Skip to main content

Proactive Scan & Jules-Style Issues

The CI-Native Agent does not wait for you to ask. The proactive scan workflow finds problems on its own, files them as readable GitHub Issues, and announces the fix before it arrives.

How it runs​

.github/workflows/proactive-scan.yml ships with the SquireX setup and runs:

  • On every push to main that touches agent metadata or Apex
  • On a weekly schedule (cron)
  • On demand (workflow_dispatch, the Run workflow button)

Each run executes a full SquireX scan, uploads SARIF to GitHub Advanced Security, and the resulting code_scanning_alert webhook drives the autofix loop.

What the workflow does around the scan:

  • Test fixtures are excluded. Results under test/, tests/, __tests__/ or any fixtures/ directory are dropped from the SARIF before upload and before issues are filed (regex in the SQUIREX_EXCLUDE_REGEX workflow variable). The job summary shows the total, excluded and kept counts.
  • Code scanning is checked first. If code scanning is not enabled on the repository, the SARIF upload is skipped with a notice in the job summary instead of failing the job. Issues are still filed from the filtered results. Enable code scanning to get alerts in the Security tab (and the autofix trigger).
  • Permissions. The workflow needs security-events: write, issues: write, contents: read and actions: read (the last one is required by upload-sarif on private repos).

Jules-style Issues​

For every finding, the agent files a GitHub Issue written in a first-person, conversational voice — it explains what it found, suggests a direction, and tells you a fix is already on the way:

## 🔴 I found an Excessive Agency issue in `IncidentBot.cls`

**Rule:** AGENTFORCE-1.1 — Unconfirmed Data Mutation
**Severity:** error | **Compliance:** SOC2_CC6, NIST_AI_RMF
**Triggered by:** schedule · Commit: a1b2c3d

### What I found
The agent modifies records without a user-confirmation step…

### My suggestion
Address the Excessive Agency risk in `IncidentBot.cls` by following the
patterns in the rule documentation…

> 🤖 SquireX Autonomy is generating an automated fix. A silent draft PR
> will appear on this repository shortly, ready for your review and merge.

Issues are:

  • Severity-coded — 🔴 error / 🟡 warning / 🔵 note, plus squirex:<level> and category labels
  • Deduplicated — existing open SquireX issues are fetched first; the agent never re-files the same finding
  • Linked to rule docs — every rule references its public catalog page at squirex.dev/rules/{ruleId}

Compliance tagging​

When a rule carries regulatory mappings, the agent surfaces them directly in the issue — Compliance: SOC2_CC6, NIST_AI_RMF, EU_AI_ACT, HIPAA, PCI_DSS, OWASP_MCP. This turns each autonomous finding into audit-ready evidence without a separate report.

The chain: scan → issue → silent PR​

The proactive scan and the fix loop are one continuous chain. The issue is the human-readable announcement; the silent draft PR is the action. You review both — the agent never merges.