[Schema Inaccuracy] code_scanning_alert reopened webhook: dismissed_by typed as empty object {} instead of simple-user

Inizia individuando lo schema del webhook code_scanning_alert per l'azione reopened e confronta la sua definizione di dismissed_by con le altre varianti dell'azione e le correzioni in #6058 e #6081. Il lavoro è completato quando dismissed_by fa riferimento a simple-user o null e i client generati mantengono campi utente come login.

Expected

In the code_scanning_alert webhook event with action: "reopened", the alert.dismissed_by property should reference the simple-user schema (or be null), consistent with every other action variant that includes a dismissed_by field:

• appeared_in_branch — dismissed_by is simple-user | null
• closed_by_user — dismissed_by is simple-user | null
• fixed — dismissed_by is simple-user | null
• updated_assignment — dismissed_by is simple-user | null

The dismissed_by field on the reopened action's alert object should match this pattern:

dismissed_by:
  oneOf:
    - $ref: '#/components/schemas/simple-user'
    - type: 'null'

Actual

The webhook schema for code_scanning_alert (action reopened) defines dismissed_by as an empty object {} with no properties. When GitHub delivers this webhook for an alert that was previously dismissed before being reopened, the dismissed_by field contains a full user object (with login, id, etc.), but the schema describes it as an empty object.

Generated clients (e.g. githubkit) produce a model with zero fields — the Pydantic extra="ignore" default silently drops all incoming properties, leaving an empty model instance. Any access to .login then raises AttributeError.

Reproduction Steps

1. Configure a repository webhook (or GitHub App) to receive code_scanning_alert events.
2. Dismiss a code scanning alert via the GitHub UI (this populates dismissed_by with the dismissing user).
3. Reopen the same alert (e.g., via the GitHub UI or API), triggering a code_scanning_alert webhook with action: "reopened".
4. Inspect the webhook payload. The alert.dismissed_by field contains a full user object, e.g. {"login": "octocat", "id": 1, ...}.
5. Attempt to validate this payload against a client generated from the OpenAPI spec. The dismissed_by model is empty — all fields are silently dropped and .login is inaccessible.

Impact

Any strongly-typed client generated from this spec (e.g., githubkit for Python, Octokit for TypeScript) will silently produce an empty dismissed_by model instead of a usable user object. Accessing standard user fields like .login raises AttributeError at runtime.

Note: the companion reopened_by_user action correctly types dismissed_by as null (since a user-reopened alert will never have a dismissed_by). The generic reopened action is the only variant where this schema error exists.

Reference

• Previous fix for the same class of bug on the fixed action: #6058
• Previous fix for the same class of bug on the closed_by_user action: #6081
• REST API endpoint schema (correct): https://docs.github.com/en/rest/code-scanning/code-scanning#get-a-code-scanning-alert
• Webhook event docs: https://docs.github.com/en/webhooks/webhook-events-and-payloads#code_scanning_alert