@lincoln504/pi-research 0.1.12 → 1.0.0

package/src/security/github-advisories.ts

@@ -12,102 +12,27 @@
  */
 
 import type { Advisory, GitHubResult } from './types.ts';
+import type { GitHubAdvisoryRaw } from './github-advisory-types.ts';
+import { normalizeEcosystem } from './ecosystem.ts';
+import { createTimeoutSignal, retryWithBackoff, isTransientError } from '../web-research/retry-utils.ts';
+import { CircuitBreaker } from '../utils/circuit-breaker.ts';
+import { metrics } from '../utils/metrics.ts';
 import { logger } from '../logger.ts';
-import { createTimeoutSignal, retryWithBackoff } from '../web-research/retry-utils.ts';
-
-// ============================================================================
-// Type Definitions for Fetch API
-// ============================================================================
-
-/**
- * Standard fetch API types for compatibility
- */
-type FetchType = (
-  _input: string | Request,
-  _init?: RequestInit,
-) => Promise<Response>;
-
-declare const fetch: FetchType;
-
-interface Headers {
-  append(_name: string, _value: string): void;
-  delete(_name: string): void;
-  get(_name: string): string | null;
-  has(_name: string): boolean;
-  set(_name: string, _value: string): void;
-  forEach(_callback: (_value: string, _name: string) => void): void;
-}
-
-interface Response {
-  readonly headers: Headers;
-  readonly ok: boolean;
-  readonly redirected: boolean;
-  readonly status: number;
-  readonly statusText: string;
-  readonly type: 'basic' | 'cors' | 'default' | 'error' | 'opaque' | 'opaqueredirect';
-  readonly url: string;
-  readonly body: ReadableStream<Uint8Array> | null;
-  readonly bodyUsed: boolean;
-  clone(): Response;
-  arrayBuffer(): Promise<ArrayBuffer>;
-  blob(): Promise<Blob>;
-  formData(): Promise<FormData>;
-  json(): Promise<unknown>;
-  text(): Promise<string>;
-}
-
-// ============================================================================
-// Type Definitions for GitHub API Responses
-// ============================================================================
-
-/**
- * GitHub Advisory Vulnerability Package
- */
-interface GitHubAdvisoryPackage {
-  readonly ecosystem?: string;
-  readonly name?: string;
-}
-
-/**
- * GitHub Advisory Affected Entry
- */
-interface GitHubAdvisoryAffected {
-  readonly package?: GitHubAdvisoryPackage;
-}
-
-/**
- * GitHub Advisory Vulnerability
- */
-interface GitHubAdvisoryVulnerability {
-  readonly package?: GitHubAdvisoryPackage;
-  readonly affected?: readonly GitHubAdvisoryAffected[];
-}
-
-/**
- * Raw GitHub Advisory from API response
- */
-interface GitHubAdvisoryRaw {
-  readonly ghsa_id?: string;
-  readonly id?: string;
-  readonly summary?: string;
-  readonly description?: string;
-  readonly severity?: string;
-  readonly published_at?: string;
-  readonly updated_at?: string;
-  readonly cve_id?: string;
-  readonly html_url?: string;
-  readonly advisory_url?: string;
-  readonly vulnerabilities?: readonly GitHubAdvisoryVulnerability[];
-  readonly affected?: readonly GitHubAdvisoryAffected[];
-}
-
-/**
- * GitHub API list response wrapper
- */
-interface GitHubAdvisoryListResponse {
-  readonly items?: readonly GitHubAdvisoryRaw[];
-}
-
+import {
+  isGitHubAdvisoryRaw,
+  isArray,
+  isGitHubAdvisoryListResponse,
+  isGitHubAdvisoryArray,
+  isSingleGitHubAdvisory,
+  mapGitHubAdvisory,
+} from './github-advisory-types.ts';
+
+const githubCircuitBreaker = new CircuitBreaker({
+  failureThreshold: 5,
+  resetTimeoutMs: 10000,
+  name: 'GitHub API',
+  isTransientError: isTransientError
+});
 
 // ============================================================================
 // Constants
@@ -116,197 +41,18 @@ interface GitHubAdvisoryListResponse {
 const GITHUB_API_BASE = 'https://api.github.com';
 const DEFAULT_MAX_RESULTS = 20;
 
