autofix-ssc-javascript

Finds open Semgrep Supply Chain (SCA) issues in package-lock.json files across a Semgrep organization — optionally scoped to one or more projects — and triggers the Semgrep Autofix API to open a fix PR for each one.

This is an example script of how to use the apis to automate tasks. It is not officially supported by Semgrep.

How it works

1. Resolves your deployment from SEMGREP_APP_TOKEN via GET /api/v1/deployments.
2. Pages through open SCA issues via the v2 IssuesService.ListIssues API, optionally filtered to specific project (repository) names.
3. Keeps only issues whose file path basename is package-lock.json.
4. For each match, calls the v2 AutofixService.CreateAutofix API, which asynchronously analyzes the issue and opens a pull request in the underlying repository.

Autofix is asynchronous: a successful response means the job was accepted, not that a PR has been opened yet. PRs land a bit later.

Requirements

• Python 3 (standard library only — no dependencies to install)
• A Semgrep API token with "Web API" permission, exported as SEMGREP_APP_TOKEN
• Autofix must be enabled for your organization/repositories, and the Semgrep app needs write access to the target repos (otherwise individual issues are skipped with an error, not a hard failure)

Usage

export SEMGREP_APP_TOKEN=<your token>

# Dry run — list matching issues, trigger nothing
./autofix_package_lock_sca.py

# Trigger autofix jobs (prompts for confirmation)
./autofix_package_lock_sca.py --apply

# Skip the prompt, cap the run at 5 issues
./autofix_package_lock_sca.py --apply --yes --limit 5

# If your token can access more than one deployment
./autofix_package_lock_sca.py --deployment-slug my-org-slug

# Scope to a single project
./autofix_package_lock_sca.py --project my-frontend-repo

# Scope to a list of projects read from a CSV file
./autofix_package_lock_sca.py --projects-csv projects.csv --apply

Flags

Flag	Description
--deployment-slug SLUG	Deployment to use, if the token can access more than one
--project NAME	Name of a Semgrep project to scan (repeatable). Combines with --projects-csv
--projects-csv PATH	CSV file listing Semgrep project names to scan
--limit N	Cap the number of autofix jobs triggered
--apply	Actually trigger autofix jobs (default is dry run — list only)
--yes	Skip the confirmation prompt when applying

If neither --project nor --projects-csv is given, the whole organization is scanned (previous behavior).

CSV format

One project name per row. A header of project, project_name, repository, or name (case-insensitive) is used to find the right column; otherwise the first column of every row is used, so a plain headerless single-column list also works:

project
frontend-app
checkout-service
internal-tools

Output

The script prints, per issue: issue id, repository name, file path, and rule id. It never prints finding messages, code snippets, or the API token.

Per-issue Autofix errors (e.g. credits exhausted, no write access, fix already in flight, unsupported issue type) are reported individually and do not abort the rest of the run.

Notes

• ListIssues' filePaths filter is a fuzzy search that's silently ignored unless "Duplo" is enabled for the deployment, so this script filters by ISSUE_TYPE_SCA server-side and matches package-lock.json client-side instead, which works regardless of account configuration.
• ListIssues requires filter.onPrimaryBranch to be set explicitly (the API rejects requests without it: "requires a branch filter to return accurate, deduplicated results"). This script sets it to true so results are deduplicated to each project's default branch.
• Both API endpoints used here are in Beta per Semgrep's API docs; expect possible breaking changes.