Skip to content

Improve dependabot error message #2375

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aashah wants to merge 1 commit into
base: main
Choose a base branch
from
+47 −3
Open

Improve dependabot error message #2375

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 15 additions & 2 deletions pkg/github/dependabot.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ func GetDependabotAlert(t translations.TranslationHelperFunc) inventory.ServerTo
alert, resp, err := client.Dependabot.GetRepoAlert(ctx, owner, repo, alertNumber)
if err != nil {
return ghErrors.NewGitHubAPIErrorResponse(ctx,
fmt.Sprintf("failed to get alert with number '%d'", alertNumber),
dependabotErrMsg(fmt.Sprintf("failed to get alert with number '%d'", alertNumber), owner, repo, resp),
resp,
err,
), nil, nil
Expand Down Expand Up @@ -160,7 +160,7 @@ func ListDependabotAlerts(t translations.TranslationHelperFunc) inventory.Server
})
if err != nil {
return ghErrors.NewGitHubAPIErrorResponse(ctx,
fmt.Sprintf("failed to list alerts for repository '%s/%s'", owner, repo),
dependabotErrMsg(fmt.Sprintf("failed to list alerts for repository '%s/%s'", owner, repo), owner, repo, resp),
resp,
err,
), nil, nil
Expand All @@ -184,3 +184,16 @@ func ListDependabotAlerts(t translations.TranslationHelperFunc) inventory.Server
},
)
}

// dependabotErrMsg enhances error messages for dependabot API failures by
// appending a hint about token permissions when the response indicates
// the token may lack access to the repository (403 or 404).
func dependabotErrMsg(base, owner, repo string, resp *github.Response) string {
if resp != nil && (resp.StatusCode == http.StatusForbidden || resp.StatusCode == http.StatusNotFound) {
return fmt.Sprintf("%s. Your token may not have access to Dependabot alerts on %s/%s. "+
"To access Dependabot alerts, the token needs the 'security_events' scope or, for fine-grained tokens, "+
"Dependabot alerts read permission for this specific repository.",
base, owner, repo)
Comment on lines +191 to +196
Copy link

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

dependabotErrMsg appends the token-permission hint for all 404 responses. A 404 can also mean the alert/repo genuinely doesn’t exist, so this risks presenting misleading guidance. Consider limiting the hint to 403 (or otherwise gating it on a stronger signal than status code alone) so “not found” failures don’t look like permission problems.

Copilot uses AI. Check for mistakes.
}
return base
}
33 changes: 32 additions & 1 deletion pkg/github/dependabot_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,23 @@ func Test_GetDependabotAlert(t *testing.T) {
"alertNumber": float64(9999),
},
expectError: true,
expectedErrMsg: "failed to get alert",
expectedErrMsg: "Your token may not have access to Dependabot alerts on owner/repo",
},
{
name: "alert fetch forbidden",
mockedClient: MockHTTPClientWithHandlers(map[string]http.HandlerFunc{
GetReposDependabotAlertsByOwnerByRepoByAlertNumber: http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
w.WriteHeader(http.StatusForbidden)
_, _ = w.Write([]byte(`{"message": "Resource not accessible by integration"}`))
}),
}),
requestArgs: map[string]any{
"owner": "owner",
"repo": "repo",
"alertNumber": float64(42),
},
expectError: true,
expectedErrMsg: "Your token may not have access to Dependabot alerts on owner/repo",
},
}

Expand Down Expand Up @@ -208,6 +224,21 @@ func Test_ListDependabotAlerts(t *testing.T) {
expectError: true,
expectedErrMsg: "failed to list alerts",
},
{
name: "alerts listing forbidden includes token hint",
mockedClient: MockHTTPClientWithHandlers(map[string]http.HandlerFunc{
GetReposDependabotAlertsByOwnerByRepo: http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
w.WriteHeader(http.StatusForbidden)
_, _ = w.Write([]byte(`{"message": "Resource not accessible by integration"}`))
}),
}),
requestArgs: map[string]any{
"owner": "owner",
"repo": "repo",
},
expectError: true,
expectedErrMsg: "Your token may not have access to Dependabot alerts on owner/repo",
},
}

for _, tc := range tests {
Expand Down
Loading