Merge pull request #181 from GeekMasher/depbot-enabled

Update how isEnabled works for Dependabot

Author: GeekMasher

examples/dependabot.py

@@ -6,9 +6,13 @@
     os.environ.get("GITHUB_REPOSITORY", "GeekMasher/ghastoolkit"),
 )
 
-depgraph = Dependabot()
+dependabot = Dependabot()
 
-alerts = depgraph.getAlerts()
+if not dependabot.isEnabled():
+    print("Dependabot is not enabled")
+    exit(1)
+
+alerts = dependabot.getAlerts()
 print(f"Total Alerts :: {len(alerts)}")
 
 for alert in alerts:

src/ghastoolkit/octokit/dependabot.py

@@ -24,11 +24,15 @@ def __init__(self, repository: Optional[Repository] = None) -> None:
     def isEnabled(self) -> bool:
         """Is Dependabot enabled."""
         try:
-            self.graphql.query(
+            data = self.graphql.query(
                 "GetDependencyStatus",
                 options={"owner": self.repository.owner, "repo": self.repository.repo},
             )
-            return True
+            return (
+                data.get("data", {})
+                .get("repository", {})
+                .get("hasVulnerabilityAlertsEnabled", False)
+            )
         except:
             logger.debug(f"Failed to get alert count")
         return False

src/ghastoolkit/octokit/graphql/__init__.py

@@ -1,9 +1,7 @@
 DEPENDENCY_GRAPH_STATUS = """\
 {
     repository(owner: "$owner", name: "$repo") {
-        vulnerabilityAlerts(first: 100, states: [OPEN], $cursor) {
-            totalCount
-        }
+        hasVulnerabilityAlertsEnabled
     }
 }
 """