AutoFix PR Configuration

Pull Request Configuration

You can configure the AutoFix pull requests to your own needs with the "PR Configuration" settings. It's possible to change the following fields:

• Title Prefix: Customize the title to match your internal processes
• Labels: Add specific labels to the PR for easier sorting and tracking
• Branch name: Customize the prefix of the branch Autofix creates
• Commit Message: Customize the prefix of the commit message in the PR
• Summary: Optionally include an additional message for each PR. For example add custom instructions for engineers or additional context.
• Create Draft PR: create draft PRs instead of ready for review.
• Auto-Merge PR: Aikido relies on built-in Github, Gitlab and Azure DevOps auto-merge features for this, learn more here.
• Create Task for PR: important for compliance reasons. This will automatically create a new task in your connected task tracker, linking to the created PR.

Linking Pull Requests with Tasks

There are two ways to link AutoFix pull requests to tasks, both can be used at the same time.

1. Linking Existing Tasks

Task identifiers for issues fixed in the PR are included in the branch name by default. If your workspace is integrated with a task tracker, the PR will automatically be linked to the corresponding task by the task tracker.

The task reference placeholder ($TASK_REF ) can be used in the following Pull Request Configuration fields:

• Branch prefix
• Commit message
• PR title

1. Create a new task per PR

Creating a task for each AutoFix PR can be used to assign people to review and merge the AutoFix PRs. Enable "Create task for PR" in your AutoFix configuration. A task will be created for each AutoFix PR whether it is linked with existing tasks or not.

Note: this option is currently only available for Jira and Jira DC.

Repository-specific configuration

Global AutoFix settings in the Aikido UI apply to all repositories within the Aikido workspace. To configure settings specific to a repository, use the .aikido file located at the root of the repo. The configurations specified in this file will override the global settings.

For example, this configuation:

.aikido

autofix:
  single_pr_for_repo: true
  pr_config:
    branch_prefix: "aikido-"
    title_prefix: "Aikido "
    commit_prefix: "[fix] "
    labels: "security"
    draft_pr: false
    auto_merge: true
    create_task_for_pr: true
    task_title_prefix: "[AIK] "
    disable_codeowners_as_reviewers: true

• creates a single PR for all lockfiles in the repo
• the branch name starts with aikido-
• the PR title starts with Aikido
• the commit starts with [fix]
• the PR has a label security
• the PR is not a draft PR
• the PR will be auto-merged by the SCM (eg Github) when the required approvals are present
• a task (eg. Jira) is created for the PR
• the title of the task (eg. Jira) starts with [AIK]
• Gitlab specific: the codeowners will not be added as reviewers on the PR

The sections below explain each configuration parameter in detail.

Branch prefixes

Branch prefixes can be configured per repo by adding a .aikido file at the root level of the repo with the following contents:

.aikido

autofix:
  pr_config:
    branch_prefix: "prefix-for-branch-"

AutoFix will use the branch_prefix value when creating a branch for that specific repository. For this example AutoFix will create branches like prefix-for-branch-update-dependency-xyz.

The branch prefix defined in the .aikido file takes priority over the branch prefix configured in the UI.

Branch template

AutoFix creates a unique branch name by adding a random identifier to the branch name. This random identifier might not match your branch naming rules. In this case a branch template can be used to fully define the branch name format.

In many organizations these branch naming rules are used to enforce linking between tasks and branches. The following configuration makes AutoFix create specific branch names:

.aikido

autofix:
  pr_config:
    branch_template: fix/$TASK_REF

The $TASK_REF is replaced by the tasks linked with the issue fixed in the Pull Request. For example: fix/AIK-1234 for a single task or fix/AIK-1234-AIK-4567 for multiple tasks.

If you have Create task for Pull Request enabled, the automatically created task identifier will be using in the branch name.

In case your branch format is very strict and allows only a single ticket, you can use $TASK_REF_0 to only include a single task identifier.

Pull request title prefixes

Pull request title prefixes can be configured per repo by adding a .aikido file at the root level of the repo with the following contents:

.aikido

autofix:
  pr_config:
    title_prefix: "Title Prefix"

AutoFix will start the pull request title with Title Prefix . The title prefix defined in the .aikido file takes priority over the branch prefix configured in the UI.

Commit prefixes

Commit prefixes can be configured per repo by adding a .aikido file at the root level of the repo with the following contents:

.aikido

autofix:
  pr_config:
    commit_prefix: "fix: "

AutoFix will use the commit_prefix value when creating a commit for that specific repository. For this example AutoFix will create commits like fix: updating package uuid

The commit prefix defined in the .aikido file takes priority over the commit prefix configured in the UI.

Labels

Labels can be configured per repo by adding a .aikido file at the root level of the repo with the following contents:

.aikido

autofix:
  pr_config:
    labels: "aikido,security"

AutoFix will use the labels value when creating a Pull Request for that specific repository. For this example AutoFix add both the aikido and security label on the pull requests.

The labels defined in the .aikido file takes priority over the labels configured in the UI. When defined in the .aikido file, the labels configured in the UI are ommitted.

Draft PR

Draft PR can be configured per repo by adding a .aikido file at the root level of the repo with the following contents:

.aikido

autofix:
  pr_config:
    draft_pr: true

The example above creates Pull Requests as Draft for the specific repo.

The draft PR configuration in the .aikido file takes priority over the draft PR configuration in the UI.

Auto-merge

Auto-merging can be configured per repo by adding a .aikido file at the root level of the repo with the following contents:

.aikido

autofix:
  pr_config:
    auto_merge: true

The example above enables auto-merging for the specific repo.

The auto-merge configuration in the .aikido file takes priority over the auto-merge configuration in the UI.

Create task for PR

AutoFix automatically creates a task in your issue tracker when a pull request is opened in Aikido. This is useful for maintaining remediation traceability required by compliance standards.

Creating a task can be enabled or disabled for a specific repo by adding a .aikido file at the root level of the repo with the following contents:

.aikido

autofix:
  pr_config:
    create_task_for_pr: true

The example above enables creating a task for the specific repo. The configuration in the .aikido file takes priority over the configuration in the UI.

Task title prefix

When "create task for PR" is enabled, a prefix for the task title can be configured per repo by adding a .aikido file at the root level of the repo with the following contents:

.aikido

autofix:
  pr_config:
    task_title_prefix: "[AIK] "

The example makes sure the task created for the PR starts with [AIK] in the specific repo.

The configuration in the .aikido file takes priority over the configuration in the UI.

Disabling CODEOWNERS as reviewers

For Gitlab, Aikido AutoFix will add the CODEOWNERS as reviewers on Merge Requests (if there are less than 10 CODEOWNERS for the lockfile). This behavior can be disabled by adding a .aikido file at the root level of the repo with the following contents:

.aikido

autofix:
  pr_config:
    disable_codeowners_as_reviewers: true

Grouping AutoFixes per lockfile or per repo

By default, Aikido AutoFix creates a separate Pull Request per lockfile in your repository. This keeps changes isolated and easy to review for standard projects.

For repos with many lockfiles owned by a single team, receiving many individual PRs can be noisy. Enabling a single Pull Request per repository reduces the administrative overhead and CI/CD usage.

To change this behavior, add a .aikido file at the root level of the repo with the following contents:

.aikido

autofix:
    single_pr_for_repo: true