[Schema Inaccuracy] code_scanning_alert reopened webhook: dismissed_by typed as empty object {} instead of simple-user

[donicrosby]

Expected

In the code_scanning_alert webhook event with action: "reopened", the alert.dismissed_by property should reference the simple-user schema (or be null), consistent with every other action variant that includes a dismissed_by field:

• appeared_in_branch — dismissed_by is simple-user | null
• closed_by_user — dismissed_by is simple-user | null
• fixed — dismissed_by is simple-user | null
• updated_assignment — dismissed_by is simple-user | null

The dismissed_by field on the reopened action's alert object should match this pattern:

dismissed_by:
  oneOf:
    - $ref: '#/components/schemas/simple-user'
    - type: 'null'

Actual

The webhook schema for code_scanning_alert (action reopened) defines dismissed_by as an empty object {} with no properties. When GitHub delivers this webhook for an alert that was previously dismissed before being reopened, the dismissed_by field contains a full user object (with login, id, etc.), but the schema describes it as an empty object.

Generated clients (e.g. githubkit) produce a model with zero fields — the Pydantic extra="ignore" default silently drops all incoming properties, leaving an empty model instance. Any access to .login then raises AttributeError.

Reproduction Steps

1. Configure a repository webhook (or GitHub App) to receive code_scanning_alert events.
2. Dismiss a code scanning alert via the GitHub UI (this populates dismissed_by with the dismissing user).
3. Reopen the same alert (e.g., via the GitHub UI or API), triggering a code_scanning_alert webhook with action: "reopened".
4. Inspect the webhook payload. The alert.dismissed_by field contains a full user object, e.g. {"login": "octocat", "id": 1, ...}.
5. Attempt to validate this payload against a client generated from the OpenAPI spec. The dismissed_by model is empty — all fields are silently dropped and .login is inaccessible.

Impact

Any strongly-typed client generated from this spec (e.g., githubkit for Python, Octokit for TypeScript) will silently produce an empty dismissed_by model instead of a usable user object. Accessing standard user fields like .login raises AttributeError at runtime.

Note: the companion reopened_by_user action correctly types dismissed_by as null (since a user-reopened alert will never have a dismissed_by). The generic reopened action is the only variant where this schema error exists.

Reference

• Previous fix for the same class of bug on the fixed action: [Schema Inaccuracy] code_scanning_alert fixed webhook: fixed_at typed as null instead of date-time string #6058
• Previous fix for the same class of bug on the closed_by_user action: [Schema Inaccuracy] code_scanning_alert closed_by_user webhook: fixed_at typed as null instead of date-time string #6081
• REST API endpoint schema (correct): https://docs.github.com/en/rest/code-scanning/code-scanning#get-a-code-scanning-alert
• Webhook event docs: https://docs.github.com/en/webhooks/webhook-events-and-payloads#code_scanning_alert

[yanyongyu]

The dismissed_by schemas for other actions of the code_scanning_alert event do not reference the simple-user schema currently, as illustrated below:

dismissed_by:
  title: User
  type:
  - object
  - 'null'
  properties:
    avatar_url:
      type: string
      format: uri
    deleted:
      type: boolean
    email:
      type:
      - string
      - 'null'
    events_url:
      type: string
      format: uri-template
    followers_url:
      type: string
      format: uri
    following_url:
      type: string
      format: uri-template
    gists_url:
      type: string
      format: uri-template
    gravatar_id:
      type: string
    html_url:
      type: string
      format: uri
    id:
      type: integer
    login:
      type: string
    name:
      type: string
    node_id:
      type: string
    organizations_url:
      type: string
      format: uri
    received_events_url:
      type: string
      format: uri
    repos_url:
      type: string
      format: uri
    site_admin:
      type: boolean
    starred_url:
      type: string
      format: uri-template
    subscriptions_url:
      type: string
      format: uri
    type:
      type: string
      enum:
      - Bot
      - User
      - Organization
    url:
      type: string
      format: uri
    user_view_type:
      type: string
  required:
  - login
  - id