autofix-ssc-javascript

Finds open Semgrep Supply Chain (SCA) issues in package-lock.json files across a Semgrep organization — optionally scoped to one or more projects — and triggers the Semgrep Autofix API to open a fix PR for each one.

How it works

1. Resolves your deployment from SEMGREP_APP_TOKEN via GET /api/v1/deployments.
2. Pages through open SCA issues via the v2 IssuesService.ListIssues API, optionally filtered to specific project (repository) names.
3. Keeps only issues whose file path basename is package-lock.json.
4. For each match, calls the v2 AutofixService.CreateAutofix API, which asynchronously analyzes the issue and opens a pull request in the underlying repository.

Autofix is asynchronous: a successful response means the job was accepted, not that a PR has been opened yet. PRs land a bit later.

Requirements

• Python 3 (standard library only — no dependencies to install)
• A Semgrep API token with "Web API" permission, exported as SEMGREP_APP_TOKEN
• Autofix must be enabled for your organization/repositories, and the Semgrep app needs write access to the target repos (otherwise individual issues are skipped with an error, not a hard failure)

Usage

export SEMGREP_APP_TOKEN=<your token>

# Dry run — list matching issues, trigger nothing
./autofix_package_lock_sca.py

# Trigger autofix jobs (prompts for confirmation)
./autofix_package_lock_sca.py --apply

# Skip the prompt, cap the run at 5 issues
./autofix_package_lock_sca.py --apply --yes --limit 5

# If your token can access more than one deployment
./autofix_package_lock_sca.py --deployment-slug my-org-slug

# Scope to a single project
./autofix_package_lock_sca.py --project my-frontend-repo

# Scope to a list of projects read from a CSV file
./autofix_package_lock_sca.py --projects-csv projects.csv --apply

Flags

Flag	Description
--deployment-slug SLUG	Deployment to use, if the token can access more than one
--project NAME	Name of a Semgrep project to scan (repeatable). Combines with --projects-csv
--projects-csv PATH	CSV file listing Semgrep project names to scan
--limit N	Cap the number of autofix jobs triggered
--apply	Actually trigger autofix jobs (default is dry run — list only)
--yes	Skip the confirmation prompt when applying

If neither --project nor --projects-csv is given, the whole organization is scanned (previous behavior).

CSV format

One project name per row. A header of project, project_name, repository, or name (case-insensitive) is used to find the right column; otherwise the first column of every row is used, so a plain headerless single-column list also works:

project
frontend-app
checkout-service
internal-tools

Output

The script prints, per issue: issue id, repository name, file path, and rule id. It never prints finding messages, code snippets, or the API token.

Per-issue Autofix errors (e.g. credits exhausted, no write access, fix already in flight, unsupported issue type) are reported individually and do not abort the rest of the run.

Notes

• ListIssues' filePaths filter is a fuzzy search that's silently ignored unless "Duplo" is enabled for the deployment, so this script filters by ISSUE_TYPE_SCA server-side and matches package-lock.json client-side instead, which works regardless of account configuration.
• ListIssues requires filter.onPrimaryBranch to be set explicitly (the API rejects requests without it: "requires a branch filter to return accurate, deduplicated results"). This script sets it to true so results are deduplicated to each project's default branch.
• Both API endpoints used here are in Beta per Semgrep's API docs; expect possible breaking changes.