https://github.com/hofiorg/dependabot-alerts
A script to fetch Dependabot alerts for all repositories of a GitHub user
https://github.com/hofiorg/dependabot-alerts
bash bash-script dependabot dependabot-alerts script shell-script
Last synced: 9 months ago
JSON representation
A script to fetch Dependabot alerts for all repositories of a GitHub user
- Host: GitHub
- URL: https://github.com/hofiorg/dependabot-alerts
- Owner: hofiorg
- License: mit
- Created: 2025-06-20T13:47:39.000Z (about 1 year ago)
- Default Branch: main
- Last Pushed: 2025-06-21T18:50:28.000Z (about 1 year ago)
- Last Synced: 2025-08-31T23:51:54.658Z (11 months ago)
- Topics: bash, bash-script, dependabot, dependabot-alerts, script, shell-script
- Language: Shell
- Homepage:
- Size: 9.77 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# dependabot-alerts
[](https://github.com/hofiorg/dependabot-alerts/blob/main/dependabot-alerts)
[](https://github.com/hofiorg/dependabot-alerts/blob/main/LICENSE)
[](https://github.com/hofiorg/dependabot-alerts/actions/workflows/lint-bash.yml)
A script to fetch [Dependabot](https://github.com/dependabot) alerts for all repositories of a GitHub user.
## 🛠️ Prerequisites
This script requires the following tools to be installed on your system:
- [`curl`](https://curl.se/) — for making HTTP requests to the GitHub API
- [`jq`](https://stedolan.github.io/jq/) — for parsing JSON responses in Bash
### ☑️ Check if they are installed
Run the following commands to verify:
```sh
which curl
which jq
```
If either command returns no path, you need to install the missing tools.
## 📥 Installation
### On Ubuntu (including WSL)
```sh
sudo apt update
sudo apt install -y curl jq
```
### 🔐 Set up the GitHub Personal Access Token
Create a fine-grained or classic token at 👉 with the following permissions:
- `repo` (for private repositories, if applicable)
- `security_events` (for Dependabot alerts)
### 🌍 Set the token as Environment Variable
```sh
export GH_TOKEN=your_github_token_here
```
To make this persistent, add the above line to your `~/.bashrc` or `~/.zshrc`.
### 🚀 Usage
Run the script as follows:
```sh
./dependabot-alerts [github_username]
```
If no username is provided, it defaults to `hofiorg`.
#### 🧪 Examples
```sh
./dependabot-alerts
./dependabot-alerts octocat
```
#### 📊 Output Example
When you run the script, you'll see a table like this:
```txt
📦 Fetching repository list for user 'hofiorg'...
Repository Status
------------------------------ ------
angular-boilerplate ✅
graphql_react_example ❌ 2
java_websockets ✅
react-input-calendar -
utils ✅
```
**Legend:**
- ✅ – No open Dependabot alerts
- ❌ *n* – *n* open, undismissed alerts found
- `-` – Alerts not accessible (e.g., archived or insufficient permissions)