如何使用 Github API 检查是否为 Repo 启用了 Dependabot？

Question

I've gone through Github Rest API v3 and Github GraphQL API v4 but I'm unable to find a resource/endpoint to check if dependabot is enabled via the API? I've gone through loads of documentation but was unable to find anything helpful. Could someone please point me to the correct document or tell me which resource to use? Thanks!

Answer 1

There was a dependabot API docs that could have helped, but it was deprecated in August 3rd 2021.

However, a workaround would be to check if the dependabot.yml file is present in your repository or not using a GET request to api.github.com/repos/name/repo/contents/fileNameOrPath .

Reference about the dependabot.yml file

Answer 2

Now that Dependabot is merged into GitHub, there are two different components that could be enabled in the Security & analysis section of the settings of a given GitHub repo:

1. Dependabot alerts
2. Dependabot security updates

(Both require Dependency graph to also be enabled in the same section)

The first is just whether alerts are created, the second is whether automated pull requests are generated when a fix is available.

Checking if Dependabot alerts are enabled

According to the GitHub REST API Reference , you can check whether Dependabot alerts are enabled via the GitHub REST API at the following endpoint: https://api.github.com/repos/{owner}/{repo}/vulnerability-alerts

A 204 response confirms the feature is enabled, a 404 means it is not.

Checking if Dependabot security updates are enabled

Curiously, the GitHub REST API Reference lists requests to enable or disable the feature, but not to get the current status of the feature for a given repo.

For that, as GuiFalourd indicated using the GraphQL API to check for the presence of a .github/dependabot.yml file is the way to go, using something like the following against the Graph endpoint https://api.github.com/graphql

Query

{
    repository(name: "{repo}", owner: "{owner}") {
        object(expression: "HEAD:.github/") {
            ... on Tree {
                entries {
                    name
                }
            }
        }
    }
}

Response if file is present:

{
    "data": {
        "repository": {
            "object": {
                "entries": [
                    {
                        "name": "dependabot.yml"
                    }
                ]
            }
        }
    }
}

Response if file is not present:

{
    "data": {
        "repository": {
            "object": null
        }
    }
}

Answer 3

Answer by @epopisces is to the point, I was also looking for the same thing. Now addition to what he said. Checking the status of Dependabot security updates is possible via GET request (GET /repos/{owner}/{repo}) to a particular repo, which can have security and analysis tag in response(only if we have Advanced security license). No other way to know the status yet via API.

https://docs.github.com/en/rest/reference/repos#get-a-repository

Answer 4

As of 2023-01-10 the Repository object type now exposes a hasVulnerabilityAlertsEnabled field in the GraphQL API. So, for example, the following query:

{
  repository(name: "platform-samples", owner: "github") {
    id
    hasVulnerabilityAlertsEnabled
  }
}

Gives the following result:

{
  "data": {
    "repository": {
      "id": "MDEwOlJlcG9zaXRvcnk4NDQ1ODc3",
      "hasVulnerabilityAlertsEnabled": true
    }
  }
}