[twistedmelonman]

What

The daily digest now reports, per repo, whether Dependabot security alerts are on. A new "Dependabot alerts" section follows CodeQL and uses the same layout: a count line, a table of gaps and unreadable repos, "No gaps" only when there are none, and an explicit message when every read failed.

On 2026-10-21, alerts turned out to be off on 8 repos (7 NOS repos plus smartwatermelon/vpn-lan-bridge), and nothing flagged it.

How each state is decided

GET repos/{owner}/{repo}/vulnerability-alerts, per non-archived repo:

Response	State
exit 0, empty body (204)	on
HTTP 404 and the body message is exactly Vulnerability alerts are disabled.	off, listed as a gap
anything else: 403, a bare Not Found 404, the disabled message on a non-404, a body on success	unreadable, listed with the reason

A bare 404 is how GitHub hides a resource the token cannot see, so it never counts as off. Unreadable never counts as on or off. If every read fails, the section says nothing was verified and names Administration: Read as the likely cause.

There is no exempt class. Off is a gap on every repo, forks included.

Credentials: no App change needed

On both the 204 and the 404 responses, the endpoint returns X-Accepted-GitHub-Permissions: administration=read (captured 2026-10-21). The dependabot-digest-swm App already holds Administration: read for the CodeQL section, and the workflow already asks for it. The workflow comments and the credentials runbook now say that this grant serves both sections, so nobody prunes it thinking only CodeQL uses it.

What is not verified: the exact response an App token without Administration would get. I could not mint such a token. The test fixture for that case copies the CodeQL section's Resource not accessible by integration 403. Whatever that response turns out to be, the probe reports it as unreadable, because only the exact disabled-message 404 counts as off.

Decision for Andrew

A live survey with a user token on 2026-10-21 found one repo still off: twistedmelonman/Instapaper-MCP, a fork. The protection and CodeQL sections exempt forks by recorded decision. No such decision exists for alerts, so this PR flags the fork. Turn alerts on there, or record a fork exemption, and the row goes away.

Tests

test-standards.sh covers on (204, public and private), off (fork and non-fork), and unreadable. The unreadable cases include known-bad shapes: a bare Not Found 404, a 403 that carries the disabled message, an integration 403, and a body returned on success. A mutation check that treats every 404 as off makes the suite fail. Render tests cover the all-unreadable, all-on, missing-field and malformed cases.

Two test fixes were needed:

• The stub now prints a 404 body's message to stderr, as real gh does.
• Section slices now end at the next section instead of at ---. CodeQL is no longer the last section, and macOS sed does not support \| alternation.