ghas-api-interaction

GHAS API Interaction

Overview

Patterns for interacting with GitHub Advanced Security APIs using the gh CLI. Covers code scanning, secret scanning, and Dependabot alert lifecycle management.

Code Scanning Alerts

# List all open code scanning alerts
gh api repos/{owner}/{repo}/code-scanning/alerts \
  --jq '.[] | select(.state=="open") | {number, rule: .rule.id, severity: .rule.security_severity_level, path: .most_recent_instance.location.path, line: .most_recent_instance.location.start_line}'

# Get details for a specific alert
gh api repos/{owner}/{repo}/code-scanning/alerts/{alert_number}

# Dismiss an alert (with reason)
gh api repos/{owner}/{repo}/code-scanning/alerts/{alert_number} \
  -X PATCH -f state=dismissed -f dismissed_reason=false_positive -f dismissed_comment="Verified safe: input is validated upstream"

# List alerts by severity
gh api repos/{owner}/{repo}/code-scanning/alerts?severity=critical\&state=open

Secret Scanning Alerts

# List open secret scanning alerts
gh api repos/{owner}/{repo}/secret-scanning/alerts \
  --jq '.[] | select(.state=="open") | {number, secret_type, push_protection_bypassed}'

# Resolve an alert after remediation
gh api repos/{owner}/{repo}/secret-scanning/alerts/{alert_number} \
  -X PATCH -f state=resolved -f resolution=revoked

Dependabot Alerts

# List open Dependabot alerts with severity
gh api repos/{owner}/{repo}/dependabot/alerts \
  --jq '.[] | select(.state=="open") | {number, package: .security_vulnerability.package.name, severity: .security_vulnerability.severity, cve: .security_advisory.cve_id}'

# Dismiss after upgrading
gh api repos/{owner}/{repo}/dependabot/alerts/{alert_number} \
  -X PATCH -f state=dismissed -f dismissed_reason=fix_started -f dismissed_comment="Upgraded to safe version"

Extracting Owner/Repo

# Get owner/repo from git remote
gh repo view --json nameWithOwner --jq '.nameWithOwner'