Skip to content

Commit 22872d3

Browse files
mmaikelclaude
mmaikel
and
claude
committed
Add Dependabot alert support
Add GHDependabotAlert, GHDependabotAlertState, and GHDependabotAlertsIterable following the same pattern as the existing GHCodeScanningAlert and GHSecretScanningAlert implementations. New classes: - GHDependabotAlert: Main alert class with nested Dependency, SecurityAdvisory, SecurityVulnerability, Package, PatchedVersion - GHDependabotAlertState: OPEN, DISMISSED, FIXED, AUTO_DISMISSED - GHDependabotAlertsIterable: Paginated iteration with owner wrapping New GHRepository methods: - listDependabotAlerts() / listDependabotAlerts(state) / listDependabotAlerts(filters) - getDependabotAlert(number) Endpoint: GET /repos/{owner}/{repo}/dependabot/alerts Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 0faddc9 commit 22872d3

File tree

5 files changed

+463
-1
lines changed

5 files changed

+463
-1
lines changed

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<modelVersion>4.0.0</modelVersion>
33
<groupId>org.kohsuke</groupId>
44
<artifactId>cortexapps-github-api</artifactId>
5-
<version>1.329</version>
5+
<version>1.330</version>
66
<name>GitHub API for Java</name>
77
<url>https://github-api.kohsuke.org/</url>
88
<description>GitHub API for Java</description>

