csm-actions/Fix Code securely
Securefix Action
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 10, 2026
- License
- MIT
Pinned Snippet
uses: csm-actions/securefix-action@4d885e1bcb71f4f110215c833002ce9fa0ee0fa6 # v0.6.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| action | Action to run. One of "client", "validate-config", "prepare", "notify", "commit", "server". If server_repository is set, defaults to "client". | no | — |
| app_id | GitHub App ID | no | — |
| app_private_key | GitHub App Private Key | no | — |
| outputs | Prepare action's outputs | no | — |
| commit_message | Commit message | no | — |
| pull_request_comment | Pull request comment. If this is set, a pull request comment is posted after a pull request is created. | no | — |
| server_repository | Server repository name | no | — |
| files | Fixed files | no | — |
| use_git_ls_files | If true, the action uses `git ls-files` to list committed files. | no | true |
| fail_if_changes | If true, the action fails if there are changes. | no | false |
| repository | A repository full name where a commit will be pushed. | no | — |
| branch | A branch where a commit will be pushed. | no | — |
| root_dir | A Git root directory where a commit will be pushed. | no | — |
| pull_request_title | A pull request title. To create a pull request, this is required. | no | — |
| pull_request_base_branch | A pull request base branch. To create a pull request, this is required. | no | — |
| pull_request_body | A pull request body. | no | — |
| pull_request_labels | Pull request labels. Each label is separated by a newline. Note that labels must exist in the repository. This action doesn't create labels. | no | — |
| pull_request_draft | Create a pull request as draft. | no | false |
| pull_request_reviewers | Pull request reviewers. Each reviewer is separated by a newline. | no | — |
| pull_request_team_reviewers | Pull request team reviewers. This requires the `members:read` permission. Each reviewer is separated by a newline. | no | — |
| pull_request_assignees | Pull request assignees. Each assignee is separated by a newline. | no | — |
| project_owner | Project owner where the pull request is added. | no | — |
| project_number | Project number where the pull request is added. | no | — |
| project_id | Project id where the pull request is added. | no | — |
| milestone_number | Milestone number where the pull request is added. | no | — |
| automerge_method | auto-merge method. One of "merge", "squash", or "rebase". By default, auto-merge is disabled. | no | — |
| custom | Custom parameter in JSON object format. This is passed to the server side and output as the `custom` output of the prepare or server action. | no | — |
| workflow_name | Client Workflow name. If this is empty, the action does not check the workflow name. | no | securefix |
| allow_workflow_fix | Either true or false. If true, the action allows the workflow to fix the code. | no | false |
| allow_members_read | Either true or false. If true, the members:read permission is granted. | no | false |
| allow_organization_projects_write | Either true or false. If true, the organization-projects:write permission is granted. | no | false |
| commit_error | The output error of the commit action. | no | — |
| config | YAML config to push other repositories and branches. | no | — |
| config_file | A file path to YAML config. | no | — |
| label_name | Label name to trigger the action. | no | ${{github.event.label.name}} |
| label_description | Label description to trigger the action. The format must be <repository owner>/<repository name>/<workflow run ID>. | no | ${{github.event.label.description}} |
| delete_label | Either true or false. If true, the label is deleted. | no | true |
| github_token_to_delete_label | GitHub token to delete the label. | no | ${{github.token}} |
Outputs
| name | description |
|---|---|
| artifact_name | The name of the uploaded artifact. |
| changed_files | Changed files. |
| changed_files_from_root_dir | Changed files from the root directory. |
| branch | The branch where the commit will be pushed. |
| client_repository | The client repository full name. |
| create_pull_request | JSON serialized pull request creation parameters. |
| fixed_files | Newline-separated list of fixed files. |
| github_token | GitHub App installation token for the destination repository. |
| metadata | JSON serialized metadata from the client. |
| custom | Custom parameter from the client in JSON object format. |
| push_repository | The destination repository full name. |
| pull_request | JSON serialized pull request data of the client's pull request. |
| new_pull_request | JSON serialized pull request data of the newly created pull request. |
| workflow_run | JSON serialized workflow run data. |