Add Auto-Fix Command

.github/workflows/frogbot-auto-fix.yml

@@ -0,0 +1,42 @@
+name: "Frogbot Auto-Fix"
+on:
+  workflow_dispatch:
+    inputs:
+      component-name:
+        description: "Dependency to fix."
+        required: true
+      affected-version:
+        description: "Currently installed vulnerable version."
+        required: true
+      fix-version:
+        description: "Version to upgrade to."
+        required: true
+      branch-name:
+        description: "Branch to base the fix PR on. Defaults to the default branch."
+        required: false
+      commit-hash:
+        description: "Exact commit the scan ran against."
+        required: false
+permissions:
+  pull-requests: write
+  contents: write
+jobs:
+  auto-fix:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.commit-hash || inputs.branch-name || github.ref }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: jfrog/frogbot/autofix@v3
+        env:
+          JF_URL: ${{ secrets.FROGBOT_URL }}
+          JF_ACCESS_TOKEN: ${{ secrets.FROGBOT_ACCESS_TOKEN }}
+          JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          component-name: ${{ inputs.component-name }}
+          affected-version: ${{ inputs.affected-version }}
+          fix-version: ${{ inputs.fix-version }}
+          branch-name: ${{ inputs.branch-name }}
+          commit-hash: ${{ inputs.commit-hash }}

.github/workflows/test.yml

@@ -77,6 +77,9 @@ jobs:
           - name: 'Scan Pull Request'
             package: 'scanpullrequest'
 
+          - name: 'Auto Fix'
+            package: 'autofix'
+
         os: [ ubuntu, windows, macos ]
     steps:
       # Configure prerequisites

action/lib/main.js

@@ -42,6 +42,10 @@ function main() {
             yield utils_1.Utils.setupOidcTokenIfNeeded(jfrogUrl);
             const eventName = yield utils_1.Utils.setFrogbotEnv();
             yield utils_1.Utils.addToPath();
+            if (core.getInput('command') === 'auto-fix') {
+                yield utils_1.Utils.execAutoFix();
+                return;
+            }
             switch (eventName) {
                 case 'pull_request':
                 case 'pull_request_target':

action/lib/utils.js

@@ -149,6 +149,38 @@ class Utils {
             }
         });
     }
+    /**
+     * Execute frogbot auto-fix command.
+     */
+    static execAutoFix() {
+        return __awaiter(this, void 0, void 0, function* () {
+            core.exportVariable('JF_COMPONENT_NAME', core.getInput('component-name'));
+            core.exportVariable('JF_AFFECTED_VERSION', core.getInput('affected-version'));
+            core.exportVariable('JF_FIX_VERSION', core.getInput('fix-version'));
+            const commitHash = core.getInput('commit-hash');
+            if (commitHash) {
+                core.exportVariable('JF_COMMIT_HASH', commitHash);
+            }
+            const branchName = core.getInput('branch-name');
+            if (branchName) {
+                core.exportVariable('JF_GIT_BASE_BRANCH', branchName);
+            }
+            else if (!process.env.JF_GIT_BASE_BRANCH) {
+                const git = (0, simple_git_1.simpleGit)();
+                try {
+                    const currentBranch = yield git.branch();
+                    core.exportVariable('JF_GIT_BASE_BRANCH', currentBranch.current);
+                }
+                catch (error) {
+                    throw new Error('Error getting current branch from the .git folder: ' + error);
+                }
+            }
+            const res = yield (0, exec_1.exec)(Utils.getExecutableName(), ['auto-fix']);
+            if (res !== core.ExitCode.Success) {
+                throw new Error('Frogbot exited with exit code ' + res);
+            }
+        });
+    }
     /**
      * Try to load the Frogbot executables from cache.
      *

action/src/main.ts

@@ -8,6 +8,12 @@ async function main() {
         await Utils.setupOidcTokenIfNeeded(jfrogUrl);
         const eventName: string = await Utils.setFrogbotEnv();
         await Utils.addToPath();
+
+        if (core.getInput('command') === 'auto-fix') {
+            await Utils.execAutoFix();
+            return;
+        }
+
         switch (eventName) {
             case 'pull_request':
             case 'pull_request_target':

action/src/utils.ts

@@ -125,6 +125,38 @@ export class Utils {
         }
     }
 
+    /**
+     * Execute frogbot auto-fix command.
+     */
+    public static async execAutoFix() {
+        core.exportVariable('JF_COMPONENT_NAME', core.getInput('component-name'));
+        core.exportVariable('JF_AFFECTED_VERSION', core.getInput('affected-version'));
+        core.exportVariable('JF_FIX_VERSION', core.getInput('fix-version'));
+
+        const commitHash: string = core.getInput('commit-hash');
+        if (commitHash) {
+            core.exportVariable('JF_COMMIT_HASH', commitHash);
+        }
+
+        const branchName: string = core.getInput('branch-name');
+        if (branchName) {
+            core.exportVariable('JF_GIT_BASE_BRANCH', branchName);
+        } else if (!process.env.JF_GIT_BASE_BRANCH) {
+            const git: SimpleGit = simpleGit();
+            try {
+                const currentBranch: BranchSummary = await git.branch();
+                core.exportVariable('JF_GIT_BASE_BRANCH', currentBranch.current);
+            } catch (error) {
+                throw new Error('Error getting current branch from the .git folder: ' + error);
+            }
+        }
+
+        const res: number = await exec(Utils.getExecutableName(), ['auto-fix']);
+        if (res !== core.ExitCode.Success) {
+            throw new Error('Frogbot exited with exit code ' + res);
+        }
+    }
+
     /**
      * Try to load the Frogbot executables from cache.
      *

autofix/action.yml

@@ -0,0 +1,39 @@
+name: "Frogbot Auto-Fix by JFrog"
+description: "Automatically creates a fix PR for a known vulnerable dependency using JFrog Frogbot."
+author: "JFrog"
+inputs:
+  component-name:
+    description: "Dependency to fix."
+    required: true
+  affected-version:
+    description: "Currently installed vulnerable version."
+    required: true
+  fix-version:
+    description: "Version to upgrade to."
+    required: true
+  branch-name:
+    description: "Branch the vulnerability was detected on. Used as the PR base. Defaults to the current branch."
+    required: false
+  commit-hash:
+    description: "Exact commit the scan ran against."
+    required: false
+  command:
+    description: "Frogbot command to run."
+    default: "auto-fix"
+    required: false
+  version:
+    description: "Frogbot version to use."
+    default: "latest"
+    required: false
+  oidc-provider-name:
+    description: "Provider Name's value that was set in OpenId Connect integration in the JFrog platform."
+    required: false
+  oidc-audience:
+    description: "By default, this is the URL of the GitHub repository owner, such as the organization that owns the repository."
+    required: false
+runs:
+  using: "node24"
+  main: "../action/lib/main.js"
+branding:
+  icon: "terminal"
+  color: "green"