Remediation requests

BIMP creates remediation pull requests in GitHub and remediation merge requests in GitLab. Configure how BIMP groups image updates and which labels it adds so the resulting work fits your existing review process.

Choose how image updates are grouped

Open Settings → Defaults and find Default remediation PR strategy under Remediation pull requests. Choose one of these organization defaults:

• Per artifact creates one pull or merge request containing all recommended image updates in each artifact file.
• Per image creates one pull or merge request for each recommended target image across a repository branch.

Use Per artifact when your teams prefer to review related changes to one file together. Use Per image when you want to group all artifacts that require the same image update, for example, updating all Python image references across a repository.

Override the strategy for a repository

Use a repository override when one repository needs to group remediation work differently from the rest of the organization.

1. Open Repositories.
2. Open the settings for the repository and tracked branch.
3. Find Remediation PR strategy.
4. Choose Inherit organization default, Per artifact, or Per image.

You need permission to manage the repository to change this setting.

Add labels to remediation requests

Open Settings → Defaults and find Default remediation PR labels under Remediation pull requests. Enter one label per line, then save the organization defaults.

BIMP adds these labels when it creates remediation pull requests in GitHub or merge requests in GitLab. If a label does not already exist in the repository, BIMP creates it before applying it. Leave the setting empty to create remediation requests without default labels.

Choose labels that work with your existing review queues, automation, and reporting. Avoid labels that trigger workflows which are not suitable for every BIMP remediation request.

Incident remediation adds the bimp-security-incident label alongside the configured defaults. See Incident Response for the incident workflow.

You need permission to manage organization settings to change the default labels or the organization remediation strategy.