Set up Contrast AI SmartFix

This example shows how to set up SmartFix in a .github/workflows/smartfix.yml workflow file. It uses Anthropic Claude Sonnet as the LLM.

#-
# #%L
# Contrast AI SmartFix
# %%
# Copyright (C) 2025 Contrast Security, Inc.
# %%
# Contact: support@contrastsecurity.com
# License: Commercial
# NOTICE: This Software and the patented inventions embodied within may only be
# used as part of Contrast Security’s commercial offerings. Even though it is
# made available through public repositories, use of this Software is subject to
# the applicable End User Licensing Agreement found at
# https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
# between Contrast Security and the End User. The Software may not be reverse
# engineered, modified, repackaged, sold, redistributed or otherwise used in a
# way not consistent with the End User License Agreement.
# #L%
#

name: Contrast AI SmartFix

on:
  pull_request:
    types:
      - closed
  schedule:
     - cron: '0 0 * * *' # <-- Customer configured schedule
  workflow_dispatch: # Allows manual triggering

permissions:
  contents: write
  pull-requests: write

jobs:
  generate_fixes:
    name: Generate Fixes
    runs-on: ubuntu-latest
    if: github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
          aws-region: ${{ vars.AWS_REGION }}

      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          
      - name: Run Contrast AI SmartFix - Generate Fixes Action
        uses: Contrast-Security-OSS/contrast-ai-smartfix-action@v1
        with:
          # --- Max Open PRs ---
          max_open_prs: 5
          # --- Base Branch ---
          base_branch: '${{ github.event.repository.default_branch }}'
          # --- Build Command ---
          build_command: 'mvn clean test'
          # --- Formatting Command ---
          formatting_command: 'mvn spotless:apply'
          # --- Max QA Intervention loop attempts ---
          max_qa_attempts: 6
          # --- GitHub Token ---
          github_token: ${{ secrets.GITHUB_TOKEN }}
          # --- Contrast API Credentials ---
          contrast_host: ${{ vars.CONTRAST_HOST }}
          contrast_org_id: ${{ vars.CONTRAST_ORG_ID }}
          contrast_app_id: ${{ vars.CONTRAST_APP_ID }}
          contrast_authorization_key: ${{ secrets.CONTRAST_AUTHORIZATION_KEY }}
          contrast_api_key: ${{ secrets.CONTRAST_API_KEY }}
          # --- Google Gemini API Credentials ---
          gemini_api_key: ${{ secrets.GEMINI_API_KEY }}
          # --- Anthropic API Credentials ---
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          # --- Azure Open API Credentials ---
          # azure_api_key: ${{ secrets.AZURE_API_KEY }}
          # azure_api_base: ${{ secrets.AZURE_API_BASE }}
          # azure_api_version: ${{ secrets.AZURE_API_VERSION }}
          # --- Agent Configuration ---
          agent_model: ${{ vars.AGENT_MODEL || 'bedrock/us.anthropic.claude-3-7-sonnet-20250219-v1:0' }}
          # Other Optional Inputs (see action.yml for defaults and more options)
          # formatting_command: 'mvn spotless:apply' # Or the command appropriate for your project to correct the formatting of SmartFix\'s changes.  This ensures that SmartFix follows your coding standards.
          # max_open_prs: 5 # This is the maximum limit for the number of PRs that SmartFix will have open at single time
          # enable_full_telemetry: 'false' # Set to false to disable full telemetry

  handle_pr_merge:
    name: Handle PR Merge
    runs-on: ubuntu-latest
    if: github.event.pull_request.merged == true && contains(github.event.pull_request.head.ref, 'smartfix/remediation-')
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Notify Contrast on PR Merge
        uses: Contrast-Security-OSS/contrast-ai-smartfix-action@v1
        with:
          run_task: merge 
          # --- GitHub Token ---
          github_token: ${{ secrets.GITHUB_TOKEN }}
          # --- Contrast API Credentials ---
          contrast_host: ${{ vars.CONTRAST_HOST }}
          contrast_org_id: ${{ vars.CONTRAST_ORG_ID }}
          contrast_app_id: ${{ vars.CONTRAST_APP_ID }}
          contrast_authorization_key: ${{ secrets.CONTRAST_AUTHORIZATION_KEY }}
          contrast_api_key: ${{ secrets.CONTRAST_API_KEY }}
        env: 
          GITHUB_EVENT_PATH: ${{ github.event_path }}
  
  handle_pr_closed:
    name: Handle PR Close
    runs-on: ubuntu-latest
    if: github.event.pull_request.merged == false && contains(github.event.pull_request.head.ref, 'smartfix/remediation-')
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Notify Contrast on PR Closed
        uses: Contrast-Security-OSS/contrast-ai-smartfix-action@v1
        with:
          run_task: closed
          # --- GitHub Token ---
          github_token: ${{ secrets.GITHUB_TOKEN }}
          # --- Contrast API Credentials ---
          contrast_host: ${{ vars.CONTRAST_HOST }}
          contrast_org_id: ${{ vars.CONTRAST_ORG_ID }}
          contrast_app_id: ${{ vars.CONTRAST_APP_ID }}
          contrast_authorization_key: ${{ secrets.CONTRAST_AUTHORIZATION_KEY }}
          contrast_api_key: ${{ secrets.CONTRAST_API_KEY }}
        env: 
          GITHUB_EVENT_PATH: ${{ github.event_path }}