LegacyFixer
How LegacyFixer works
A self-service GitHub App workflow for Python dependency-security maintenance.
Workflow
- A repository owner signs in with GitHub and creates a workspace.
- The GitHub App is installed only on repositories selected during installation.
- A repository push triggers a webhook event.
- LegacyFixer queues and runs a dependency-security scan.
- The scan outcome is recorded and displayed in the authenticated workspace dashboard.
- Pull request creation remains disabled by default and can be enabled only through explicit repository-level settings.
Default behavior
The recommended first onboarding path is passive monitoring. LegacyFixer records findings and does not open a pull request.
When pull request creation is enabled, fixes are proposed through isolated branches and reviewable pull requests. LegacyFixer does not auto-merge.
Current validated coverage
LegacyFixer has been validated for selected Python dependency layouts including requirements.txt, nested requirements.txt, poetry.lock, Pipfile.lock, and setup.cfg install_requires.
Behavioral cases validated include passive findings, dependency conflicts, dependency hell, PR diff granularity, and no PR creation in passive mode.