‎src/main/java/org/kohsuke/github/GHDependabotAlert.java‎

Lines changed: 346 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,346 @@
1+
package org.kohsuke.github;
2+
3+
import com.fasterxml.jackson.annotation.JsonIgnore;
4+
import com.fasterxml.jackson.annotation.JsonProperty;
5+
import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
6+
7+
import java.io.IOException;
8+
import java.net.URL;
9+
import java.util.Date;
10+
11+
/**
12+
* Dependabot alert for a repository with a dependency affected by a security vulnerability.
13+
*
14+
* <a href="https://docs.github.com/en/rest/dependabot/alerts">Dependabot alerts API</a>
15+
*/
16+
@SuppressFBWarnings(value = { "UUF_UNUSED_FIELD" }, justification = "JSON API")
17+
public class GHDependabotAlert extends GHObject {
18+
@JsonIgnore
19+
private GHRepository owner;
20+
private long number;
21+
private String html_url;
22+
private GHDependabotAlertState state;
23+
private Dependency dependency;
24+
private SecurityAdvisory security_advisory;
25+
private SecurityVulnerability security_vulnerability;
26+
private String created_at;
27+
private String updated_at;
28+
private String dismissed_at;
29+
private GHUser dismissed_by;
30+
private String dismissed_reason;
31+
private String dismissed_comment;
32+
private String fixed_at;
33+
private String auto_dismissed_at;
34+
35+
GHDependabotAlert wrap(GHRepository owner) {
36+
this.owner = owner;
37+
return this;
38+
}
39+
40+
/**
41+
* Id/number of the alert.
42+
*
43+
* @return the id/number
44+
* @see #getId()
45+
*/
46+
public long getNumber() {
47+
return number;
48+
}
49+
50+
/**
51+
* Id/number of the alert.
52+
*
53+
* @return the id/number
54+
* @see #getNumber()
55+
*/
56+
@Override
57+
public long getId() {
58+
return getNumber();
59+
}
60+
61+
@Override
62+
public URL getHtmlUrl() throws IOException {
63+
return GitHubClient.parseURL(html_url);
64+
}
65+
66+
/**
67+
* State of alert.
68+
*
69+
* @return the state
70+
*/
71+
public GHDependabotAlertState getState() {
72+
return state;
73+
}
74+
75+
/**
76+
* Dependency that is affected by the vulnerability.
77+
*
78+
* @return the dependency
79+
*/
80+
@SuppressFBWarnings(value = { "EI_EXPOSE_REP" }, justification = "Expected behavior")
81+
public Dependency getDependency() {
82+
return dependency;
83+
}
84+
85+
/**
86+
* Security advisory associated with the alert.
87+
*
88+
* @return the security advisory
89+
*/
90+
@SuppressFBWarnings(value = { "EI_EXPOSE_REP" }, justification = "Expected behavior")
91+
public SecurityAdvisory getSecurityAdvisory() {
92+
return security_advisory;
93+
}
94+
95+
/**
96+
* Security vulnerability associated with the alert.
97+
*
98+
* @return the security vulnerability
99+
*/
100+
@SuppressFBWarnings(value = { "EI_EXPOSE_REP" }, justification = "Expected behavior")
101+
public SecurityVulnerability getSecurityVulnerability() {
102+
return security_vulnerability;
103+
}
104+
105+
/**
106+
* Gets created at.
107+
*
108+
* @return the created at
109+
*/
110+
public Date getCreatedAt() {
111+
return GitHubClient.parseDate(created_at);
112+
}
113+
114+
/**
115+
* Gets updated at.
116+
*
117+
* @return the updated at
118+
*/
119+
public Date getUpdatedAt() {
120+
return GitHubClient.parseDate(updated_at);
121+
}
122+
123+
/**
124+
* Time when alert was dismissed. Non-null when {@link #getState()} is DISMISSED.
125+
*
126+
* @return the time
127+
*/
128+
public Date getDismissedAt() {
129+
return GitHubClient.parseDate(dismissed_at);
130+
}
131+
132+
/**
133+
* User that dismissed the alert. Non-null when {@link #getState()} is DISMISSED.
134+
*
135+
* @return the user
136+
*/
137+
@SuppressFBWarnings(value = { "EI_EXPOSE_REP" }, justification = "Expected behavior")
138+
public GHUser getDismissedBy() {
139+
return dismissed_by;
140+
}
141+
142+
/**
143+
* Reason for dismissal. Can be 'fix_started', 'inaccurate', 'no_bandwidth', 'not_used', 'tolerable_risk'.
144+
*
145+
* @return the reason
146+
*/
147+
public String getDismissedReason() {
148+
return dismissed_reason;
149+
}
150+
151+
/**
152+
* Optional comment associated with the dismissal.
153+
*
154+
* @return the comment
155+
*/
156+
public String getDismissedComment() {
157+
return dismissed_comment;
158+
}
159+
160+
/**
161+
* Dependency affected by the vulnerability.
162+
*/
163+
@SuppressFBWarnings(value = { "UWF_UNWRITTEN_FIELD" }, justification = "JSON API")
164+
public static class Dependency {
165+
@JsonProperty("package")
166+
private Package pkg;
167+
private String manifest_path;
168+
