Get PR Dependency Advisories
Platform Note
- Clean-install path: use the Go command from
.github/tools/skills-go.
Authentication
- Azure DevOps PAT:
ADO_PAT_<normalized_org> - GitHub PAT:
GH_SEC_PAT
What it does
- Resolves source branch from PR metadata.
- Finds changed dependency manifest files in the selected PR iteration.
- Extracts dependencies from supported manifests.
- Queries
https://api.github.com/advisoriesfor each dependency. - Returns one consolidated JSON report.
Supported changed manifests
package.json(dependencies,devDependencies,optionalDependencies,peerDependencies)package-lock.jsonrequirements.txtrequirements-dev.txtpoetry.lockgo.modCargo.lock
Arguments
| # | Name | Required | Description |
|---|---|---|---|
| 1 | organization | Yes | Azure DevOps organization |
| 2 | project | Yes | Project name or ID |
| 3 | repositoryId | Yes | Repository name or ID |
| 4 | pullRequestId | Yes | Pull request ID |
| 5 | iterationId | No | PR iteration ID (defaults to latest) |
| 6 | per_page | No | Max advisories per dependency query (1..100, default: 20) |
Examples
go run ./.github/tools/skills-go/cmd/skills-go get-pr-dependency-advisories myorg MyProject MyRepo 42
Output
Returns compact JSON with:
manifestFilesdependenciesadvisoriesdependenciesCheckedadvisoriesFoundhighOrCritical