contrast-security-oss/Contrast AI SmartFix
Automatically generate fixes for vulnerabilities detected by Contrast Security
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 11, 2026
- License
- None
Pinned Snippet
uses: contrast-security-oss/contrast-ai-smartfix-action@f242b1ddad6ccedd0fab89ca2cee6cac606fc0c1 # v1.0.19tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| build_command | Command to build the application | no | — |
| formatting_command | Command to format code (optional) | no | — |
| max_open_prs | Maximum number of open PRs | no | 5 |
| max_events_per_agent | Maximum number of events per agent run before terminating (default: 120) | no | 120 |
| github_token | GitHub token for PR operations | yes | — |
| base_branch | Base branch for PRs | no | ${{ github.event.repository.default_branch }} |
| contrast_host | Contrast Security API host | yes | — |
| contrast_org_id | Contrast Organization ID | yes | — |
| contrast_app_id | Contrast Application ID (use contrast_app_ids for monorepo support) | no | — |
| contrast_app_ids | JSON array of Contrast Application IDs for monorepo support (e.g. '["app-id-1", "app-id-2"]'). If contrast_app_id is also set, it takes precedence. | no | — |
| contrast_authorization_key | Contrast Authorization Key | yes | — |
| contrast_api_key | Contrast API Key | yes | — |
| gemini_api_key | Gemini API key for Google AI Studio | no | — |
| anthropic_api_key | Anthropic API key | no | — |
| aws_bearer_token_bedrock | AWS Bedrock API Bearer Token (alternative to AWS IAM credentials) | no | — |
| aws_region | AWS Region for Bedrock (required for ALL Bedrock authentication methods: IAM credentials or bearer token) | no | — |
| azure_api_key | Azure API Key for Azure OpenAI | no | — |
| azure_api_base | Azure API Base URL | no | — |
| azure_api_version | Azure API Version | no | — |
| agent_model | LLM model path to use for the agent | no | — |
| skip_writing_security_test | Whether to attempt writing security tests | no | false |
| use_smartfix_instructions | Read SMARTFIX_INSTRUCTIONS.md from the repo root and inject it into the fix agent prompt. | no | true |
| use_repo_agent_instructions | Fall back to existing agent instruction files (.github/copilot-instructions.md, AGENTS.md, CLAUDE.md, .cursorrules) if SMARTFIX_INSTRUCTIONS.md is absent or disabled. | no | true |
| debug_mode | Enable debug mode for verbose logging | no | false |
| vulnerability_severities | Array of vulnerability severity levels to process (allowed: CRITICAL, HIGH, MEDIUM, LOW, NOTE) | no | ["CRITICAL", "HIGH", "MEDIUM"] |
| run_task | [DEPRECATED] This input is now automatically determined. Setting this will be ignored. | no | auto |
| enable_full_telemetry | Enable full telemetry, including potentially sensitive data. Defaults to true. | no | true |
| coding_agent | Specifies the coding agent to use for generating fixes. Allowed values: SMARTFIX, GITHUB_COPILOT, CLAUDE_CODE. | no | SMARTFIX |
| use_contrast_llm | Use Contrast LLM as your default LLM provider. Set to false if using your own LLM. | no | false |
| enable_anthropic_prompt_caching | Enable Anthropic prompt caching for supported models (bedrock/claude and anthropic/claude). Defaults to true. | no | true |
Outputs
no outputs