AutoFix for AI Code Analysis

AutoFix writes code fixes for security issues found by AI Code Analysis, and delivers them as pull requests (PRs). All programming languages are supported.

You can get a fix in 2 ways:

• From the AutoFix page: preview a fix, refine it, and open a PR when you're ready.
• Automatically: Aikido opens PRs in the daily static application security testing (SAST) AutoFix run, with the same settings and limits as SAST.

Prerequisites

• AutoFix is set up with write access to the repository.
• The finding points to a source code file in a connected repository.

How it works

AI Code Analysis produces a root-cause analysis for each finding. AutoFix uses that analysis to change the code that causes the issue, not only the line where it was reported.

Fix findings from the AutoFix page

1. 1

   Open the findings

   Go to AutoFix → Code and select AI Code Analysis.

2. 2

   Preview the fix

   Click Create Preview on a finding. The preview shows the code changes, and the result of running your tests against the fix when it's available.

3. 3

   Adjust the fix

   If the fix isn't quite right, click Refine with Aikido AI and describe what to change. See Refine AutoFixes with Aikido AI. Click Regenerate to start over, or Mark as Ignored if the finding doesn't need a fix.

4. 4

   Open the pull request

   Click Create PR. The dropdown next to it has more options:

   • Create PR to Specific Branch: open the PR against a branch other than the default branch, for example a release branch.
   • Create PR and Ship it: open the PR and add your repository's deploy label to it.

Create fixes automatically

AI Code Analysis findings are fixed in the daily SAST AutoFix run. They follow the same settings and limits as SAST:

• Settings: go to AutoFix → Settings, turn on Automatically fix SAST/AI Code Analysis & IaC issues, and select the repositories, severity levels, and Only private repos there.
• Limits: SAST and AI Code Analysis share the limits of the daily run. See Automatic Creation of Pull Requests.
• Grouping: findings from the same scan, with the same issue type and file, are fixed in 1 PR, with up to 5 findings per PR. The PR description explains which change fixes which finding.

Findings without a file location aren't fixed automatically.

Override the settings per repository

Use the sast section under autofix.automated in the repository's .aikido file, not iac. AI Code Analysis fixes count as high confidence, so the confidence setting doesn't skip them.

autofix:
  automated:
    sast:
      update_policy: critical_and_high_only # or all, critical_issues_only

Setting disabled: true in the sast section stops both SAST and AI Code Analysis PRs for that repository. See Repository-specific configuration for all .aikido options.

What happens after a fix is merged

When all issues linked to an AutoFix PR are resolved, for example because the fix was merged through another PR, Aikido closes the PR and deletes its branch. If someone else has pushed commits to the PR, Aikido leaves it open.

Language support

AutoFix works with all programming languages. For JavaScript codebases, it also writes new unit tests and updates existing ones. It applies linting rules to the generated code for JavaScript, Python, and .NET.

FAQ

Related