[BUG]: octokit.dependabot.listAlertsForRepo does not respect severity

[kunalnagar]

What happened?

Calling octokit.dependabot.listAlertsForRepo with a severity filter does not respect the passed in value. For e.g:

const response = await octokit.dependabot.listAlertsForRepo({
  owner: repositoryOwner,
  repo: repositoryName,
  state: 'open',
  severity: 'low',
  ecosystem: 'npm',
  per_page: 10,
})

returns a list of ALL severities, and not just low

Versions

Octokit.js 20.0.2 or even the latest 21.0.1
Node.js 20

Relevant log output

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[github-actions]

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

[wolfy1339]

We don't do anything specific with parameters. Every parameter that is defined in the code gets sent.

Can you reproduce the issue if you send the request manually using octokit.request()?

Has this parameter been added recently? We're behind on updates to the API from GitHub due to some issues.

octokit/openapi#452

[kunalnagar]

@wolfy1339

Can you reproduce the issue if you send the request manually using octokit.request()?

Yep, same result using octokit.request() as well:

Has this parameter been added recently?

Don't think so. I see it in the REST API as well as in the 20.0.2 version of octokit/rest

Context:
I was made aware of this issue via this GitHub action I maintain. Folks there seem to think it may be related to the way getInput works on actions/toolkit.

When I use it locally on a simple node.js app (outside of github actions context) it works great! So maybe something is going on with Actions? Do you think that might be the place to open this request? Thanks!

Here's a sample run that shows all severities being logged
Here's the commit just FYI

[kunalnagar]

@kfcampbell @wolfy1339 - I did a bit more debugging and it seems that the culprit is the ecosystem key. If I pass in an empty string to ecosystem, it does not respect the severity param it seems. Hope this helps!

Screen.Recording.2024-08-03.at.9.49.24.PM.mov

[wolfy1339]

Try reporting it over in https://github.com/orgs/community/discussions/categories/api-and-webhooks

This doesn't seem like an issue with octokit

[kunalnagar]

@wolfy1339 - created: https://github.com/orgs/community/discussions/134561

Closing this issue out. Thank you for pointing me in the right direction 👍