仓库安全公告评论 API 开启公开预览

你现在可以通过 REST API 读取、新增和编辑仓库安全公告上的评论，其中包括由私密漏洞报告创建的公告。

此前，公告讨论只能通过 Web UI 访问，尽管其中通常包含漏洞报告最有价值的分诊上下文。借助这些新端点，你可以：

• 列出仓库安全公告的评论，并可选择仅返回自指定时间以来更新的评论。
• 获取单条评论。
• 新增评论。
• 编辑评论。

仓库安全公告响应现在还会包含 comments 评论数量；全局公告响应则会包含其关联仓库安全公告的评论数量。因此，你可以在获取评论前判断哪些公告存在讨论。这些字段统计非机密评论，并帮助你在获取评论前识别具有评论活动的公告。

这将帮助你为审计和迁移导出公告讨论、自动添加分诊备注，并构建与现有 Issue 和 Pull Request 工作流相同的公告工作流。

有几点需要注意：

• 访问权限遵循与公告本身相同的规则。你需要具备仓库安全公告 scope，且无法查看公告的用户也无法查看其评论。
• 访问需要具备查看该公告的权限，以及适当的仓库安全公告读取或写入权限或令牌 scope。非协作者无法查看内部评论，且这些 REST API 端点不会返回机密评论。
• API 暂不支持删除评论。

该功能现已面向 GitHub Free、GitHub Pro、GitHub Team 和 GitHub Enterprise Cloud 的公共仓库开启公开预览。

请参阅我们的 REST API 文档了解更多信息。

You can now read, add, and edit comments on repository security advisories using the REST API, including advisories created from private vulnerability reports.

Until now, the discussion on an advisory was only reachable in the web UI, even though it often holds the most useful triage context on a vulnerability report. With the new endpoints, you can:

• List the comments on a repository security advisory, optionally limited to those updated since a given time.
• Get a single comment.
• Add a comment.
• Edit a comment.

Repository security advisory responses also now include a comments count, and global advisory responses include the count for their linked repository advisory, so you can tell which advisories have discussion before you fetch it. These fields count non-confidential comments and help identify advisories with comment activity before fetching the comments.

This helps you export advisory discussions for audits and migrations, automatically add triage notes, and build advisory workflows that work the same way as the ones you already have for issues and pull requests.

A few things to know:

• Access follows the same rules as the advisory itself. You need the repository security advisories scope, and anyone who can’t see an advisory can’t see its comments.
• Access requires permission to view the advisory and the appropriate read or write repository security advisories permission or token scope. Non-collaborators cannot view internal comments, and confidential comments are not returned by these REST endpoints.
• Deleting comments isn’t supported yet through the API.

This is available in public preview for public repositories on GitHub Free, GitHub Pro, GitHub Team, and GitHub Enterprise Cloud.

Learn more in our REST API docs.