Skip to main content

COLLECT OPEN SECURITY ALERTS ACROSS GITHUB REPOSITORIES

This guide shows you how to record the open Dependabot, code scanning and secret scanning alerts for a set of repositories in one GitHub organization. Each repository gets one alerts resource per scanner. A repository where a scanner is not enabled is recorded as unavailable, and the run does not fail.

Prerequisites

  • A Swamp repository
  • A GitHub token with read access to the Dependabot, code scanning and secret scanning alerts of the repositories you want to cover
  • Network access to the GitHub API, or to your GitHub Enterprise Server

Pull the extension

swamp extension pull @hivemq/github

The output looks like:

INF extension·pull: Pulling "@hivemq/github"@"2026.08.27.1787839782"
INF extension·pull: Identity verified: "@hivemq/github"@"2026.08.27.1787839782"
INF extension·pull: Pulled "@hivemq/github"@"2026.08.27.1787839782"
INF extension·pull: Extracted 21 files:

Store the token in a vault

Create a vault named github and store the token in it under the key token. The Storing Secrets tutorial covers storing a value, and the Vaults reference lists the vault commands. If you already keep the token in another vault, use that vault's name and key in the next step.

Create one behavior per scanner

Create three behaviors, one for each scanner:

  • dependabot-alerts of type @hivemq/github/dependabot/alerts
  • code-scanning-alerts of type @hivemq/github/code-scanning/alerts
  • secret-scanning-alerts of type @hivemq/github/secret-scanning/alerts

Each type requires the org and token global arguments. Pass the token as a vault reference so that the secret is never written into a definition. Each definition's global arguments look like this:

globalArguments:
  org: example-org
  token: "${{ vault.get('github', 'token') }}"

If the organization is on GitHub Enterprise Server, also set baseUrl to the server's API base URL. Without it, the behaviors use https://api.github.com. Create and Run a Behavior shows the create command and the global argument syntax.

List the open alerts

Pass the same repositories to each scanner so the results cover the same set. The repos input is an array of repository names in the organization.

List the Dependabot alerts:

swamp behavior run dependabot-alerts list --input 'repos:json=["api","web"]'

This fetches the open Dependabot alerts for api and web, then writes one alerts resource per repository and one run resource that aggregates the call. A repository with Dependabot alerts disabled is recorded as unavailable.

List the code scanning alerts:

swamp behavior run code-scanning-alerts list --input 'repos:json=["api","web"]'

This writes one alerts resource per repository and one run resource. A repository without code scanning set up is recorded as unavailable.

List the secret scanning alerts:

swamp behavior run secret-scanning-alerts list --input 'repos:json=["api","web"]'

This writes the same pair of resources. It includes non-provider and AI-detected generic patterns, which the GitHub API leaves out of its default listing.

Read the results

Each alerts resource lists the repository's open alerts with number, htmlUrl, title and severity. It also carries an unavailable marker when the scanner is not enabled, and a truncated marker when the list was cut short. Use Query and Manage Data to find the latest alerts resources for each behavior.

The run resource from each scanner is the input that Build Slack payloads from GitHub security alert runs expects. To repeat the collection on a timer, put the three list calls in a workflow and follow Run Workflows on a Schedule.