List Dependabot alerts for a repository

type Github = {

  token: string;

};

/**

 * List Dependabot alerts for a repository

 * You must use an access token with the `security_events` scope to use this endpoint with private repositories.

You can also use tokens with the `public_repo` scope for public repositories only.

GitHub Apps must have **Dependabot alerts** read permission to use this endpoint.

 */

export async function main(

  auth: Github,

  owner: string,

  repo: string,

  state: string | undefined,

  severity: string | undefined,

  ecosystem: string | undefined,

  package: string | undefined,

  manifest: string | undefined,

  scope: "development" | "runtime" | undefined,

  sort: "created" | "updated" | undefined,

  direction: "asc" | "desc" | undefined,

  page: string | undefined,

  per_page: string | undefined,

  before: string | undefined,

  after: string | undefined,

  first: string | undefined,

  last: string | undefined

) {

  const url = new URL(

    `https://api.github.com/repos/${owner}/${repo}/dependabot/alerts`

  );

  for (const [k, v] of [

    ["state", state],

    ["severity", severity],

    ["ecosystem", ecosystem],

    ["package", package],

    ["manifest", manifest],

    ["scope", scope],

    ["sort", sort],

    ["direction", direction],

    ["page", page],

    ["per_page", per_page],

    ["before", before],

    ["after", after],

    ["first", first],

    ["last", last],

  ]) {

    if (v !== undefined && v !== "") {

      url.searchParams.append(k, v);

    }

  }

  const response = await fetch(url, {

    method: "GET",

    headers: {

      Authorization: "Bearer " + auth.token,

    },

    body: undefined,

  });

  if (!response.ok) {

    const text = await response.text();

    throw new Error(`${response.status} ${text}`);

  }

  return await response.json();

}