Unable to fetch dependabot metadata with v1.3.0 and `alert-lookup` & `compat-lookup` enabled about fetch-metadata HOT 2 CLOSED

It turns out the default secrets.GITHUB_TOKEN does not have enough permissions to allow access to the dependabot vulnerabilities graphQL endpoints. I was able to fix that by creating a PAT with the public_repo scope and pass it to the github-token action parameter instead. See https://github.com/SalimBensiali/le-blanc-jewellery/blob/584b38d698d92edbd62d5f93ce8d4edf4333d4ca/.github/workflows/dependabot-auto-label.yml#L24

I only found out about this this by accident/luck as documentation around this was very limited. See https://chezsoi.org/lucas/blog/listing-all-github-security-alerts-of-a-user-s-projects-using-graphql-and-python.html where it is being mentioned.

To create a PAT see https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token

I can raise a PR to add this to the docs.

from fetch-metadata.

@SalimBensiali Ah, apologies for that. We have a few places where the GITHUB_TOKEN should be substituted for one with augmented permissions.

I need to make some other updates to the documentation so I will incorporate this.

from fetch-metadata.