private String scope;
169+
170+
/**
171+
* The package affected by the vulnerability.
172+
*
173+
* @return the package
174+
*/
175+
public Package getPackage() {
176+
return pkg;
177+
}
178+
179+
/**
180+
* Path to the manifest file that declares the dependency.
181+
*
182+
* @return the manifest path
183+
*/
184+
public String getManifestPath() {
185+
return manifest_path;
186+
}
187+
188+
/**
189+
* Scope of the dependency (runtime or development).
190+
*
191+
* @return the scope
192+
*/
193+
public String getScope() {
194+
return scope;
195+
}
196+
}
197+
198+
/**
199+
* A package affected by a vulnerability.
200+
*/
201+
@SuppressFBWarnings(value = { "UWF_UNWRITTEN_FIELD" }, justification = "JSON API")
202+
public static class Package {
203+
private String ecosystem;
204+
private String name;
205+
206+
/**
207+
* The package ecosystem (e.g., npm, pip, maven).
208+
*
209+
* @return the ecosystem
210+
*/
211+
public String getEcosystem() {
212+
return ecosystem;
213+
}
214+
215+
/**
216+
* The package name.
217+
*
218+
* @return the name
219+
*/
220+
public String getName() {
221+
return name;
222+
}
223+
}
224+
225+
/**
226+
* Security advisory associated with a Dependabot alert.
227+
*/
228+
@SuppressFBWarnings(value = { "UWF_UNWRITTEN_FIELD" }, justification = "JSON API")
229+
public static class SecurityAdvisory {
230+
private String ghsa_id;
231+
private String cve_id;
232+
private String summary;
233+
private String description;
234+
private String severity;
235+
236+
/**
237+
* GitHub Security Advisory ID.
238+
*
239+
* @return the GHSA ID
240+
*/
241+
public String getGhsaId() {
242+
return ghsa_id;
243+
}
244+
245+
/**
246+
* CVE ID for the advisory, if available.
247+
*
248+
* @return the CVE ID
249+
*/
250+
public String getCveId() {
251+
return cve_id;
252+
}
253+
254+
/**
255+
* Short summary of the advisory.
256+
*
257+
* @return the summary
258+
*/
259+
public String getSummary() {
260+
return summary;
261+
}
262+
263+
/**
264+
* Full description of the advisory.
265+
*
266+
* @return the description
267+
*/
268+
public String getDescription() {
269+
return description;
270+
}
271+
272+
/**
273+
* Severity of the advisory (critical, high, medium, low).
274+
*
275+
* @return the severity
276+
*/
277+
public String getSeverity() {
278+
return severity;
279+
}
280+
}
281+
282+
/**
283+
* Security vulnerability details.
284+
*/
285+
@SuppressFBWarnings(value = { "UWF_UNWRITTEN_FIELD" }, justification = "JSON API")
286+
public static class SecurityVulnerability {
287+
@JsonProperty("package")
288+
private Package pkg;
289+
private String severity;
290+
private String vulnerable_version_range;
291+
private PatchedVersion first_patched_version;
292+
293+
/**
294+
* The package affected by this vulnerability.
295+
*
296+
* @return the package
297+
*/
298+
public Package getPackage() {
299+
return pkg;
300+
}
301+
302+
/**
303+
* Severity of the vulnerability (critical, high, medium, low).
304+
*
305+
* @return the severity
306+
*/
307+
public String getSeverity() {
308+
return severity;
309+
}
310+
311+
/**
312+
* Version range affected by the vulnerability.
313+
*
314+
* @return the vulnerable version range
315+
*/
316+
public String getVulnerableVersionRange() {
317+
return vulnerable_version_range;
318+
}
319+
320+
/**
321+
* First patched version that fixes the vulnerability.
322+
*
323+
* @return the first patched version
324+
*/
325+
public PatchedVersion getFirstPatchedVersion() {
326+
return first_patched_version;
327+
}
328+
}
329+
330+
/**
331+
* A patched version identifier.
332+
*/
333+
@SuppressFBWarnings(value = { "UWF_UNWRITTEN_FIELD" }, justification = "JSON API")
334+
public static class PatchedVersion {
335+
private String identifier;
336+
337+
/**
338+
* The version identifier.
339+
*
340+
* @return the identifier
341+
*/
342+
public String getIdentifier() {
343+
return identifier;
344+
}
345+
}
346+
}

‎src/main/java/org/kohsuke/github/GHDependabotAlertState.java‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
package org.kohsuke.github;
2+
3+
/**
4+
* What is the current state of the Dependabot Alert
5+
*/
6+
public enum GHDependabotAlertState {
7+
/**
8+
* Alert is open and still an active issue.
9+
*/
10+
OPEN,
11+
/**
12+
* Alert has been manually dismissed by a user.
13+
*/
14+
DISMISSED,
15+
/**
16+
* Issue that caused the alert has been fixed.
17+
*/
18+
FIXED,
19+
/**
20+
* Alert has been automatically dismissed by Dependabot.
21+
*/
22+
AUTO_DISMISSED,
23+
}

0 commit comments

Comments
 (0)