Agent P Configuration References

Agent P uses organization-level defaults with optional repository-level overrides.

The agp-workflow.yml file defines the GitHub Actions workflow that executes Agent P. This file is created during onboarding and should not be edited manually. The configuration is managed through Sonatype Guide.

# .github/workflows/agp-workflow.yml

name: Sonatype Guide - Agent P

on:
  schedule:
    # Runs once a day. Sonatype Guide picks a randomized time
    # for each repository so onboarded repos don't all run simultaneously.
    - cron: '0 6 * * *'
  workflow_dispatch:
    inputs:
      verbose:
        description: 'Enable verbose output'
        required: false
        default: 'false'
        type: boolean
      mode:
        description: 'Run mode (standard or security)'
        required: false
        default: 'standard'
        type: string
      vulnerabilities:
        description: 'JSON array of vulnerabilities to target (security mode)'
        required: false
        default: ''
        type: string

permissions:
  contents: write
  pull-requests: write
  id-token: write  # Required for OIDC authentication with Sonatype Guide

concurrency:
  group: agp-${{ github.ref }}
  cancel-in-progress: false

jobs:
  # Gate job: checks if repo should run, fetches governed config
  gate:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      directive: ${{ steps.gate.outputs.directive }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Sonatype Guide gate
        id: gate
        uses: sonatype/agp-action/gate@v1
        with:
          guide-url: ${{ vars.AGP_API_URL }}

  # Main AGP job: only runs when gate outputs 'run'
  agp:
    needs: gate
    if: needs.gate.outputs.directive == 'run'
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Fetch governed configuration
        uses: sonatype/agp-action/gate@v1
        with:
          guide-url: ${{ vars.AGP_API_URL }}

      - name: Run AGP
        uses: sonatype/agp-action@v1
        with:
          mode: ${{ inputs.mode || 'standard' }}
          vulnerabilities: ${{ inputs.vulnerabilities }}
          verbose: ${{ inputs.verbose || 'false' }}
        env:
          GITHUB_TOKEN: ${{ github.token }}

The Default Configuration tab organizes Agent P settings into sections. Sonatype Guide centrally stores these settings and provides the applicable configuration to Agent P at the start of each run.

Repository-level overrides can replace individual default settings without affecting other repositories.