resolve-github-alerts

Resolve GitHub Alerts

This skill resolves all GitHub security alerts: Dependabot alerts, code scanning alerts, and secret scanning alerts.

Constants

• Label: automated/resolve-github-alerts
• Branch: automated/resolve-github-alerts
• Base branch: detect at runtime — do not hardcode main. Most repos use main, but some use master, develop, or trunk. Run gh repo view --json defaultBranchRef --jq .defaultBranchRef.name once at the start of execution and use the result everywhere a base branch is needed (PR creation, branch creation, etc.).

Setup

At the start of execution, derive the GitHub owner and repo. Use git remote get-url origin from the current working directory (works in both the main checkout and git worktrees):

OWNER_REPO=$(git remote get-url origin | sed -E 's#.*(github\.com[:/])##;s/\.git$//')
OWNER=${OWNER_REPO%/*}
REPO=${OWNER_REPO#*/}

Use $OWNER and $REPO in all gh CLI commands below.

Worktree Awareness

This skill may run inside a git worktree. Observe these rules:

• Derive repo root from git rev-parse --show-toplevel, never hard-code a path.
• All file reads/edits must use paths relative to the worktree root, not the main checkout.
• git remote, git fetch, git push, and gh commands work unchanged in a worktree because they share the main repo's remote configuration.
• Do not run git worktree add/remove — the caller manages the worktree lifecycle.

Resolution Priority

1. Fix the root cause in code — All fixes must be committed as code changes: dependency upgrades in the project's manifest/lockfiles (e.g. requirements*.{in,txt}, pyproject.toml, poetry.lock, uv.lock, package.json, Cargo.toml, go.mod), Dockerfile base image tags, GitHub Actions versions, or application code fixes in the project's source tree. Never apply ad hoc fixes via manual steps. Never add lint exclusions or scanner ignores.
2. Dismiss only for confirmed false positives — Only dismiss alerts for test credentials, false positives, or transitive dependencies with no available patch.
3. Create GitHub issues as last resort — Only when the fix requires human judgment or access you don't have.