Fix GraphQL 502 failures by using ghastoolkit's paginated Dependency Graph queries

[Copilot]

Runs against large repositories consistently failed with ERROR:ghastoolkit.octokit:GraphQL API Status :: 502, blocking merge workflows, while the same configuration succeeded on small repositories.

Root cause

ghascompliance/octokit/graphql/GetDependencyInfo.graphql was a stale, un-paginated copy of ghastoolkit's Dependency Graph query: it requested every manifest and every dependency of every manifest in one call.

dependencyGraphManifests {          # local copy: no page limits anywhere
    edges { node { filename dependencies { edges { node { ... } } } } }
}

vs. ghastoolkit's current query, which walks manifests one page at a time and pages dependencies by cursor:

dependencyGraphManifests(first: 1, $manifests_cursor) {
    edges { node { filename dependencies(first: $dependencies_first, $dependencies_cursor) { ... } } }
}

Dependabot.graphql.loadQueries() mutates ghastoolkit's shared module-level QUERIES dict, so the local copy replaced the paginated query for every GraphQL caller in the run. On large repositories that request times out server side and GitHub responds 502.

Changes

• Removed the local query overrides (GetDependencyInfo.graphql, GetDependencyAlerts.graphql) and the loadQueries() call in checks.py, so ghastoolkit's maintained, paginated queries are used. The alerts copy was also stale, omitting the number and state fields that getAlertsGraphQL() reads.
• Skip the Dependency Graph fetch when there are no Dependabot alerts in checkDependabot(). Dependencies are only used to resolve alerts to package names, so a repository with zero alerts no longer issues the heavy GraphQL requests at all.
• Added tests/test_checks.py covering the absence of local overrides, that the built-in query is paginated, and the skip/fetch behaviour of the Dependabot check.

Notes for reviewers

The action runs against vendor/ghastoolkit (0.17.7, which already has the 502/503/504 retry from #195), while unit tests run against the pipenv-installed ghastoolkit. Both ship the paginated GetDependencyInfo query, so the removal is safe for either path.

• Fixes ERROR:ghastoolkit.octokit:GraphQL API Status :: 502 results into workflow failure #140

[Copilot]

Copilot wasn't able to review any files in this pull request.

[Copilot]

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Lite

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Lite