[Schema Inaccuracy] code_scanning_alert fixed webhook: fixed_at typed as null instead of date-time string

Open

#6,058 opened on Feb 28, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 2/5
Estimated time: 1-3 hours
Newbie friendliness: 55/100

Issue type: Bug
Clarity: Clearly specified
Activity status: Stale
Tech stack: openapi
Domain: api

Research direction

Start by locating the code_scanning_alert webhook schema for action "fixed" and compare alert.fixed_at with the REST endpoint schema referenced in the issue. Update the schema so fixed_at accepts nullable ISO 8601 date-time strings, then verify that the example payload validates while null remains allowed.

Written by the indexing model from the issue text.

Description

feature

Expected

In the code_scanning_alert webhook event with action: "fixed", the alert.fixed_at property should be typed as a nullable ISO 8601 date-time string:

fixed_at:
  type: string
  format: date-time
  nullable: true
  description: >-
    The time that the alert was fixed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

This would be consistent with how fixed_at is already defined on the REST API endpoint GET /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}, where it is correctly typed as string or null with format: date-time.

Actual

The webhook schema for code_scanning_alert (action fixed) defines fixed_at with only type: null, meaning it can never contain a value — only null or absent.

Reproduction Steps

Configure a repository webhook (or GitHub App) to receive code_scanning_alert events.
Trigger a code_scanning_alert event with action: "fixed" (e.g., fix a CodeQL finding and merge to the default branch).
Inspect the webhook payload. The alert.fixed_at field contains an ISO 8601 datetime string, e.g. "2025-01-15T10:30:00Z".
Attempt to validate this payload against a client generated from the OpenAPI spec. Validation fails because the schema only permits null for fixed_at.

Impact

Any strongly-typed client generated from this spec (e.g., githubkit for Python, Octokit for TypeScript) will reject valid code_scanning_alert fixed webhook payloads because fixed_at does not conform to the null-only schema.

Reference

REST API endpoint schema (correct): https://docs.github.com/en/rest/code-scanning/code-scanning#get-a-code-scanning-alert
Webhook event docs: https://docs.github.com/en/webhooks/webhook-events-and-payloads#code_scanning_alert

Dominant language: No language data
Stars: 1.6k
Forks: 342
Avg merge: 3h 33m
Merged PRs (30d): 51

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

[Bug]: cron delivery mirror stores the delivery as a user turn, so the agent answers the human as the job's operator Open

area/sessions comp/cron comp/gateway P2 sweeper:risk-message-delivery sweeper:risk-session-state type/bug

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

NousResearch/hermes-agent#118863 · Opened Sep 22, 2026
PSBT inputs finalized by Bitcoin Core are not considered complete Open

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

spesmilo/electrum#10986 · Opened Sep 22, 2026
[Bug]: session_search misses a short non-Latin query typed in the other case Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

use-agent-os/agent-os#3312 · Opened Sep 22, 2026
[control_panel] uninstall 专用的 Agent 绑定守卫被误用于 start/stop/restart，导致被 Agent 绑定的 App 无法停止 Open

Difficulty 2/5 1-3 hours Newbie friendliness 85/100

buckyos/buckyos#626 · Opened Sep 22, 2026
[Bug] Hybrid search panics or truncates results for non-positive topK Open

needs-acceptance wg/data-plane-networking

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

vllm-project/semantic-router#4024 · 1 comment · Opened Sep 22, 2026

More Backend & API Design issues