiple GitHub repositories?▼

Grype vulnerability scan failures can be auto-fixed by pulling the latest failing run, parsing affected packages and recommended fixes, bumping dependencies across Go, npm, Python, and Java, and opening one PR per affected repository.

Can I automate dependency bumps for npm, Python, Go, and Java based on Grype scan results?▼

Yes, Grype scan results can be parsed to automatically bump vulnerable dependencies across npm, Python, Go, and Java ecosystems by extracting fixed_in versions and applying the recommended updates directly to the affected repositories.

How does automated vulnerability remediation handle repositories that already have an open fix pull request?▼

Automated vulnerability remediation skips any repository that already has an open fix pull request, ensuring duplicate PRs are not created and avoiding redundant dependency bumps for previously addressed Grype findings.

Does the Grype auto-fix workflow verify builds before pushing dependency update branches?▼

Yes, the Grype auto-fix workflow runs local build validations before pushing fix branches, ensuring dependency updates do not break compilation and securely opening validated pull requests for the affected repositories.

Can I fix vulnerabilities from a specific Grype run URL instead of the latest failing scan?▼

Yes, vulnerabilities can be fixed from a specific Grype run by providing a run URL, allowing the workflow to parse that exact scan data, extract affected packages, and generate targeted dependency bump PRs.

Related Skills

Explore More Software Engineering Skills→
mizchimizchi
320

gh-fix-ci

Diagnose failing GitHub Actions PR checks and draft remediation plans.

Community
Intermediate
arjitj2arjitj2

squash-merge-dependabot-fixes

Squash-merge approved Dependabot pull requests sequentially with conflict resolution.

Community
Advanced
submariner-iosubmariner-io
77

cve-fix

Scan Go repositories for CVEs, update dependencies, and commit fixes.

Official
Advanced
chrislyonschrislyons

dependency.audit

Audit npm, Python, and Rust dependencies for vulnerabilities, licenses, and upgrades.

Community
Intermediate