ci: trial the agentic Open Source fix from prodsec-orb [AG-387]

[ShawkyZ]

Trials the agentic Open Source fix from snyk/prodsec-orb#166 on this repository, matching the trials on snyk-intellij-plugin#880, snyk/cli#7054 and remy-cli-extension#147.

What changes

	Before	After
prodsec orb	snyk/prodsec-orb@1	@dev:3999cf4…
open-source-agentic-fix-enabled	—	true
open-source-scan	orb default (high)	high, stated explicitly
security-scans contexts	devex_ide	+ prodsec-orb-runtime

open-source-scan: high is not a change in what blocks — it is already the orb default. It is written down because the fix is scoped by the same threshold the gate uses, so the trial's threshold should be visible rather than implicit.

How it behaves

When the Enhanced Gate blocks the Open Source scan, the job still fails exactly as it does today. In addition, snyk fix --agentic runs at the gate's own severity threshold and raises a pull request against the branch that failed. The fix step always exits 0, so it cannot turn a passing build red or mask a failure.

It has already worked end to end elsewhere: snyk-intellij-plugin#881 — 4 vulnerabilities fixed across 3 files, raised as a pull request, with the blocked job still failing.

open-source-additional-arguments is forwarded to the fix as --additional-params, so its own internal scan honours the same --exclude=mocked_data this gate uses rather than proposing changes to mocked data.

Worth knowing before merging

• Enabling the feature adds a github-cli/install step that runs on every build of this repository, not only blocked ones, because a CircleCI step cannot be made conditional on a runtime value. If that install fails it fails the job even when the gate passed.
• snyk fix runs this repository's dependency lifecycle scripts (npm ci is already part of this job) in the same job that holds the context secrets. The orb exports a repository-write GitHub token for the GitHub CLI, so those scripts can read it, alongside the Snyk token and the LLM key.
• The fix has its own safety caps — 50 files, 5000 lines, 1 MB of patch — and refuses to push if it exceeds them, or to stage .snyk, build output or credential files.

Reverting

The dev orb reference is mutable and expires after 90 days. This must move back to snyk/prodsec-orb@1 once #166 is released, or the orb stops resolving and blocks every pull request.

Verification done

• The config compiles with the packed orb inlined (circleci config validate), which is what catches parameter errors that circleci orb validate alone cannot.
• The compiled output was checked to confirm the fix step exists with PARAM_ENABLED: true, PARAM_SEVERITY_THRESHOLD: high, --exclude=mocked_data forwarded, and both contexts attached.
• Not verified: an actual blocked run on this repository. That happens the first time the gate blocks here.

🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected