From 3df1f3a3de770c1768500b75a5b71944a75f6b2a Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 18 Aug 2026 22:36:48 +0000 Subject: [PATCH 01/13] Initial plan From 76ac3b9bb745c51022abb420ca563a7ddc1e1296 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 18 Aug 2026 22:39:21 +0000 Subject: [PATCH 02/13] Handle dependabot checks when dependency graph lookup fails Co-authored-by: felickz <1760475+felickz@users.noreply.github.com> --- ghascompliance/checks.py | 20 ++++++---- tests/test_checks.py | 81 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 93 insertions(+), 8 deletions(-) create mode 100644 tests/test_checks.py diff --git a/ghascompliance/checks.py b/ghascompliance/checks.py index c106346..a055ecd 100644 --- a/ghascompliance/checks.py +++ b/ghascompliance/checks.py @@ -225,7 +225,13 @@ def checkDependabot(self): ) alerts = dependabot.getAlertsGraphQL() # Dependencies - dependencies = depgraph.getDependencies() + try: + dependencies = depgraph.getDependencies() + except GHASToolkitError as err: + Octokit.warning( + f"Dependency Graph API request failed with status {err.status}; processing Dependabot alerts without dependency enrichment" + ) + dependencies = None Octokit.info("Total Dependabot Alerts :: " + str(len(alerts))) @@ -240,13 +246,11 @@ def checkDependabot(self): continue # Find the dependency from the graph - dependency = dependencies.findPurl(alert.purl) - + dependency = dependencies.findPurl(alert.purl) if dependencies else None if not dependency: - Octokit.error( - f"Unable to find alert in DependencyGraph :: {alert.purl}" + Octokit.warning( + f"Unable to find alert in DependencyGraph :: {alert.purl}. Continuing with alert package URL" ) - continue severity = alert.severity.lower() @@ -263,9 +267,9 @@ def checkDependabot(self): names = [ # org.apache.commons - dependency.fullname, + dependency.fullname if dependency else alert.purl, #  maven://org.apache.commons - dependency.getPurl(version=False), + dependency.getPurl(version=False) if dependency else alert.purl, ] if self.policy.checkViolation( diff --git a/tests/test_checks.py b/tests/test_checks.py new file mode 100644 index 0000000..0bc0245 --- /dev/null +++ b/tests/test_checks.py @@ -0,0 +1,81 @@ +import sys +import unittest +from datetime import datetime +from types import SimpleNamespace +from unittest.mock import MagicMock, patch + +sys.path.append(".") + +from ghastoolkit.errors import GHASToolkitError +from ghascompliance.checks import Checks + + +class TestChecks(unittest.TestCase): + def _create_alert(self): + advisory = SimpleNamespace(ghsa_id="GHSA-test-1234", cwes=["CWE-79"]) + alert = MagicMock() + alert.purl = "pkg:pip/flask" + alert.severity = "critical" + alert.advisory = advisory + alert.createdAt.return_value = datetime(2026, 8, 18, 0, 0, 0) + alert.get.side_effect = lambda key, default=None: {"dismissReason": None}.get( + key, default + ) + return alert + + @patch("ghascompliance.checks.GitHub.repository") + @patch("ghascompliance.checks.DependencyGraph") + @patch("ghascompliance.checks.Dependabot") + def test_check_dependabot_dependency_graph_400_still_processes_alerts( + self, dependabot_cls, depgraph_cls, repository_mock + ): + repository_mock.isInPullRequest.return_value = False + + alert = self._create_alert() + dependabot = dependabot_cls.return_value + dependabot.graphql = MagicMock() + dependabot.getAlerts.return_value = [alert] + + depgraph = depgraph_cls.return_value + depgraph.getDependencies.side_effect = GHASToolkitError( + "Bad Request", status=400 + ) + + policy = MagicMock() + policy.checkViolation.return_value = True + + checks = Checks(policy) + self.assertEqual(checks.checkDependabot(), 1) + policy.checkViolation.assert_called_once() + + @patch("ghascompliance.checks.GitHub.repository") + @patch("ghascompliance.checks.DependencyGraph") + @patch("ghascompliance.checks.Dependabot") + def test_check_dependabot_alert_without_dependency_graph_match_uses_purl( + self, dependabot_cls, depgraph_cls, repository_mock + ): + repository_mock.isInPullRequest.return_value = False + + alert = self._create_alert() + dependabot = dependabot_cls.return_value + dependabot.graphql = MagicMock() + dependabot.getAlerts.return_value = [alert] + + dependencies = MagicMock() + dependencies.findPurl.return_value = None + depgraph = depgraph_cls.return_value + depgraph.getDependencies.return_value = dependencies + + policy = MagicMock() + policy.checkViolation.return_value = True + + checks = Checks(policy) + self.assertEqual(checks.checkDependabot(), 1) + self.assertEqual( + policy.checkViolation.call_args.kwargs["names"], + [alert.purl, alert.purl], + ) + + +if __name__ == "__main__": + unittest.main() From fd32de986994e6f085186c322682795d654e74c1 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 18 Aug 2026 22:44:47 +0000 Subject: [PATCH 03/13] Avoid misleading per-alert warning when dependency graph fails Co-authored-by: felickz <1760475+felickz@users.noreply.github.com> --- ghascompliance/checks.py | 2 +- tests/test_checks.py | 9 ++++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/ghascompliance/checks.py b/ghascompliance/checks.py index a055ecd..603eabf 100644 --- a/ghascompliance/checks.py +++ b/ghascompliance/checks.py @@ -247,7 +247,7 @@ def checkDependabot(self): # Find the dependency from the graph dependency = dependencies.findPurl(alert.purl) if dependencies else None - if not dependency: + if not dependency and dependencies is not None: Octokit.warning( f"Unable to find alert in DependencyGraph :: {alert.purl}. Continuing with alert package URL" ) diff --git a/tests/test_checks.py b/tests/test_checks.py index 0bc0245..c4bc9f2 100644 --- a/tests/test_checks.py +++ b/tests/test_checks.py @@ -26,8 +26,9 @@ def _create_alert(self): @patch("ghascompliance.checks.GitHub.repository") @patch("ghascompliance.checks.DependencyGraph") @patch("ghascompliance.checks.Dependabot") + @patch("ghascompliance.checks.Octokit.warning") def test_check_dependabot_dependency_graph_400_still_processes_alerts( - self, dependabot_cls, depgraph_cls, repository_mock + self, warning_mock, dependabot_cls, depgraph_cls, repository_mock ): repository_mock.isInPullRequest.return_value = False @@ -47,6 +48,12 @@ def test_check_dependabot_dependency_graph_400_still_processes_alerts( checks = Checks(policy) self.assertEqual(checks.checkDependabot(), 1) policy.checkViolation.assert_called_once() + self.assertFalse( + any( + "Unable to find alert in DependencyGraph" in call.args[0] + for call in warning_mock.call_args_list + ) + ) @patch("ghascompliance.checks.GitHub.repository") @patch("ghascompliance.checks.DependencyGraph") From 0a23540afd5fdb24b3a793711c7801f77c33670c Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 18 Aug 2026 22:45:48 +0000 Subject: [PATCH 04/13] Add explicit warning assertion for missing dependency match Co-authored-by: felickz <1760475+felickz@users.noreply.github.com> --- tests/test_checks.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tests/test_checks.py b/tests/test_checks.py index c4bc9f2..42d08a2 100644 --- a/tests/test_checks.py +++ b/tests/test_checks.py @@ -58,8 +58,9 @@ def test_check_dependabot_dependency_graph_400_still_processes_alerts( @patch("ghascompliance.checks.GitHub.repository") @patch("ghascompliance.checks.DependencyGraph") @patch("ghascompliance.checks.Dependabot") + @patch("ghascompliance.checks.Octokit.warning") def test_check_dependabot_alert_without_dependency_graph_match_uses_purl( - self, dependabot_cls, depgraph_cls, repository_mock + self, warning_mock, dependabot_cls, depgraph_cls, repository_mock ): repository_mock.isInPullRequest.return_value = False @@ -82,6 +83,9 @@ def test_check_dependabot_alert_without_dependency_graph_match_uses_purl( policy.checkViolation.call_args.kwargs["names"], [alert.purl, alert.purl], ) + warning_mock.assert_called_once_with( + f"Unable to find alert in DependencyGraph :: {alert.purl}. Continuing with alert package URL" + ) if __name__ == "__main__": From b28a0d1b536fd3fa97f8e23ab833d2e6937a7c0e Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 18 Aug 2026 22:47:00 +0000 Subject: [PATCH 05/13] Match Dependabot alerts by PURL Co-authored-by: felickz <1760475+felickz@users.noreply.github.com> --- ghascompliance/checks.py | 15 ++++++++++++++- tests/test_checks.py | 6 ++++-- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/ghascompliance/checks.py b/ghascompliance/checks.py index 603eabf..534f78f 100644 --- a/ghascompliance/checks.py +++ b/ghascompliance/checks.py @@ -6,6 +6,7 @@ from ghastoolkit import ( GitHub, CodeScanning, + Dependency, Dependencies, DependencyGraph, Dependabot, @@ -246,7 +247,19 @@ def checkDependabot(self): continue # Find the dependency from the graph - dependency = dependencies.findPurl(alert.purl) if dependencies else None + alert_purl = Dependency.fromPurl(alert.purl).getPurl(version=False) + dependency = ( + next( + ( + dep + for dep in dependencies + if dep.getPurl(version=False) == alert_purl + ), + None, + ) + if dependencies + else None + ) if not dependency and dependencies is not None: Octokit.warning( f"Unable to find alert in DependencyGraph :: {alert.purl}. Continuing with alert package URL" diff --git a/tests/test_checks.py b/tests/test_checks.py index 42d08a2..5e7c184 100644 --- a/tests/test_checks.py +++ b/tests/test_checks.py @@ -6,7 +6,9 @@ sys.path.append(".") +from ghastoolkit import Dependencies from ghastoolkit.errors import GHASToolkitError +from ghastoolkit.supplychain.dependency import Dependency from ghascompliance.checks import Checks @@ -69,8 +71,8 @@ def test_check_dependabot_alert_without_dependency_graph_match_uses_purl( dependabot.graphql = MagicMock() dependabot.getAlerts.return_value = [alert] - dependencies = MagicMock() - dependencies.findPurl.return_value = None + alert.purl = "pkg:pip/flask@3.0.0" + dependencies = Dependencies([Dependency(name="requests", manager="pip")]) depgraph = depgraph_cls.return_value depgraph.getDependencies.return_value = dependencies From f4c8ba0784c8917c4b92fe7ac5d3b270a100b0a5 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 18 Aug 2026 22:47:56 +0000 Subject: [PATCH 06/13] Skip matching when graph unavailable Co-authored-by: felickz <1760475+felickz@users.noreply.github.com> --- ghascompliance/checks.py | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/ghascompliance/checks.py b/ghascompliance/checks.py index 534f78f..a8f8dc5 100644 --- a/ghascompliance/checks.py +++ b/ghascompliance/checks.py @@ -247,9 +247,10 @@ def checkDependabot(self): continue # Find the dependency from the graph - alert_purl = Dependency.fromPurl(alert.purl).getPurl(version=False) - dependency = ( - next( + dependency = None + if dependencies: + alert_purl = Dependency.fromPurl(alert.purl).getPurl(version=False) + dependency = next( ( dep for dep in dependencies @@ -257,9 +258,6 @@ def checkDependabot(self): ), None, ) - if dependencies - else None - ) if not dependency and dependencies is not None: Octokit.warning( f"Unable to find alert in DependencyGraph :: {alert.purl}. Continuing with alert package URL" From a06b313327070a3f5c26c53c8020d17f0c35b2fe Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 19 Aug 2026 04:26:27 +0000 Subject: [PATCH 07/13] Normalize Dependabot purl matching Co-authored-by: felickz <1760475+felickz@users.noreply.github.com> --- ghascompliance/checks.py | 6 ++++-- tests/test_checks.py | 31 +++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+), 2 deletions(-) diff --git a/ghascompliance/checks.py b/ghascompliance/checks.py index a8f8dc5..99b4522 100644 --- a/ghascompliance/checks.py +++ b/ghascompliance/checks.py @@ -249,12 +249,14 @@ def checkDependabot(self): # Find the dependency from the graph dependency = None if dependencies: - alert_purl = Dependency.fromPurl(alert.purl).getPurl(version=False) + alert_purl = ( + Dependency.fromPurl(alert.purl).getPurl(version=False).lower() + ) dependency = next( ( dep for dep in dependencies - if dep.getPurl(version=False) == alert_purl + if