trial

.github/workflows/snyk-gemini-fix.yml

@@ -0,0 +1,91 @@
+name: Snyk + Gemini Auto-Fix
+
+on:
+  push:
+    branches: [ os-fix-try ]
+  workflow_dispatch: # Allows manual triggering
+
+jobs:
+  gemini-remediation:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install Snyk & Gemini CLI
+        run: |
+          npm install -g snyk @google/gemini-cli
+          # gemini --install-plugin core-automation
+          # Optional: Configure Snyk as a tool for Gemini using MCP
+          npx -y snyk@latest mcp configure --tool=gemini-cli --rule-type=smart-apply
+
+      - name: Run Snyk Scan
+        id: snyk
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        run: |
+          # Generate JSON report for Gemini to consume
+          # We use '|| true' to prevent the action from stopping here
+          snyk test . --json > snyk_results.json || echo "HAS_VULNS=true" >> $GITHUB_ENV
+      - name: Configure Gemini Policy (FIXED)
+        run: |
+          mkdir -p ~/.gemini
+          # The filename must be settings.json for the 2026 security engine
+          cat <<EOF > ~/.gemini/settings.json
+          {
+            "tools": {
+              "shell": {
+                "enabled": true,
+                "allowedCommands": ["snyk *", "npm *", "git *"]
+              },
+              "files": {
+                "enabled": true,
+                "allowedDirectories": ["./"]
+              }
+            },
+            "yolo": true
+          }
+          EOF
+      - name: Gemini AI Fixer (FIXED)
+        if: env.HAS_VULNS == 'true'
+        env:
+          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+          GEMINI_CLI_TRUST_WORKSPACE: true
+        run: |
+          # 1. We use --tools=all to make sure the model 'sees' the shell tool
+          # 2. We use a System Instruction to force the correct tool name
+          gemini --yolo -p "
+            SYSTEM: You are a security agent. Use 'run_shell' for terminal commands and 'edit_file' for code changes.
+
+            TASK: 
+            Analyze snyk_results.json. 
+            1. For each high vulnerability, use 'run_shell' to try 'snyk fix'.
+            2. If 'snyk fix' doesn't work, use 'read_file' and 'edit_file' to patch manually.
+            3. Run 'snyk test --json' to verify the fix.
+            4. Only stop once high-severity issues are resolved.
+          "
+      - name: Create Pull Request
+        if: env.HAS_VULNS == 'true' || env.HAS_CODE_VULNS == 'true'
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: "security: Gemini-automated vulnerability remediation"
+          title: "🚀 Gemini Security Fixes"
+          body: |
+            This PR was generated by Gemini CLI in response to a failed Snyk scan.
+
+            **Changes applied:**
+            - Fixed vulnerabilities identified in `snyk_results.json`
+            - Updated dependencies/code to meet security standards.
+            - Verified with a follow-up Snyk scan.
+          branch: gemini-security-patch