https://www.cloudkaramchari.com/tags/graphql-api/Recent content in GraphQL API on CloudkaramchariHugo -- gohugo.ioencloudkaramchariSun, 06 Sep 2026 13:00:00 +0530https://www.cloudkaramchari.com/blog/github-actions-vulnerability-alerts-permission-dependabot-github-token-guide/Sun, 06 Sep 2026 13:00:00 +0530https://www.cloudkaramchari.com/blog/github-actions-vulnerability-alerts-permission-dependabot-github-token-guide/ <h1 id="github-actions-new-vulnerability-alerts-permission-read-dependabot-alerts-without-a-pat">GitHub Actions' New vulnerability-alerts Permission: Read Dependabot Alerts Without a PAT</h1> <p>If you've ever tried to have a GitHub Actions workflow check for open Dependabot alerts — to block a release, gate a merge, or post a Slack summary — you've probably hit a wall: the default <code>GITHUB_TOKEN</code> can't read them. The workaround for years has been minting a classic personal access token with <code>security_events</code> scope, stashing it as a repo secret, and hoping whoever set it up doesn't leave the org before it needs rotating. As of the GitHub Actions early-September 2026 update, that workaround is no longer necessary. There's a new <code>vulnerability-alerts</code> permission you can grant directly to <code>GITHUB_TOKEN</code>, scoped to read-only, no PAT required.</p>