Skip to main content
On this page

Fix findings

After you review a finding, choose the fix workflow available to you. Always read and test the resulting change before merging it.

Copy a prompt

Select Copy prompt, then paste the prompt into your coding tool. The prompt includes the finding’s context and suggested improvement; you remain in control of the implementation, tests, and pull request.

Ask Rose to prepare a fix

If Run fixes is available, select between 1 and 10 active findings, then select Run fixes. Rose prepares the selected changes together on one branch and opens one pull request.

Rose findings list for Acme Checkout with three high-severity findings selected and the Run fixes (3) action available

Select active findings, then run their fixes together.

You can leave the page while the fix is running and return to check its status. Wait for the current fix to finish before starting overlapping work for the same repository.

If Rose cannot prepare a change, the findings stay active. Try a smaller set or use Copy prompt. See Troubleshoot Rose if the same finding fails again.

Review the pull request

Treat a Rose pull request like any other code change:

  1. Read the changed code and the linked findings.
  2. Run the repository’s relevant checks.
  3. Edit or request changes when needed.
  4. Merge only when the change is ready. Rose does not merge it for you.

Ask Rose for follow-up changes

On an open pull request created by Rose:

  1. Add a new general comment as a collaborator with write access.
  2. Start a normal Markdown line with the Rose App mention shown for your installation, then include the change you want.

Rose ignores mentions without an instruction and mentions inside blockquotes or fenced code blocks. Inline review comments provide context but do not start a follow-up.

GitHub pull request conversation where a collaborator asks Rose to update checkout span attributes and address review comments, then Rose replies with a completed summary

Rose applies requested updates to the existing branch and reports the work in the same conversation.

Follow-up limits

  • One at a time: only one follow-up can actively update a pull request. Wait for it to finish before requesting another.
  • 20 per pull request: after 20 follow-up executions, Rose replies that the limit has been reached.

Results

  • Code changes: Rose pushes them to the existing pull request branch instead of opening another pull request.
  • No code changes: Rose answers in the pull request conversation.

Rose updates one response comment while working and does not overwrite a branch that changed after the follow-up started.

After the change reaches the default branch, a later Review can mark findings as resolved if they no longer match. There is no separate verification step in Rose; check the code and telemetry through your normal development workflow.