Harden Dependabot policy evaluation when Dependency Graph enrichment fails

[Copilot]

Dependabot checks could abort with a 400 path during action execution, which prevented expected alert reporting in repositories with active vulnerability alerts. This change keeps evaluation running even when dependency enrichment is unavailable.

• Problem scope

  • checkDependabot assumed Dependency Graph data was always retrievable and always mappable by purl, causing alert processing to stop in failure/miss scenarios.

• Behavior change in Dependabot flow

  • Wrap depgraph.getDependencies() with GHASToolkitError handling.
  • On dependency graph failure, continue evaluating Dependabot alerts instead of aborting the check.
  • When findPurl(alert.purl) has no match, continue and evaluate against fallback names derived from alert.purl.

• Policy matching fallback

  • If enrichment is unavailable, policy names input now uses:
    • alert.purl
    • alert.purl (versionless fallback slot)

• Regression coverage

  • Added focused tests for:
    • Dependency Graph API 400 during Dependabot evaluation.
    • Missing dependency match for an alert purl.

try:
    dependencies = depgraph.getDependencies()
except GHASToolkitError:
    dependencies = None

dependency = dependencies.findPurl(alert.purl) if dependencies else None
names = [
    dependency.fullname if dependency else alert.purl,
    dependency.getPurl(version=False) if dependency else alert.purl,
]

• Fixes [Bug]: Got exception when dependabot alerts were found in repo during action execution #182

[Copilot]

Copilot wasn't able to review any files in this pull request.

[Copilot]

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

Review details

Suppressed comments (1)

ghascompliance/checks.py:249

• The missing-match fallback is not reachable for a non-empty real dependency graph: Dependencies.findPurl() currently uses the tautology dep.fullname == dep.fullname (vendor/ghastoolkit/supplychain/dependencies.py:269), so it returns the first dependency even when alert.purl does not match. This can evaluate the alert against an unrelated package instead of the new fallback. Correct the findPurl comparison and cover this path with a real Dependencies collection rather than mocking findPurl.

            # Find the dependency from the graph

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[felickz]

@copilot resolve the merge conflicts in this pull request

[Copilot]

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved the merge conflicts in 264a7f5 and pushed follow-up validation/review cleanup through 38b2e75.

[Copilot]

Review details

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

ghascompliance/checks.py:299

• The lookup assumes Dependabot ecosystem names are identical to Dependency Graph PURL types. For example, the alert adapter produces pkg:pip/... (vendor/ghastoolkit/octokit/dependabot.py:345), while SPDX Python dependencies use the canonical pkg:pypi/...; both this PURL comparison and the manager/fullname fallback therefore miss a real Python dependency. This also affects ecosystems such as Go/golang, RubyGems/gem, and Rust/cargo, causing package-name conditions to receive only the fallback alert PURL. Normalize Dependabot ecosystem names to their PURL type aliases before matching and add representative coverage.

                        if unquote(dep.getPurl(version=False)).lower() == alert_purl
                        or (
                            (dep.manager or "").lower() == alert_manager
                            and unquote(dep.fullname).lower() == alert_fullname

ghascompliance/checks.py:258

• GHASToolkitError.status is optional, and getDependencies() can raise one without a status (for example, for an unsupported GHES version). This warning then reports status None and discards the useful exception message. Include err itself so the fallback remains diagnosable while still showing HTTP status codes when available.

                        f"Dependency Graph API request failed with status {err.status}; processing Dependabot alerts without dependency enrichment"

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Balanced