How mattandrea02/agentic-dsec works
Agentic DSEC is a post-SAST remediation service: a CI client submits immutable run coordinates for a completed SonarQube analysis, then a queued worker produces reviewable remediation artifacts and can optionally publish an issue or pull request. The graph follows the documented service roles and the sampled pipeline/node calls. Service internals beyond the excerpts are represented only where their role is documented; uncertain wiring is omitted.
Main entry points: graph_builder.py LangGraph workflow · runner.py Run executor · api.py Trigger API · nodes.py Fetch findings
Components 23
Run service
- Trigger API
src/service/api.py - Run policy
src/service/policy.py - Durable queue
src/service/store.py - Single worker
src/service/worker.py - Run executor
src/service/runner.py
Analysis pipeline
- Pinned checkout
src/service/repository.py - Sonar adapter
src/service/sonar.py - Pipeline entry
src/application/pipeline.py - LangGraph workflow
src/graph/graph_builder.py - Fetch findings
src/graph/nodes.py - Prioritize findings
src/nodes/prioritazion_agent.py - Build report
src/nodes/report_builder.py
Remediation generation
- LLM client
src/core/llm_client.py - Explain and recommend
src/core/chain_builder.py - Code-fix agent
src/agents/agent.py - Generate code fixes
src/graph/nodes.py
Artifacts and publishing
- GitHub publishing
src/core/git_workflow.py - Git and GitHub tools
src/tools/git_tools.py - Run artifacts
Other components
- Repository CI
- SonarQube
- Configured LLM
- GitHub
Connections 25
- Repository CI → Trigger API: submits run
- Trigger API → Run policy: validates run
- Trigger API → Durable queue: enqueues run
- Single worker → Durable queue: claims run
- Single worker → Run executor: executes run
- Run executor → Pinned checkout: pins source
- Pinned checkout → GitHub: clones commit
- Run executor → Sonar adapter: loads analysis
- Sonar adapter → SonarQube: reads results
- Run executor → Pipeline entry: starts pipeline
- Pipeline entry → LangGraph workflow: invokes graph
- LangGraph workflow → Fetch findings: dispatches stage
- Fetch findings → Prioritize findings: prioritizes findings
- Fetch findings → Build report: builds report
- LangGraph workflow → Explain and recommend: runs analysis chains
- Explain and recommend → LLM client: creates model
- LLM client → Configured LLM: calls model
- LangGraph workflow → Generate code fixes: dispatches fixes
- Generate code fixes → Code-fix agent: requests code changes
- Code-fix agent → LLM client: creates agent model
- LangGraph workflow → Run artifacts: writes report and patch
- LangGraph workflow → GitHub publishing: publishes when enabled
- GitHub publishing → Git and GitHub tools: uses Git operations
- Git and GitHub tools → GitHub: creates issue or PR
- GitHub → Repository CI: awaits human review