Tatsh / deltona / 26735645812

100%

push

github

git: fix Dependabot detection missing security-update repos

The gidgethub migration read security_and_analysis straight off the
repository dicts returned by /user/repos, but GitHub only includes that
field on the single-repository endpoint, never on the list endpoint. As
a result _uses_dependabot never saw dependabot_security_updates.status,
fell through to probing for a .github/workflows/dependabot.yml file
(404 for most repositories), and skipped every repository that uses
Dependabot security updates without a workflow file. PyGithub had hidden
this by lazily fetching the full repository when .security_and_analysis
was accessed.

Restore that behaviour: when the field is absent, fetch the full
repository to read it. Explicit -r owner/name runs already fetch via the
single-repository endpoint, so no extra request is made for them.

The test fake was masking the bug by including security_and_analysis in
its list payload; it now mirrors GitHub and returns the field only from
the single-repository route, so the suite exercises the full-repository
fetch.

Signed-off-by: Andrew Udvare <audvare@gmail.com>

423 of 423 branches covered (100.0%)

Branch coverage included in aggregate %.

4 of 4 new or added lines in 1 file covered. (100.0%)

3490 of 3490 relevant lines covered (100.0%)

5.0 hits per line