From 14e47f3b0d0ce8b719a1d2ca2f0489b967982b86 Mon Sep 17 00:00:00 2001
From: UnstoppableMango <erik.rasmussen@unmango.dev>
Date: Mon, 7 Sep 2026 12:19:17 -0500
Subject: [PATCH] feat(repo): add configurable vulnerability alerts support

Allow repositories to opt out of Dependabot vulnerability alerts by
exposing a `vulnerabilityAlerts` option. Disable alerts for the `pkgs`
repo as its lockfiles track upstream pins rather than direct
dependencies, making advisories unactionable.
---
 components/publicRepo.ts | 3 +++
 components/repo.ts       | 5 ++++-
 index.ts                 | 4 ++++
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/components/publicRepo.ts b/components/publicRepo.ts
index d3e1420..36703a2 100644
--- a/components/publicRepo.ts
+++ b/components/publicRepo.ts
@@ -27,6 +27,8 @@ export interface PublicRepoArgs {
 	topics?: Input<Input<string>[]>;
 	/** Passed through to the repository resource, for adopting one that already exists. */
 	repoOptions?: CustomResourceOptions;
+	/** Whether Dependabot raises alerts for the repository. Defaults to enabled. */
+	vulnerabilityAlerts?: Input<boolean>;
 }
 
 export class PublicRepo extends Repo {
@@ -51,6 +53,7 @@ export class PublicRepo extends Repo {
 					topics: args.topics,
 				},
 				repoOptions: args.repoOptions,
+				vulnerabilityAlerts: args.vulnerabilityAlerts,
 			},
 			opts,
 		);
diff --git a/components/repo.ts b/components/repo.ts
index c904c6e..2d64cf2 100644
--- a/components/repo.ts
+++ b/components/repo.ts
@@ -1,5 +1,5 @@
 import * as gh from '@pulumi/github';
-import { ComponentResource, ComponentResourceOptions, CustomResourceOptions } from '@pulumi/pulumi';
+import { ComponentResource, ComponentResourceOptions, CustomResourceOptions, Input } from '@pulumi/pulumi';
 
 export interface RepoArgs {
 	overrides: Partial<gh.RepositoryArgs>;
@@ -9,6 +9,8 @@ export interface RepoArgs {
 	 * alias for one whose URN is moving.
 	 */
 	repoOptions?: CustomResourceOptions;
+	/** Whether Dependabot raises alerts for the repository. Defaults to enabled. */
+	vulnerabilityAlerts?: Input<boolean>;
 }
 
 export abstract class Repo extends ComponentResource {
@@ -38,6 +40,7 @@ export abstract class Repo extends ComponentResource {
 
 		const vulnerabilityAlerts = new gh.RepositoryVulnerabilityAlerts(name, {
 			repository: repo.name,
+			enabled: args.vulnerabilityAlerts,
 		}, { parent: this });
 
 		this.repo = repo;
diff --git a/index.ts b/index.ts
index 67a1090..fcd50fe 100644
--- a/index.ts
+++ b/index.ts
@@ -124,6 +124,10 @@ const pkgs = new PublicRepo('pkgs', {
 	description: 'Mini nixpkgs — personal Nix package collection',
 	topics: ['nix', 'nixpkgs', 'nix-flake'],
 	githubChecks: ['build (x86_64-linux)'],
+	// Lockfiles under pkgs/ record what upstream projects pin, not what this
+	// repo depends on. Their advisories are unactionable here and accumulate
+	// with every package added.
+	vulnerabilityAlerts: false,
 });
 
 const terraform2crd = new PublicRepo('terraform2crd', {