feat(repo): add configurable vulnerability alerts support

[UnstoppableMango]

Allow repositories to opt out of Dependabot vulnerability alerts by
exposing a vulnerabilityAlerts option. Disable alerts for the pkgs
repo as its lockfiles track upstream pins rather than direct
dependencies, making advisories unactionable.

Summary by CodeRabbit

• New Features

  • Repository configurations can now optionally enable or disable GitHub vulnerability alerts.
  • Public repository settings support passing through the vulnerability-alert configuration.

• Configuration Changes

  • Vulnerability alerts are disabled for the pkgs repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 0799e6dd-fab3-4dd0-8838-a5ea33c6047d

📥 Commits

Reviewing files that changed from the base of the PR and between f2de2b5 and 14e47f3.

📒 Files selected for processing (3)

• components/publicRepo.ts
• components/repo.ts
• index.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 4 remain after this review.

---

📝 Walkthrough

Walkthrough

The repository components now accept an optional vulnerability-alert setting. The pkgs repository disables vulnerability alerts through this configuration.

Changes

Vulnerability alert configuration

Layer / File(s)	Summary
Repository alert input and wiring components/repo.ts, components/publicRepo.ts	RepoArgs and PublicRepoArgs accept vulnerabilityAlerts. Repo applies the value to RepositoryVulnerabilityAlerts.enabled.
pkgs repository setting index.ts	The pkgs repository sets vulnerabilityAlerts to false and documents the setting.

Estimated code review effort: 2 (Simple) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 14e47

Repository vulnerability alerts are now configurable, with alerts disabled only for pkgs where lockfile advisories are not actionable. The change is scoped and ready to merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: configurable vulnerability alerts support for repositories. It is concise and specific.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 3…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch vuln-alerts

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟢 Approval recommended

The change is small and targeted, with only a minor maintainability suggestion around making the documented default explicit.

Pull request overview

Adds an opt-out switch for GitHub/Dependabot vulnerability alerts in this Pulumi-managed GitHub org, allowing per-repository configuration (used here to disable alerts for pkgs, where advisories are noisy/unactionable due to upstream-pinned lockfiles).

Changes:

• Introduce a vulnerabilityAlerts?: Input<boolean> option on repos and plumb it through PublicRepo into the base Repo component.
• Wire the option into the gh.RepositoryVulnerabilityAlerts resource via its enabled field.
• Disable vulnerability alerts for the pkgs repository in index.ts.

File summaries

File	Description
index.ts	Disables vulnerability alerts specifically for the pkgs repo.
components/repo.ts	Adds configurable vulnerabilityAlerts arg and passes it to RepositoryVulnerabilityAlerts.enabled.
components/publicRepo.ts	Exposes and forwards vulnerabilityAlerts from PublicRepoArgs to the base Repo.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[pulumi]

🍹 The Update (preview) for UnstoppableMango/unmango-github/prod (at 14e47f3) was successful.

Resource Changes

    Name  Type                                                                      Operation
~   pkgs  unmango:github:PublicRepo                                                 update
~   pkgs  github:index/repositoryVulnerabilityAlerts:RepositoryVulnerabilityAlerts  update