Repository: google/go-github
Pull request #3547 (2025-04-14 14:19:44)

feat: Add EPSS to Dependabot alerts
Adding new field with EPSS information to Dependabot alerts

google-cla[bot]: Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this [failed invocation](https://github.com/google/go-github/pull/3547/checks?check_run_id=40513412301) of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.
mdfleury-wbd: > Thank you, @mdfleury-wbd! Do you have a link that would give people more information about those new fields and how to interpret them that you could add to the comments?

I do 

https://github.blog/changelog/2024-10-10-epss-scores-in-the-github-advisory-database/

Any preference as to where in the comments?
gmlewis: Please run `go generate ./...` (or `./script/generate.sh`) one more time and push the results.
gmlewis: Oh, sorry, it looks like a test needs updating (remove the two `Ptr()` calls).

Patch:
diff --git a/github/dependabot_alerts.go b/github/dependabot_alerts.go
index c274f07b..67e624c9 100644
--- a/github/dependabot_alerts.go
+++ b/github/dependabot_alerts.go
@@ -29,6 +29,15 @@ type AdvisoryCWEs struct {
 	Name  *string `json:"name,omitempty"`
 }
 
+// AdvisoryEPSS represents the advisory pertaining to the Exploit Prediction Scoring System.
+//
+// For more information, see:
+// https://github.blog/changelog/2024-10-10-epss-scores-in-the-github-advisory-database/
+type AdvisoryEPSS struct {
+	Percentage float64 `json:"percentage"`
+	Percentile float64 `json:"percentile"`
+}
+
 // DependabotSecurityAdvisory represents the GitHub Security Advisory.
 type DependabotSecurityAdvisory struct {
 	GHSAID          *string                  `json:"ghsa_id,omitempty"`
@@ -39,6 +48,7 @@ type DependabotSecurityAdvisory struct {
 	Severity        *string                  `json:"severity,omitempty"`
 	CVSS            *AdvisoryCVSS            `json:"cvss,omitempty"`
 	CWEs            []*AdvisoryCWEs          `json:"cwes,omitempty"`
+	EPSS            *AdvisoryEPSS            `json:"epss,omitempty"`
 	Identifiers     []*AdvisoryIdentifier    `json:"identifiers,omitempty"`
 	References      []*AdvisoryReference     `json:"references,omitempty"`
 	PublishedAt     *Timestamp               `json:"published_at,omitempty"`
diff --git a/github/github-accessors.go b/github/github-accessors.go
index 1e244278..4a327027 100644
--- a/github/github-accessors.go
+++ b/github/github-accessors.go
@@ -6854,6 +6854,14 @@ func (d *DependabotSecurityAdvisory) GetDescription() string {
 	return *d.Description
 }
 
+// GetEPSS returns the EPSS field.
+func (d *DependabotSecurityAdvisory) GetEPSS() *AdvisoryEPSS {
+	if d == nil {
+		return nil
+	}
+	return d.EPSS
+}
+
 // GetGHSAID returns the GHSAID field if it's non-nil, zero value otherwise.
 func (d *DependabotSecurityAdvisory) GetGHSAID() string {
 	if d == nil || d.GHSAID == nil {


Test patch:
diff --git a/github/dependabot_alerts_test.go b/github/dependabot_alerts_test.go
index 3a46855e..8410825a 100644
--- a/github/dependabot_alerts_test.go
+++ b/github/dependabot_alerts_test.go
@@ -281,6 +281,10 @@ func TestDependabotSecurityAdvisory_Marshal(t *testing.T) {
 				Name:  Ptr("Exposure of Sensitive Information to an Unauthorized Actor"),
 			},
 		},
+		EPSS: &AdvisoryEPSS{
+			Percentage: 0.05,
+			Percentile: 0.5,
+		},
 		Identifiers: []*AdvisoryIdentifier{
 			{
 				Type:  Ptr("GHSA"),
@@ -353,6 +357,10 @@ func TestDependabotSecurityAdvisory_Marshal(t *testing.T) {
           "name": "Exposure of Sensitive Information to an Unauthorized Actor"
         }
       ],
+      "epss": {
+        "percentage": 0.05,
+        "percentile": 0.5
+      },
       "identifiers": [
         {
           "type": "GHSA",
diff --git a/github/github-accessors_test.go b/github/github-accessors_test.go
index 8dadb706..9efb190b 100644
--- a/github/github-accessors_test.go
+++ b/github/github-accessors_test.go
@@ -8904,6 +8904,14 @@ func TestDependabotSecurityAdvisory_GetDescription(tt *testing.T) {
 	d.GetDescription()
 }
 
+func TestDependabotSecurityAdvisory_GetEPSS(tt *testing.T) {
+	tt.Parallel()
+	d := &DependabotSecurityAdvisory{}
+	d.GetEPSS()
+	d = nil
+	d.GetEPSS()
+}
+
 func TestDependabotSecurityAdvisory_GetGHSAID(tt *testing.T) {
 	tt.Parallel()
 	var zeroValue string