plan-code-scanning-remediation

Fetch open alerts via the gh api code-scanning endpoint, read each flagged source file to confirm the vulnerable pattern still exists, and check open PRs for existing coverage. Then group verified alerts by rule ID or subsystem into focused remediation features.

Group alerts that share the same rule ID in one file or directory, the same rule family in one subsystem, or the same source/sink pattern and verification path. Never mix unrelated languages, rule families, or ownership areas in one feature.

Use this Skill only for code scanning alerts such as CodeQL and SAST findings in your own source code. For dependency vulnerabilities from tools like Dependabot, use the plan-vulnerability-remediation skill instead.

No, this Skill is strictly read-only planning. It never modifies source code, workflows, branches, or config; it only produces or updates a remediation epic document under docs/epics with grouped findings and verification guidance.

Each alert group gets a stable group_id, a predictable branch name like security/<group_id>, and an HTML PR marker comment embedding the group ID, alert numbers, and rule IDs. Re-running the workflow updates the existing epic instead of creating duplicates.