Skip to content

Use GPT-5.5 for security workflows #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
ulziibay-kernel wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

Use GPT-5.5 for security workflows #17

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 8 additions & 12 deletions .github/workflows/container-remediation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,18 +101,16 @@ jobs:
with:
name: container-scan-report

- name: Install Claude Code CLI
run: |
curl -fsSL https://claude.ai/install.sh | bash
echo "$HOME/.local/bin" >> $GITHUB_PATH
- name: Install Codex CLI
run: npm install -g @openai/codex

- name: Triage findings
env:
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
run: |
curl -fsSL "https://raw.githubusercontent.com/kernel/security-workflows/${{ inputs.security-workflows-ref }}/.github/workflows/container-scan/triage-prompt.md" \
| envsubst '${GITHUB_REPOSITORY}' \
| claude -p --model ${{ vars.CLAUDE_CODE_PREFERRED_MODEL }} --dangerously-skip-permissions --output-format text --verbose
| codex exec --model gpt-5.5 --dangerously-bypass-approvals-and-sandbox --ephemeral -

- name: Upload triage results
uses: actions/upload-artifact@v4
Expand Down Expand Up @@ -172,23 +170,21 @@ jobs:
env:
GOPRIVATE: github.com/kernel/*

- name: Install Claude Code CLI
run: |
curl -fsSL https://claude.ai/install.sh | bash
echo "$HOME/.local/bin" >> $GITHUB_PATH
- name: Install Codex CLI
run: npm install -g @openai/codex

- name: Apply fixes
timeout-minutes: 8
env:
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
GOPRIVATE: github.com/kernel/*
GO_MODULE_DIR: ${{ inputs.go-version-file != '' && format('{0}', inputs.go-version-file) || '.' }}
run: |
export DATE="$(date -u +%Y-%m-%d)"
export GO_MODULE_DIR="$(dirname "$GO_MODULE_DIR")"
curl -fsSL "https://raw.githubusercontent.com/kernel/security-workflows/${{ inputs.security-workflows-ref }}/.github/workflows/container-scan/fix-prompt.md" \
| envsubst '${GITHUB_REPOSITORY} ${DATE} ${GO_MODULE_DIR}' \
| claude -p --model ${{ vars.CLAUDE_CODE_PREFERRED_MODEL }} --dangerously-skip-permissions --output-format text --verbose
| codex exec --model gpt-5.5 --dangerously-bypass-approvals-and-sandbox --ephemeral -

- name: Check for changes
id: diff
Expand Down
10 changes: 4 additions & 6 deletions .github/workflows/semgrep.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,15 +92,13 @@ jobs:
with:
name: semgrep-results

- name: Install Claude Code CLI
run: |
curl -fsSL https://claude.ai/install.sh | bash
echo "$HOME/.local/bin" >> $GITHUB_PATH
- name: Install Codex CLI
run: npm install -g @openai/codex

- name: Triage findings
env:
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
export CODEBASE_DESCRIPTION="${{ inputs.codebase-description }}"
curl -fsSL https://raw.githubusercontent.com/kernel/security-workflows/main/.github/workflows/semgrep-triage-prompt.md | envsubst '${GITHUB_REPOSITORY} ${CODEBASE_DESCRIPTION}' | claude -p --model ${{ vars.CLAUDE_CODE_PREFERRED_MODEL }} --dangerously-skip-permissions --output-format text --verbose
curl -fsSL https://raw.githubusercontent.com/kernel/security-workflows/main/.github/workflows/semgrep-triage-prompt.md | envsubst '${GITHUB_REPOSITORY} ${CODEBASE_DESCRIPTION}' | codex exec --model gpt-5.5 --dangerously-bypass-approvals-and-sandbox --ephemeral -
18 changes: 4 additions & 14 deletions .github/workflows/vuln-remediation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,19 +264,9 @@ jobs:
if: steps.check.outputs.skip != 'true' && inputs.setup-python
run: pip install uv

- name: Install Cursor CLI
- name: Install Codex CLI
if: steps.check.outputs.skip != 'true'
run: |
curl https://cursor.com/install -fsS | bash
echo "$HOME/.cursor/bin" >> $GITHUB_PATH

- name: Enable Cursor Max Mode
if: steps.check.outputs.skip != 'true'
run: |
CFG_DIR="$HOME/.cursor"
mkdir -p "$CFG_DIR"
echo '{"maxMode": true}' > "$CFG_DIR/cli-config.json"
echo "CURSOR_CONFIG_DIR=$CFG_DIR" >> "$GITHUB_ENV"
run: npm install -g @openai/codex

- name: Install Socket CLI
if: steps.check.outputs.skip != 'true'
Expand All @@ -286,7 +276,7 @@ jobs:
if: steps.check.outputs.skip != 'true'
timeout-minutes: 10
env:
CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
GOPRIVATE: github.com/kernel/*
SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_API_TOKEN }}
run: |
Expand All @@ -305,7 +295,7 @@ jobs:

if git diff --quiet; then
export DATE="$(date -u +%Y-%m-%d)"
curl -fsSL https://raw.githubusercontent.com/kernel/security-workflows/${{ inputs.security-workflows-ref }}/.github/workflows/vuln-remediation/fix-prompt.md | envsubst '${GITHUB_REPOSITORY} ${DATE}' | agent -p --model ${{ vars.CURSOR_PREFERRED_MODEL }} --workspace . --trust --force --output-format=text
curl -fsSL https://raw.githubusercontent.com/kernel/security-workflows/${{ inputs.security-workflows-ref }}/.github/workflows/vuln-remediation/fix-prompt.md | envsubst '${GITHUB_REPOSITORY} ${DATE}' | codex exec --model gpt-5.5 --dangerously-bypass-approvals-and-sandbox --ephemeral -
fi

- name: Validate remediation diff
Expand Down
10 changes: 1 addition & 9 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,14 +87,6 @@ projectIgnorePaths:

Consumer repos need these secrets (set at org or repo level):

- `ANTHROPIC_API_KEY` — for the `semgrep.yml` triage agent (Claude Code)
- `CURSOR_API_KEY` — for the other fix/remediation agents (Cursor)
- `OPENAI_API_KEY` — for GPT-5.5 triage and remediation agents (Codex)
- `ADMIN_APP_ID` + `ADMIN_APP_PRIVATE_KEY` — GitHub App for write access
- `SOCKET_API_TOKEN` — Socket.dev API token

## Required variables

Consumer repos need these variables (set at org or repo level):

- `CLAUDE_CODE_PREFERRED_MODEL` — model for the `semgrep.yml` triage agent (Claude Code)
- `CURSOR_PREFERRED_MODEL` — model for the other Cursor agent invocations
Loading