securego / gosec

Go security checker
https://securego.io
Apache License 2.0
7.71k stars 606 forks source link

Add support to generate auto fixes using LLM (AI) #1177

Closed tran-the-lam closed 1 month ago

tran-the-lam commented 1 month ago

This feature adds support to generate auto fixes for Go scanning findings using LLM (AI). In a first instance, it relies on Gemini API to get a suggestion for a solution. This can be later extended, to integrate also other AI providers.

tran-the-lam commented 1 month ago

Example Output: Screenshot 2024-07-31 at 22 18 26

tran-the-lam commented 1 month ago

@ccojocar Please review this pr

ccojocar commented 1 month ago

Also after you address the review suggestions, please fix the lint warnings. Thanks

ccojocar commented 1 month ago

Also make sure that all checks are passing. The CI is still failing.

ccojocar commented 1 month ago

There are some issue to fix in the build/tests https://github.com/securego/gosec/actions/runs/10259787997/job/28392108382?pr=1177. Otherwise look good! Thanks

ccojocar commented 1 month ago

Unit tests are failing and it seems related to this change, please have a look at https://github.com/securego/gosec/actions/runs/10264724512/job/28456313532?pr=1177#step:5:98

tran-the-lam commented 1 month ago

@ccojocar Please review and merge.

codecov-commenter commented 1 month ago

:warning: Please install the 'codecov app svg image' to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

Attention: Patch coverage is 47.76119% with 35 lines in your changes missing coverage. Please review.

Project coverage is 69.13%. Comparing base (f33fd4b) to head (f97e82f).

Files Patch % Lines
autofix/ai.go 41.50% 30 Missing and 1 partial :warning:
cmd/gosec/main.go 0.00% 4 Missing :warning:

:exclamation: Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files ```diff @@ Coverage Diff @@ ## master #1177 +/- ## ========================================== - Coverage 69.52% 69.13% -0.39% ========================================== Files 71 72 +1 Lines 3865 3930 +65 ========================================== + Hits 2687 2717 +30 - Misses 1061 1095 +34 - Partials 117 118 +1 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.