{"id":15513088,"url":"https://github.com/tspascoal/dependabot-alerts-helper","last_synced_at":"2025-05-07T20:08:19.129Z","repository":{"id":103301932,"uuid":"519297117","full_name":"tspascoal/dependabot-alerts-helper","owner":"tspascoal","description":"A set of (simple) scripts to help manage dependabot alerts","archived":false,"fork":false,"pushed_at":"2022-07-29T17:38:32.000Z","size":254,"stargazers_count":9,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-05-07T20:07:58.104Z","etag":null,"topics":["dependabot","scripts-collection","security"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tspascoal.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-07-29T17:28:14.000Z","updated_at":"2024-07-29T07:46:32.000Z","dependencies_parsed_at":"2023-04-09T01:56:51.629Z","dependency_job_id":null,"html_url":"https://github.com/tspascoal/dependabot-alerts-helper","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tspascoal%2Fdependabot-alerts-helper","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tspascoal%2Fdependabot-alerts-helper/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tspascoal%2Fdependabot-alerts-helper/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tspascoal%2Fdependabot-alerts-helper/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tspascoal","download_url":"https://codeload.github.com/tspascoal/dependabot-alerts-helper/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252949270,"owners_count":21830151,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dependabot","scripts-collection","security"],"created_at":"2024-10-02T09:54:04.963Z","updated_at":"2025-05-07T20:08:19.095Z","avatar_url":"https://github.com/tspascoal.png","language":"Shell","funding_links":[],"categories":["Shell"],"sub_categories":[],"readme":"# Dependabot alerts helpers\n\nHelper scripts to managed [dependabot alerts](https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts) in bulk.\n\nThe scripts can:\n\n- Export alerts into a CSV, this enables opening the file in Excel for analysis, you can export alerts for multiple repositories.\n- Dismiss alerts in bulk. Dismiss all alerts in the /CSV file generated by the alerts exporter.\n- Merge PRs. Bulk merge all the pull requests that have been generated \nby dependabot. The list of PRs to merge will be picked by the CSV generated with the exporter.\n\n\u003e Note: There is no way to automatically undo the changes made by the scripts, so proceed with care and be sure of the actions you are going to take before proceeding.\n\n## Requirements\n\n- [GitHub CLI](https://cli.github.com)\n- [JQ](https://stedolan.github.io/jq/)\n- [csvtool](https://github.com/maroofi/csvtool) Only needed to dismiss alerts or merge alert pull requests.\n\n## Running\n\n### Exporting Alerts\n\nUsage:\n\n```bash\nUsage: get-alerts.sh \u003creposfilename\u003e [state]\noptional state can have the following values:  OPEN FIXED DISMISSED \n```\n\n\u003e Note: Getting alerts from a high number of repos (and/or high number of alerts) may trigger GitHub rate limits and the scripts don't take into account those rate limits, so it's advisable for big orgs to export alerts in smaller chunks.\n\nTo generate the CSV with the list of alerts you need to feed the script with a file containing the list of repositories, there a second optional parameter (state) that allows you to only get alerts with a given state (OPEN FIXED or DISMISSED), if you omit this parameter all alerts will be exported regardless of their state.\n\nThe file should contain the list of repositories (one per line) in the format OWNER/REPOSITORY\n\n```text\ntspscoal-demo2/myshuttle\noctocat/monalisa\n```\n\nThe alerts will be sent to standard output, if you want to store the results into a file redirect the output to a file.\n\nYou can use the `generate-repos.sh` script to generate the list of repositories in a given organization.\n\n\u003e personal repositories are not supported in `generate-repos.sh` command, if you want to export the repositories for a given user you can use gh cli command `gh api users/USERNAME/repos --template '{{range .}}{{printf \"%s/%s\\n\" .owner.login .name}}{{end}}`\n\nNow that you are in possession of the alerts, you can open them in excel for filtering and analysis.\n\n#### Example\n\n```sh\n# generate a list of repos\n./generate-repos.sh my-org \u003e repos.csv\n\n# consolidate dependabot alerts into csv - only export OPEN results\n./get-alerts repos.csv OPEN \u003e output.csv\n```\n\n#### Sample\n\nSample output csv, sorted by package in excel\n\n![CSV Example in example](images/csv-example-in-excel.png)\n\nYou are now ready to filter the alerts or do some analysis with a pivot table.\n\n### Dismissing Alerts\n\nUsage:\n\n```bash\nUsage: ./dismiss-alerts.sh \u003calertsfile\u003e \u003creason\u003e\nreason can be one of :  FIX_STARTED INACCURATE NOT_USED NO_BANDWIDTH TOLERABLE_RISK\n```\n\nOnce you have exported the alerts you can dismiss them in bulk. Just feed the script with the CSV file generated by the exporter.\n\n\u003e You probably don't want to dismiss all alerts, so you probably want to filter the alerts to dismiss some only based on a specific criteria (eg: alerts with low severity).\n\nTo dismiss the alerts, invoke `dismiss-alerts.sh` with the CSV file generated by the exporter and the reason for the dismissal.\n\nThese are the valid dismissal reasons\n\n- FIX_STARTED\n- INACCURATE\n- NOT_USED\n- NO_BANDWIDTH\n- TOLERABLE_RISK\n\n### Merging pull requests\n\nUsage:\n\n```bash\nUsage: ./merge-prs.sh \u003calertsfile\u003e \u003cmessage\u003e [merge method]\nvalid values for method are : merge squash rebase\ndefault value for merge method is 'merge'\n```\n\nDismissing alerts may be make sense in some circumstances, but it probably makes more sense to remediate the alerts for which dependabot has generated pull requests.\n\nIf you feed your alerts to the `merge-prs.sh` script, it will merge the PRs that have been generated by dependabot and whose state is `open`.\n\n\u003e By default the merge method is merge, but if you want you can use other methods. `merge`, `squash` and `rebase` are the supported methods.\n\nThis will allow you to merge PRs in bulk for a given potential vulnerability in all repos. For example merge all PRs for dependabot alerts generated to fix a given package (eg: `log4j`).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftspascoal%2Fdependabot-alerts-helper","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftspascoal%2Fdependabot-alerts-helper","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftspascoal%2Fdependabot-alerts-helper/lists"}