From d97ada35726df0b40463ab40bf59ae45bc49658f Mon Sep 17 00:00:00 2001 From: Abdelrahman Shawki Hassan Date: Thu, 6 Aug 2026 11:12:52 +0200 Subject: [PATCH] ci: enable the agentic Open Source fix [AG-387] snyk/prodsec-orb#166 is merged and released in v1.2.29, so this no longer needs a dev orb pin - the orb reference stays at @1 and picks the feature up. main already carries the prodsec-orb-runtime context, which is where REMY_LITELLM_API_KEY, REMY_LITELLM_BASE_URL, REMY_LITELLM_MODEL and REMY_GITHUB_TOKEN come from, so this is now a single parameter. When the Enhanced Gate blocks the Open Source scan the job still fails exactly as it does today, and in addition `snyk fix --agentic` runs against the blocking vulnerabilities and opens a pull request against the branch that failed. The fix step always exits 0, so it cannot turn a passing build red or mask a failure. Rebuilt on main rather than rebased: the branch's previous commits were dev-orb bumps that have no meaning now the orb is released. Co-Authored-By: Claude Opus 5 (1M context) --- .circleci/config.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.circleci/config.yml b/.circleci/config.yml index ec62078ac..79dbff127 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -20,6 +20,7 @@ jobs: - install - prodsec/security_scans: mode: auto + open-source-agentic-fix-enabled: true open-source-additional-arguments: --exclude=mocked_data iac-scan: disabled