[Schema Inaccuracy] code_scanning_alert reopened webhook: dismissed_by typed as empty object {} instead of simple-user

[donicrosby]

Expected

In the code_scanning_alert webhook event with action: "reopened", the alert.dismissed_by property should reference the simple-user schema (or be null), consistent with every other action variant that includes a dismissed_by field:

• appeared_in_branch — dismissed_by is simple-user | null
• closed_by_user — dismissed_by is simple-user | null
• fixed — dismissed_by is simple-user | null
• updated_assignment — dismissed_by is simple-user | null

The dismissed_by field on the reopened action's alert object should match this pattern:

dismissed_by:
  oneOf:
    - $ref: '#/components/schemas/simple-user'
    - type: 'null'

Actual

The webhook schema for code_scanning_alert (action reopened) defines dismissed_by as an empty object {} with no properties. When GitHub delivers this webhook for an alert that was previously dismissed before being reopened, the dismissed_by field contains a full user object (with login, id, etc.), but the schema describes it as an empty object.

Generated clients (e.g. githubkit) produce a model with zero fields — the Pydantic extra="ignore" default silently drops all incoming properties, leaving an empty model instance. Any access to .login then raises AttributeError.

Reproduction Steps

1. Configure a repository webhook (or GitHub App) to receive code_scanning_alert events.
2. Dismiss a code scanning alert via the GitHub UI (this populates dismissed_by with the dismissing user).
3. Reopen the same alert (e.g., via the GitHub UI or API), triggering a code_scanning_alert webhook with action: "reopened".
4. Inspect the webhook payload. The alert.dismissed_by field contains a full user object, e.g. {"login": "octocat", "id": 1, ...}.
5. Attempt to validate this payload against a client generated from the OpenAPI spec. The dismissed_by model is empty — all fields are silently dropped and .login is inaccessible.

Impact

Any strongly-typed client generated from this spec (e.g., githubkit for Python, Octokit for TypeScript) will silently produce an empty dismissed_by model instead of a usable user object. Accessing standard user fields like .login raises AttributeError at runtime.

Note: the companion reopened_by_user action correctly types dismissed_by as null (since a user-reopened alert will never have a dismissed_by). The generic reopened action is the only variant where this schema error exists.

Reference

• Previous fix for the same class of bug on the fixed action: [Schema Inaccuracy] code_scanning_alert fixed webhook: fixed_at typed as null instead of date-time string #6058
• Previous fix for the same class of bug on the closed_by_user action: [Schema Inaccuracy] code_scanning_alert closed_by_user webhook: fixed_at typed as null instead of date-time string #6081
• REST API endpoint schema (correct): https://docs.github.com/en/rest/code-scanning/code-scanning#get-a-code-scanning-alert
• Webhook event docs: https://docs.github.com/en/webhooks/webhook-events-and-payloads#code_scanning_alert

[yanyongyu]

The dismissed_by schemas for other actions of the code_scanning_alert event do not reference the simple-user schema currently, as illustrated below:

dismissed_by:
  title: User
  type:
  - object
  - 'null'
  properties:
    avatar_url:
      type: string
      format: uri
    deleted:
      type: boolean
    email:
      type:
      - string
      - 'null'
    events_url:
      type: string
      format: uri-template
    followers_url:
      type: string
      format: uri
    following_url:
      type: string
      format: uri-template
    gists_url:
      type: string
      format: uri-template
    gravatar_id:
      type: string
    html_url:
      type: string
      format: uri
    id:
      type: integer
    login:
      type: string
    name:
      type: string
    node_id:
      type: string
    organizations_url:
      type: string
      format: uri
    received_events_url:
      type: string
      format: uri
    repos_url:
      type: string
      format: uri
    site_admin:
      type: boolean
    starred_url:
      type: string
      format: uri-template
    subscriptions_url:
      type: string
      format: uri
    type:
      type: string
      enum:
      - Bot
      - User
      - Organization
    url:
      type: string
      format: uri
    user_view_type:
      type: string
  required:
  - login
  - id

[rnagulapalle]

i checked the bundled spec and this issue looks correct.

in descriptions/api.github.com/api.github.com.yaml, webhook-code-scanning-alert-reopened currently has alert.dismissed_by as just:

type: object
nullable: true

but other code_scanning_alert variants already describe dismissed_by with actual user fields (login, id, etc), so this is not only theoretical mismatch. it is an internal inconsistency in the webhook family itself.

so i think the impact here is exactly what you described: generator-based clients treat dismissed_by as an empty object shape and silently lose the real payload fields.

small nuance from checking the file: the fix may not need to be specifically simple-user if the rest of this webhook family is intentionally using the fuller inline user object shape. but either way, reopened should be brought into line with the other variants, because the current bare object contract is clearly weaker than what GitHub actually emits.