[Missing API] Add dependabot_malware_alerts to security_and_analysis on PATCH /repos/{owner}/{repo}

Open
#6,251 0 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
45/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Quiet
Tech stack
openapi
Domain
api

Research direction

Start at the OpenAPI definition for PATCH /repos/{owner}/{repo} and inspect how the security_and_analysis fields are represented for both PATCH requests and GET responses. First verify that the GitHub API supports this field; done means the endpoint description exposes dependabot_malware_alerts consistently in both directions and the repository’s validation checks pass.

Written by the indexing model from the issue text.

Description

documentation

Missing dependabot_malware_alerts in security_and_analysis (PATCH /repos)

The security_and_analysis object on the Update a repository endpoint currently supports toggling:

  • dependabot_security_updates
  • secret_scanning
  • secret_scanning_push_protection
  • secret_scanning_non_provider_patterns
  • secret_scanning_validity_checks

However, Dependabot malware alerts - which is a separate toggle in the repository settings UI under Security → Advanced Security - has no corresponding field in the API.

Why this matters

I maintain tooling that manages GitHub security settings across ~80+ repositories. Everything else can be configured via the REST API, but malware alerts require either clicking through the UI for each repo or setting up an org-wide security configuration (which requires org admin).

Having a dependabot_malware_alerts field in security_and_analysis (both GET and PATCH) would make it possible to:

  • Enable malware alerts in bulk across many repos
  • Audit whether it's enabled as part of compliance checks
  • Include it in IaC / GitOps workflows alongside the other security toggles
Expected behavior
// PATCH /repos/{owner}/{repo}
{
  "security_and_analysis": {
    "dependabot_malware_alerts": {
      "status": "enabled"
    }
  }
}

And the GET response should include the current state, same as the other fields.

Current workaround

Manual toggle per repo via the UI, or org-level security configurations (requires org admin).

Dominant language
No language data
Stars
1.6k
Forks
342
Avg merge
3h 33m
Merged PRs (30d)
51

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/rest-api-description

All issues in github/rest-api-description

Similar issues

More Backend & API Design issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.