chore: enable Remy agentic fixes

[fsargent]

Description

Enable Remy agentic fixes for SCA failures in the CircleCI security scan.

The security scan now passes open-source-agentic-fix-enabled: true to the ProdSec Orb.

The security scan job now uses the prodsec-orb-runtime context.

The repository access request is pending in #remy-sos-dogfooding.

Checklist

• Tests added and all succeed. N/A because this change only updates CircleCI configuration.
• Linted
• README.md updated, if user-facing. N/A because this change does not affect users.

🚨After having merged, please update the snyk-ls and CLI go.mod to pull in latest client.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[fsargent]

• chore: enable Remy agentic fixes #176 👈 (View in Graphite)
• main

---

How to use the Graphite Merge Queue

Add the label merge-queue to this PR to add it to the merge queue.

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

This stack of pull requests is managed by Graphite. Learn more about stacking.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 Security concerns Enabling agentic fixes grants an external automated agent the ability to commit code directly to the repository. While this facilitates rapid security remediation, it introduces a new vector in the software supply chain that relies on the security and integrity of the external 'Remy' agent.

⚡ Recommended focus areas for review CI Pipeline Breakage 🟠 [major] The lint-and-format job (lines 58-61) strictly enforces a zero-drift policy via git status --porcelain. If the enabled agentic fixes (line 120) commit code without running the project-specific make format, make generate, and go mod tidy commands mandated in AGENTS.md, the resulting automated commits will trigger and then fail the CI pipeline. Verify that the agent is configured to respect these project-specific requirements to avoid build failures. open-source-agentic-fix-enabled: true Environment Shadowing 🟡 [minor] Adding the prodsec-orb-runtime context (line 135) to the same job as codesec_code-integrations (line 134) creates a risk of environment variable collisions. CircleCI resolves conflicts by choosing the last context in the list. Ensure that prodsec-orb-runtime does not unintentionally overwrite keys (e.g., SNYK_TOKEN or GITHUB_TOKEN) required by the primary security scan logic. - prodsec-orb-runtime

📚 Repository Context Analyzed This review considered 4 relevant code sections from 4 files (average relevance: 0.71) CONTRIBUTING.md (lines 1-203) README.md (lines 1-152) internal/analysis/fake.json (lines 7-11) internal/deepcode/pacts/code-client-go-snykcodeapi.json (lines 319-336)

🤖 Repository instructions applied (from AGENTS.md)