Set up Contrast AI SmartFix

This example shows how to set up SmartFix in a .github/workflows/smartfix.yml workflow file. It uses Anthropic Claude Sonnet as the LLM.

name: Contrast AI SmartFix

on:
  pull_request:
    types:
      - closed # For notifying backend when a SmartFix PR is closed without merging
  schedule:
    - cron: '0 0 * * *' # Runs daily at midnight UTC. Adjust as needed.
  workflow_dispatch: # Allows manual triggering

permissions:
  contents: write
  pull-requests: write

jobs:
  generate_fixes:
    name: Generate Fixes
    runs-on: ubuntu-latest
    if: github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Required for SmartFix to analyze code history

      - name: Run Contrast AI SmartFix - Generate Fixes
        uses: Contrast-Security-OSS/contrast-ai-smartfix-action@v1 # Use the latest appropriate version
        with:
          # --- Contrast Configuration (Required) ---
          contrast_host: ${{ vars.CONTRAST_HOST }} # e.g., https://app.contrastsecurity.com
          contrast_org_id: ${{ vars.CONTRAST_ORG_ID }}
          contrast_app_id: ${{ vars.CONTRAST_APP_ID }}
          contrast_authorization_key: ${{ secrets.CONTRAST_AUTHORIZATION_KEY }}
          contrast_api_key: ${{ secrets.CONTRAST_API_KEY }}

          # --- GitHub Configuration (Required) ---
          github_token: ${{ secrets.GITHUB_TOKEN }} # For PR creation
          base_branch: main # Or your project's default branch

          # --- Build Configuration (Required) ---
          build_command: mvn clean verify # IMPORTANT: Replace with your project's build command that includes tests. e.g., gradle clean build test\'

          # --- LLM Configuration (BYOLLM - Choose ONE provider) ---
          # Option 1: Anthropic Claude Sonnet via AWS Bedrock (Recommended)
          agent_model: bedrock/us.anthropic.claude-3-7-sonnet-20250219-v1:0 # Check LiteLLM docs for latest model strings
          aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws_region_name: us-east-1 # Or your AWS region
          # aws_session_token: ${{ secrets.AWS_SESSION_TOKEN }} # Optional
          # aws_profile_name: ${{ vars.AWS_PROFILE_NAME }} # Optional
          # aws_role_name: ${{ vars.AWS_ROLE_NAME }} # Optional
          # aws_session_name: ${{ vars.AWS_SESSION_NAME }} # Optional
          # aws_web_identity_token: ${{ secrets.AWS_WEB_IDENTITY_TOKEN }} # Optional
          # aws_bedrock_runtime_endpoint: ${{ vars.AWS_BEDROCK_RUNTIME_ENDPOINT }} # Optional, for custom Bedrock endpoints

          # Option 2: Anthropic Claude Sonnet via Direct Anthropic API
          # agent_model: anthropic/claude-3-7-sonnet-20250219
          # anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}

          # Option 3: Google Gemini Pro via Google AI Studio (Experimental)
          # agent_model: gemini/gemini-2.5-pro-latest
          # gemini_api_key: ${{ secrets.GEMINI_API_KEY }}

          # Option 4: Azure OpenAI (Experimental)
          # agent_model: azure/<your-deployment-name> # e.g., azure/gpt-4-turbo
          # azure_api_key: ${{ secrets.AZURE_API_KEY }}
          # azure_api_base: ${{ vars.AZURE_API_BASE }} # e.g., https://<your-resource-name>.openai.azure.com
          # azure_api_version: ${{ vars.AZURE_API_VERSION }} # e.g., 2024-02-15-preview

          # --- Optional Configuration ---
          formatting_command: mvn spotless:apply # If your project uses a code formatter
          max_open_prs: 5
          debug_mode: false # Set to true for verbose logs
          # enable_full_telemetry: true # Set to false to disable full telemetry
          # skip_writing_security_test: false
          # max_qa_attempts: 6  # Max number of QA Agent runs SmartFix will attempt to fix the vulnerability and get the build in a passing state before giving up.
          # max_events_per_agent: 120  # Max number of "turns" each agent can take before giving up

  handle_pr_merge:
    name: Handle PR Merge
    runs-on: ubuntu-latest
    if: github.event.pull_request.merged == true && contains(github.event.pull_request.head.ref, 'smartfix/remediation-')
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Notify Contrast on PR Merge
        uses: Contrast-Security-OSS/contrast-ai-smartfix-action@v1
        with:
          run_task: merge
          github_token: ${{ secrets.GITHUB_TOKEN }}
          contrast_host: ${{ vars.CONTRAST_HOST }}
          contrast_org_id: ${{ vars.CONTRAST_ORG_ID }}
          contrast_app_id: ${{ vars.CONTRAST_APP_ID }}
          contrast_authorization_key: ${{ secrets.CONTRAST_AUTHORIZATION_KEY }}
          contrast_api_key: ${{ secrets.CONTRAST_API_KEY }}
        env:
          GITHUB_EVENT_PATH: ${{ github.event_path }}

  handle_pr_closed: # Handles PRs closed WITHOUT merging
    name: Handle PR Close
    runs-on: ubuntu-latest
    if: github.event.pull_request.merged == false && contains(github.event.pull_request.head.ref, 'smartfix/remediation-')
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Notify Contrast on PR Closed
        uses: Contrast-Security-OSS/contrast-ai-smartfix-action@v1
        with:
          run_task: closed
          github_token: ${{ secrets.GITHUB_TOKEN }}
          contrast_host: ${{ vars.CONTRAST_HOST }}
          contrast_org_id: ${{ vars.CONTRAST_ORG_ID }}
          contrast_app_id: ${{ vars.CONTRAST_APP_ID }}
          contrast_authorization_key: ${{ secrets.CONTRAST_AUTHORIZATION_KEY }}
          contrast_api_key: ${{ secrets.CONTRAST_API_KEY }}
        env:
          GITHUB_EVENT_PATH: ${{ github.event_path }}