Create Fix Pull Requests with Auto-PR

Auto-PR opens a GitHub pull request that fixes a vulnerability directly from an Xray scan result, so you move from finding to fix without leaving the JFrog Platform. When a scanned resource has a vulnerability with an available fix version, the Remediation tab in the vulnerability details pane offers Create Pull Request. Xray identifies the Git repository behind the scanned resource, and the JFrog GitHub App opens a pull request that upgrades the vulnerable package or base image on the branch that produced the resource.

You trigger Auto-PR on demand, one finding at a time. Frogbot works differently: it opens fix pull requests automatically during a commit scan, without you selecting a finding. For Frogbot behavior, see Advanced Management and Configuration.

Auto-PR Use Cases

Auto-PR supports the following scanning contexts.

Xray resolves the target repository from the version control system (VCS) properties on the scanned artifact.

Before You Begin

Verify the following before you use Auto-PR:

• You have a Unified license.
  Auto-PR requires the Advanced Security and Curation entitlements, which the Unified license includes.
• You have Frogbot version 3.6.0
• You have Xray version 3.153.x
• The JFrog GitHub App is installed on the GitHub organization that owns the source repository.
• The source repository is hosted on GitHub.com.
  GitHub Enterprise, GitLab, Bitbucket, and Azure Repos are not supported.
• The vulnerability has a fix version, and the affected package is a direct dependency or a base image.
• You uploaded the artifact to Artifactory with the JFrog CLI.

Configure the Auto-PR Workflow

Auto-PR runs as a GitHub Actions workflow in the target repository. The JFrog Platform triggers the workflow, and the workflow opens the pull request. Configure each repository once.

Add the Required Secrets

In the target repository, navigate to Settings > Secrets and variables > Actions, click New repository secret, and add the following secrets:

GitHub Actions supplies GITHUB_TOKEN automatically. The workflow permissions below grant it contents: write and pull-requests: write, which the checkout and pull request steps need. Do not create a repository secret named GITHUB_TOKEN. GitHub reserves that name.

Add the Workflow File

Create the file .github/workflows/auto-pr.yml in the target repository with the following content:

name: "Frogbot Auto-PR"
on:
  workflow_dispatch:
    inputs:
      component-name:
        description: "Dependency to fix."
        required: true
      affected-version:
        description: "Currently installed vulnerable version."
        required: true
      fix-version:
        description: "Version to upgrade to."
        required: true
      branch-name:
        description: "Branch to base the fix PR on. Defaults to the repository default branch."
        required: false
      commit-hash:
        description: "Exact commit the scan ran against."
        required: false
permissions:
  pull-requests: write
  contents: write
jobs:
  auto-pr:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.commit-hash || inputs.branch-name || github.event.repository.default_branch }}

      - uses: jfrog/frogbot@v3
        env:
          JF_URL: ${{ secrets.JF_URL }}
          JF_ACCESS_TOKEN: ${{ secrets.JF_ACCESS_TOKEN }}
          JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          command: auto-pr
          component-name: ${{ inputs.component-name }}
          affected-version: ${{ inputs.affected-version }}
          fix-version: ${{ inputs.fix-version }}
          branch-name: ${{ inputs.branch-name || github.event.repository.default_branch }}
          commit-hash: ${{ inputs.commit-hash }}

Once the file is in place, the JFrog Platform triggers this workflow when you create a pull request from a scan result.

Create a Fix Pull Request

To create a fix pull request with Auto-PR:

1. Navigate to Application > Xray > Scans List. The Scans List is displayed.

2. Select the Repositories tab.

3. Select the scanned binary artifact or Docker image, then select the version. The scan report is displayed.

4. In the left menu, select Security Issues > Vulnerabilities. The list of detected vulnerabilities is displayed.

5. Select the vulnerability you want to fix. The vulnerability details pane opens.

6. Select the Remediation tab. Remediation options are grouped as Direct, Base Image, Transitive, and JFrog Research Suggestion. Best Version is selected by default.

7. Click Create Pull Request on a Direct or Base Image option. A confirmation message indicates that the process has started, and names the repository and branch when those are known.

The JFrog GitHub App opens the pull request in the target repository. You can review and merge it in GitHub as you would any other pull request. After the fix is merged, the next scan of the resource shows whether the vulnerability is resolved.

The Remediation tab also offers Least Vulnerable and Quickest Fix strategies. Create Pull Request appears only on Direct and Base Image remediations.

Base Image Upgrades

For Docker image findings, Xray identifies the base images declared in the FROM directives of your Dockerfiles and links each finding to the line that introduced it. Discovery requires no configuration.

Xray scans Dockerfile and Containerfile, including prefix and suffix variants such as Dockerfile.prod, runtime.dockerfile, and Containerfile.dev. Files such as Dockerfile.md, Dockerfile.yaml, and Dockerfile.tmpl are treated as documentation or templates and are skipped. In multi-stage builds, stages referenced by alias or index resolve to their upstream FROM and are fixed when the root image is upgraded. FROM scratch is skipped.

The pull request rewrites only the FROM line, preserving comments, --platform flags, and AS <alias> suffixes, and it touches only the files that contain the vulnerable image. Tag pins, digest pins, and combined image:tag@sha256:... pins are all preserved. If no matching FROM line is found, no pull request is opened.

Two cases are not upgraded automatically:

• Base images declared through variable substitution, such as FROM $BASE_IMAGE. Xray reports these findings but cannot rewrite them.
• Translation between a tag and a digest. If your FROM line pins by digest only, the fix version must also be a digest.

Reasons Create Pull Request Is Unavailable

When Auto-PR cannot act on a finding, Create Pull Request is disabled and the tooltip states the reason.

The button is also hidden for remediation options Auto-PR cannot apply, such as transitive dependencies that are only pinned in a lock file, and for findings that carry a JFrog Research suggestion instead of a version upgrade. If the button is missing while all prerequisites are met, ask your JFrog Platform administrator to confirm that Auto-PR is enabled.