[Schema Inaccuracy] Repository security advisory operations name `repository_advisories:read` / `repository_advisories:write` OAuth scopes that do not exist

descriptions/api.github.com/api.github.com.json にある6つのリポジトリセキュリティアドバイザリ操作の説明から始め、descriptions/ghec/ghec.json の対応するエントリと比較します。文書化された OAuth および classic personal access token の scopes を issue の再現結果と照合して確認します。完了の条件は、両方のファイルで有効な scopes のみが一貫して記載され、無効な repository_advisories の代替案が残っていないことです。

Schema Inaccuracy

Moved here from github/docs#46013 at a maintainer's request.

The description of six repository security advisory operations says that OAuth app tokens and personal access tokens (classic) can use either repo or a repository_advisories:* scope. GitHub's OAuth authorization server rejects both of those scope names as invalid.

For example, GET /repos/{owner}/{repo}/security-advisories/{ghsa_id} says:

OAuth app tokens and personal access tokens (classic) need the repo or repository_advisories:read scope to to get a published security advisory in a private repository, or any unpublished security advisory that the authenticated user has access to.

The same text appears in descriptions/api.github.com/api.github.com.json and descriptions/ghec/ghec.json (checked at 642960c).

Expected

The descriptions should name only scopes that can actually be granted. For these operations that is repo, so the or repository_advisories:read / or repository_advisories:write alternatives should be removed.

If these scopes are meant to exist, they should be grantable. They are also missing from Scopes for OAuth apps.

Reproduction Steps

Request a device code with only the scope named in the description. Any OAuth app client ID will do:

$ curl -s -X POST -H "Accept: application/json" \
    -d "client_id=<oauth app client id>&scope=repository_advisories:read" \
    https://github.com/login/device/code
{"error":"invalid_scope","error_description":"The scopes requested are invalid: repository_advisories:read.","error_uri":"https://docs.github.com"}

Results for other scopes, tested against github.com on 2026-09-22 UTC:

Other colon-separated scopes are accepted, so the colon is not the cause.

The "New personal access token (classic)" page at https://github.com/settings/tokens/new does not offer these scopes either.

Only github.com was tested. GHEC was not checked.