dep.getPurl(version=False).lower() == alert_purl ), None, ) diff --git a/tests/test_checks.py b/tests/test_checks.py index 5e7c184..e122860 100644 --- a/tests/test_checks.py +++ b/tests/test_checks.py @@ -89,6 +89,37 @@ def test_check_dependabot_alert_without_dependency_graph_match_uses_purl( f"Unable to find alert in DependencyGraph :: {alert.purl}. Continuing with alert package URL" ) + @patch("ghascompliance.checks.GitHub.repository") + @patch("ghascompliance.checks.DependencyGraph") + @patch("ghascompliance.checks.Dependabot") + @patch("ghascompliance.checks.Octokit.warning") + def test_check_dependabot_purl_match_is_case_insensitive( + self, warning_mock, dependabot_cls, depgraph_cls, repository_mock + ): + repository_mock.isInPullRequest.return_value = False + + alert = self._create_alert() + alert.purl = "pkg:nuget/newtonsoft.json@13.0.3" + dependabot = dependabot_cls.return_value + dependabot.graphql = MagicMock() + dependabot.getAlerts.return_value = [alert] + + dependency = Dependency(name="Newtonsoft.Json", manager="nuget") + dependencies = Dependencies([dependency]) + depgraph = depgraph_cls.return_value + depgraph.getDependencies.return_value = dependencies + + policy = MagicMock() + policy.checkViolation.return_value = True + + checks = Checks(policy) + self.assertEqual(checks.checkDependabot(), 1) + self.assertEqual( + policy.checkViolation.call_args.kwargs["names"], + [dependency.fullname, dependency.getPurl(version=False)], + ) + warning_mock.assert_not_called() + if __name__ == "__main__": unittest.main() From f77c86f444a007c8a0388ae06d135b1323531cce Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 19 Aug 2026 04:42:34 +0000 Subject: [PATCH 08/13] Fix Maven Dependabot dependency graph matching Co-authored-by: felickz <1760475+felickz@users.noreply.github.com> --- ghascompliance/checks.py | 11 ++++++++--- tests/test_checks.py | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 43 insertions(+), 3 deletions(-) diff --git a/ghascompliance/checks.py b/ghascompliance/checks.py index 99b4522..5b93b39 100644 --- a/ghascompliance/checks.py +++ b/ghascompliance/checks.py @@ -249,14 +249,19 @@ def checkDependabot(self): # Find the dependency from the graph dependency = None if dependencies: - alert_purl = ( - Dependency.fromPurl(alert.purl).getPurl(version=False).lower() - ) + alert_dependency = Dependency.fromPurl(alert.purl) + alert_purl = alert_dependency.getPurl(version=False).lower() + alert_manager = (alert_dependency.manager or "").lower() + alert_fullname = alert_dependency.fullname.lower() dependency = next( ( dep for dep in dependencies if dep.getPurl(version=False).lower() == alert_purl + or ( + (dep.manager or "").lower() == alert_manager + and dep.fullname.lower() == alert_fullname + ) ), None, ) diff --git a/tests/test_checks.py b/tests/test_checks.py index e122860..b6559c4 100644 --- a/tests/test_checks.py +++ b/tests/test_checks.py @@ -120,6 +120,41 @@ def test_check_dependabot_purl_match_is_case_insensitive( ) warning_mock.assert_not_called() + @patch("ghascompliance.checks.GitHub.repository") + @patch("ghascompliance.checks.DependencyGraph") + @patch("ghascompliance.checks.Dependabot") + @patch("ghascompliance.checks.Octokit.warning") + def test_check_dependabot_maven_alert_matches_dependency_fullname( + self, warning_mock, dependabot_cls, depgraph_cls, repository_mock + ): + repository_mock.isInPullRequest.return_value = False + + alert = self._create_alert() + alert.purl = "pkg:maven/org.apache.commons:commons-lang3@3.14.0" + dependabot = dependabot_cls.return_value + dependabot.graphql = MagicMock() + dependabot.getAlerts.return_value = [alert] + + dependency = Dependency( + name="commons-lang3", + namespace="org.apache.commons", + manager="maven", + ) + dependencies = Dependencies([dependency]) + depgraph = depgraph_cls.return_value + depgraph.getDependencies.return_value = dependencies + + policy = MagicMock() + policy.checkViolation.return_value = True + + checks = Checks(policy) + self.assertEqual(checks.checkDependabot(), 1) + self.assertEqual( + policy.checkViolation.call_args.kwargs["names"], + [dependency.fullname, dependency.getPurl(version=False)], + ) + warning_mock.assert_not_called() + if __name__ == "__main__": unittest.main() From 132ec7cb92286927fe73dedd4229a599347f19fc Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 19 Aug 2026 04:58:45 +0000 Subject: [PATCH 09/13] Fix scoped npm PURL parsing for Dependabot alert matching Co-authored-by: felickz <1760475+felickz@users.noreply.github.com> --- ghascompliance/checks.py | 44 ++++++++++++++++++++++++++++++++++------ tests/test_checks.py | 31 ++++++++++++++++++++++++++++ 2 files changed, 69 insertions(+), 6 deletions(-) diff --git a/ghascompliance/checks.py b/ghascompliance/checks.py index 5b93b39..edbb107 100644 --- a/ghascompliance/checks.py +++ b/ghascompliance/checks.py @@ -2,6 +2,7 @@ import json from datetime import datetime from typing import * +from urllib.parse import unquote from ghastoolkit import ( GitHub, @@ -24,6 +25,30 @@ GRAPHQL_QUERIES = [os.path.join(__HERE__, "octokit", "graphql")] +def _parse_alert_purl(purl: str) -> Tuple[str, str, str]: + """Parse a versionless (manager, namespace, name) tuple from a Dependabot alert PURL. + + Unlike ``Dependency.fromPurl()``, this does not treat the first ``@`` in the + PURL as a version delimiter, so scoped npm packages such as + ``pkg:npm/@scope/name`` are parsed correctly even when a version is + present. The version, if any, is always the last ``@``-delimited segment + and never contains a ``/``, so only that trailing segment is stripped. + Percent-encoding is also normalized. + """ + pkg = unquote(purl) + if pkg.startswith("pkg:"): + pkg = pkg[len("pkg:") :] + + if "@" in pkg: + candidate, _, version = pkg.rpartition("@") + if candidate and "/" not in version: + pkg = candidate + + manager, _, rest = pkg.partition("/") + namespace, _, name = rest.rpartition("/") + return manager.lower(), namespace.lower(), name.lower() + + class Checks: def __init__( self, @@ -249,18 +274,25 @@ def checkDependabot(self): # Find the dependency from the graph dependency = None if dependencies: - alert_dependency = Dependency.fromPurl(alert.purl) - alert_purl = alert_dependency.getPurl(version=False).lower() - alert_manager = (alert_dependency.manager or "").lower() - alert_fullname = alert_dependency.fullname.lower() + alert_manager, alert_namespace, alert_name = _parse_alert_purl( + alert.purl + ) + alert_purl = ( + f"pkg:{alert_manager}/{alert_namespace}/{alert_name}" + if alert_namespace + else f"pkg:{alert_manager}/{alert_name}" + ) + alert_fullname = ( + f"{alert_namespace}/{alert_name}" if alert_namespace else alert_name + ) dependency = next( ( dep for dep in dependencies - if dep.getPurl(version=False).lower() == alert_purl + if unquote(dep.getPurl(version=False)).lower() == alert_purl or ( (dep.manager or "").lower() == alert_manager - and dep.fullname.lower() == alert_fullname + and unquote(dep.fullname).lower() == alert_fullname ) ), None, diff --git a/tests/test_checks.py b/tests/test_checks.py index b6559c4..40a1762 100644 --- a/tests/test_checks.py +++ b/tests/test_checks.py @@ -155,6 +155,37 @@ def test_check_dependabot_maven_alert_matches_dependency_fullname( ) warning_mock.assert_not_called() + @patch("ghascompliance.checks.GitHub.repository") + @patch("ghascompliance.checks.DependencyGraph") + @patch("ghascompliance.checks.Dependabot") + @patch("ghascompliance.checks.Octokit.warning") + def test_check_dependabot_scoped_npm_alert_matches_dependency_fullname( + self, warning_mock, dependabot_cls, depgraph_cls, repository_mock + ): + repository_mock.isInPullRequest.return_value = False + + alert = self._create_alert() + alert.purl = "pkg:npm/@scope/name@1.2.3" + dependabot = dependabot_cls.return_value + dependabot.graphql = MagicMock() + dependabot.getAlerts.return_value = [alert] + + dependency = Dependency(name="name", namespace="@scope", manager="npm") + dependencies = Dependencies([dependency]) + depgraph = depgraph_cls.return_value + depgraph.getDependencies.return_value = dependencies + + policy = MagicMock() + policy.checkViolation.return_value = True + + checks = Checks(policy) + self.assertEqual(checks.checkDependabot(), 1) + self.assertEqual( + policy.checkViolation.call_args.kwargs["names"], + [dependency.fullname, dependency.getPurl(version=False)], + ) + warning_mock.assert_not_called() + if __name__ == "__main__": unittest.main() From 8b6353eaeac36e17ae85640f12c9a346ff553c9b Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 19 Aug 2026 05:15:04 +0000 Subject: [PATCH 10/13] Address test setup review feedback Co-authored-by: felickz <1760475+felickz@users.noreply.github.com> --- tests/test_checks.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_checks.py b/tests/test_checks.py index abcee10..63ce2d3 100644 --- a/tests/test_checks.py +++ b/tests/test_checks.py @@ -36,13 +36,13 @@ def testDependencyInfoQueryIsPaginated(self): class TestDependabotChecks(unittest.TestCase): def setUp(self) -> None: + super().setUp() GitHub.init( "advanced-security/policy-as-code", reference="refs/heads/main", retrieve_metadata=False, ) self.checks = Checks(Policy("error")) - super().setUp() def _create_alert(self): advisory = SimpleNamespace(ghsa_id="GHSA-test-1234", cwes=["CWE-79"]) From a65a14c9bf30d211957fb219f8dd7ffbacc1ab45 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 19 Aug 2026 05:15:46 +0000 Subject: [PATCH 11/13] Narrow GraphQL override test assertion Co-authored-by: felickz <1760475+felickz@users.noreply.github.com> --- tests/test_checks.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/tests/test_checks.py b/tests/test_checks.py index 63ce2d3..307717c 100644 --- a/tests/test_checks.py +++ b/tests/test_checks.py @@ -23,7 +23,12 @@ def testNoLocalQueryOverrides(self): path = os.path.join( os.path.dirname(checks_module.__file__), "octokit", "graphql" ) - self.assertFalse(os.path.exists(path)) + query_files = [] + if os.path.exists(path): + query_files = [ + name for name in os.listdir(path) if name.endswith(".graphql") + ] + self.assertEqual(query_files, []) def testDependencyInfoQueryIsPaginated(self): """Un-paginated queries time out (502) on large repositories.""" From d6306963e0c8cfc18a29c9bc3f2c0f518c01d444 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 19 Aug 2026 05:16:45 +0000 Subject: [PATCH 12/13] Harden GraphQL override test path check Co-authored-by: felickz <1760475+felickz@users.noreply.github.com> --- tests/test_checks.py | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/test_checks.py b/tests/test_checks.py index 307717c..1f5874f 100644 --- a/tests/test_checks.py +++ b/tests/test_checks.py @@ -23,6 +23,7 @@ def testNoLocalQueryOverrides(self): path = os.path.join( os.path.dirname(checks_module.__file__), "octokit", "graphql" ) + self.assertTrue(not os.path.exists(path) or os.path.isdir(path)) query_files = [] if os.path.exists(path): query_files = [ From 38b2e75d3224f0d63f3314cf1d8fb26581b9b2f0 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 19 Aug 2026 05:17:36 +0000 Subject: [PATCH 13/13] Clarify GraphQL query tests Co-authored-by: felickz <1760475+felickz@users.noreply.github.com> --- tests/test_checks.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_checks.py b/tests/test_checks.py index 1f5874f..c682a03 100644 --- a/tests/test_checks.py +++ b/tests/test_checks.py @@ -23,7 +23,6 @@ def testNoLocalQueryOverrides(self): path = os.path.join( os.path.dirname(checks_module.__file__), "octokit", "graphql" ) - self.assertTrue(not os.path.exists(path) or os.path.isdir(path)) query_files = [] if os.path.exists(path): query_files = [ @@ -35,6 +34,7 @@ def testDependencyInfoQueryIsPaginated(self): """Un-paginated queries time out (502) on large repositories.""" query = QUERIES.get("GetDependencyInfo", "") + self.assertTrue(query) self.assertIn("dependencyGraphManifests(first:", query) self.assertIn("$manifests_cursor", query) self.assertIn("$dependencies_cursor", query)