fix(sweep): paginate the Dependabot alerts fetch - #137
Merged
Conversation
check_alerts requested only per_page=100 and used the first page, so repos with >100 open alerts (e.g. mozilla/fxa at 194) had the rest silently invisible — never investigated. Loop through all pages until a short page. Added a >100-alert pagination test.
There was a problem hiding this comment.
Pull request overview
Paginates Dependabot alert discovery so repositories with over 100 open alerts are fully processed.
Changes:
- Fetches alert pages until reaching a short or empty page.
- Adds a regression test covering 105 alerts.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
scripts/sweep.py |
Implements paginated alert fetching. |
tests/scripts/test_sweep.py |
Adds pagination regression coverage. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
With pagination removed, a sweep could dispatch all of a repo's alerts at once (fxa: 194) — a cost/concurrency spike. Add two safeguards: - investigate.max_per_sweep (default 50): per-repo cap; the rest drain on later sweeps (stateless — tagged alerts are skipped next time). - INVESTIGATE_TOTAL_CAP (200): global backstop across all repos per run. Per-alert budget is unchanged.
The pagination test only checked call count; a regression fetching page 1 twice would still pass. Assert the recorded page params are ['1','2'].
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
Suppressed comments (1)
Previously missed (1) — in code that hasn't changed since the last review.
scripts/sweep.py:607
- This failure path falls through to the successful end-of-pagination handling. A page-1 failure is therefore followed by “No open Dependabot alerts,” while a later-page failure reports the partial
datalength as the total found; both messages misrepresent an API failure. Keep fetch failures distinct from an empty/complete response (and explicitly decide whether partial pages should still be dispatched).
except Exception as e:
print(f" Could not fetch alerts (page {page}): {e}")
break
The global INVESTIGATE_TOTAL_CAP path in main() was untested. Extract it into cap_investigations(actions, cap) and cover over-cap (200 kept, non-investigate actions preserved), exact-boundary, and under-cap cases.
toufali
force-pushed
the
fix/sweep-paginate-alerts
branch
from
August 21, 2026 18:26
e0561dd to
098b47c
Compare
toufali
added a commit
that referenced
this pull request
Aug 21, 2026
fix(sweep): cursor pagination for Dependabot alerts (hotfix for #137)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #136.
check_alertsrequestedper_page=100and used only the first page, so repos with >100 open alerts (mozilla/fxa has 194) had the rest never investigated — confirmed live: 100 of 194 investigated, 94 invisible.Paginate until a page returns <100. Added a >100-alert regression test.