[akashmalbari]

Summary

Adds a selectable dependabot_alerts repository stream backed by GitHub’s Dependabot alerts REST endpoint. The stream uses cursor pagination, sorts by updated descending, and keeps per-repository incremental state so existing alerts are not replayed unnecessarily.

The schema retains alert state, vulnerable dependency details, advisory/CVSS/EPSS/CWE data, remediation versions, and assignees. README permission guidance explains the required Dependabot alerts read access.

Fixes #590

Validation

• uv run pytest tests/test_dependabot_alerts.py
• uv run pytest -m noconfig tests/test_discover.py
• uvx ruff check tap_github/repository_streams.py tap_github/streams.py tests/test_dependabot_alerts.py
• uvx ruff format --check tap_github/repository_streams.py tap_github/streams.py tests/test_dependabot_alerts.py
• uv run mypy tap_github
• uv run ty check tap_github

uv run pytest completed with 100 passing tests; 9 existing live-API tests failed because their unauthenticated fixture requests received GitHub 403/rate-limit responses.

Compatibility and security

This is additive and does not change existing stream behavior or configuration. Users who select dependabot_alerts need a token with Dependabot alerts read permission (security_events for classic PATs, or the fine-grained/GitHub App repository permission). No credentials are logged or stored.

[akashmalbari]

Addressed the Python 3.14 CI failure in 340603f.

dependabot_alerts now defaults to deselected because the endpoint requires an explicit Dependabot alerts permission that fork-PR CI tokens do not have. Users can select it after configuring the documented scope/permission. Added a regression assertion and reran the focused stream tests, discovery test, Ruff, formatting, mypy, and ty checks.

[edgarrmondragon]

Suggested change

	# Dependabot alerts require an explicit repository permission, so users
	tolerated_http_errors: ClassVar[list[int]] = [404, 403]
	# Dependabot alerts require an explicit repository permission, so users

[akashmalbari]

Applied in 343a0f7. The stream now tolerates 404/403 responses and the regression test verifies that a missing Dependabot-alerts permission completes without records.\n\nValidated with uv run pytest tests/test_dependabot_alerts.py, Ruff check/format, mypy, and ty.

[edgarrmondragon]

Hmm. Actually... could this swallow a 403 that is in fact a rate-limit, which should be retried?

[akashmalbari]

Confirmed and fixed in 34d74c7. The REST client now lets primary and secondary rate-limit 403s reach the existing retry logic before considering a status tolerated; non-rate-limit 403s and 404s remain tolerated for this stream.\n\nAdded regression coverage for both rate-limit responses plus the missing-permission case. Validated with uv run pytest tests/test_dependabot_alerts.py, Ruff check/format, mypy, and ty.