-// ============================================================================
-// Type Guards
-// ============================================================================
-
-/**
- * Type guard to check if value is a GitHubAdvisoryRaw
- */
-function isGitHubAdvisoryRaw(value: unknown): value is GitHubAdvisoryRaw {
-  if (typeof value !== 'object' || value === null) {
-    return false;
-  }
-  return true;
-}
-
-/**
- * Type guard to check if value is an array
- */
-function isArray(value: unknown): value is readonly unknown[] {
-  return Array.isArray(value);
-}
-
-/**
- * Type guard to check if value is a string
- */
-function isString(value: unknown): value is string {
-  return typeof value === 'string';
-}
-
-/**
- * Type guard to check if value is an object (non-null, non-array)
- */
-function isObject(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !isArray(value);
-}
-
-/**
- * Type guard for GitHubAdvisoryPackage
- */
-function isGitHubAdvisoryPackage(value: unknown): value is GitHubAdvisoryPackage {
-  if (!isObject(value)) {
-    return false;
-  }
-  return true;
-}
-
-/**
- * Type guard for GitHubAdvisoryAffected
- */
-function isGitHubAdvisoryAffected(value: unknown): value is GitHubAdvisoryAffected {
-  if (!isObject(value)) {
-    return false;
-  }
-  return true;
-}
-
-/**
- * Type guard for GitHubAdvisoryVulnerability
- */
-function isGitHubAdvisoryVulnerability(value: unknown): value is GitHubAdvisoryVulnerability {
-  if (!isObject(value)) {
-    return false;
-  }
-  return true;
-}
-
-/**
- * Type guard to check if response is a list response with items
- */
-function isGitHubAdvisoryListResponse(value: unknown): value is GitHubAdvisoryListResponse {
-  if (!isObject(value)) {
-    return false;
-  }
-  return 'items' in value;
-}
-
-/**
- * Type guard to check if response is an array of advisory objects
- */
-function isGitHubAdvisoryArray(value: unknown): value is GitHubAdvisoryRaw[] {
-  if (!isArray(value)) {
-    return false;
-  }
-  return value.every(isGitHubAdvisoryRaw);
-}
-
-/**
- * Type guard to check if response is a single advisory object
- */
-function isSingleGitHubAdvisory(value: unknown): value is GitHubAdvisoryRaw {
-  if (!isGitHubAdvisoryRaw(value)) {
-    return false;
-  }
-  // Single advisory typically has ghsa_id
-  return 'ghsa_id' in value || 'summary' in value;
-}
-
-// ============================================================================
-// Helper Functions
-// ============================================================================
-
 /**
- * Extract affected packages from an advisory item
+ * Build GitHub API request headers, attaching a bearer token when GITHUB_TOKEN
+ * is set. Authentication raises the rate limit from 60/hr to 5000/hr — without
+ * it the unauthenticated ceiling is hit almost immediately under real use.
  */
-function extractAffectedPackages(item: GitHubAdvisoryRaw): string[] {
-  const affectedPackages: string[] = [];
-
-  // Try different possible structures for affected packages
-  // GitHub API response structure may vary between endpoints
-
-  // Check for vulnerabilities array
-  if (item.vulnerabilities !== undefined && isArray(item.vulnerabilities)) {
-    for (const vuln of item.vulnerabilities) {
-      if (!isGitHubAdvisoryVulnerability(vuln)) {
-        continue;
-      }
-
-      // Check for package in various possible locations
-      if (vuln.package !== undefined) {
-        if (isGitHubAdvisoryPackage(vuln.package)) {
-          const ecosystem = vuln.package.ecosystem ?? '';
-          const name = vuln.package.name;
-
-          if (isString(name) && name !== '') {
-            if (ecosystem !== '') {
-              affectedPackages.push(`${ecosystem}/${name}`);
-            } else {
-              affectedPackages.push(name);
-            }
-          }
-        }
-      } else if (vuln.affected !== undefined && isArray(vuln.affected)) {
-        // Alternative structure with 'affected' array
-        for (const aff of vuln.affected) {
-          if (isGitHubAdvisoryAffected(aff) && aff.package !== undefined) {
-            const pkg = aff.package;
-            if (isGitHubAdvisoryPackage(pkg)) {
-              const ecosystem = pkg.ecosystem ?? '';
-              const name = pkg.name;
-
-              if (isString(name) && name !== '') {
-                if (ecosystem !== '') {
-                  affectedPackages.push(`${ecosystem}/${name}`);
-                } else {
-                  affectedPackages.push(name);
-                }
-              }
-            }
-          }
-        }
-      }
-    }
-  }
-
-  // Check for direct 'affected' array at the top level
-  if (affectedPackages.length === 0 && item.affected !== undefined && isArray(item.affected)) {
-    for (const aff of item.affected) {
-      if (isGitHubAdvisoryAffected(aff) && aff.package !== undefined) {
-        const pkg = aff.package;
-        if (isGitHubAdvisoryPackage(pkg)) {
-          const ecosystem = pkg.ecosystem ?? '';
-          const name = pkg.name;
-
-          if (isString(name) && name !== '') {
-            if (ecosystem !== '') {
-              affectedPackages.push(`${ecosystem}/${name}`);
-            } else {
-              affectedPackages.push(name);
-            }
-          }
-        }
-      }
-    }
-  }
-
-  return affectedPackages;
-}
-
-/**
- * Extract references from an advisory item
- */
-function extractReferences(item: GitHubAdvisoryRaw): string[] {
-  const references: string[] = [];
-
-  if (item.html_url !== undefined && item.html_url !== '') {
-    references.push(item.html_url);
-  }
-  if (item.advisory_url !== undefined && item.advisory_url !== '') {
-    references.push(item.advisory_url);
-  }
-
-  return references;
+function githubHeaders(): Record<string, string> {
+  const token = process.env['GITHUB_TOKEN'];
+  return {
+    'User-Agent': 'pi-research/2.0',
+    Accept: 'application/vnd.github.v3+json',
+    ...(token ? { Authorization: `Bearer ${token}` } : {}),
+  };
 }
 
 // ============================================================================
@@ -327,9 +73,18 @@ export async function searchGitHubAdvisories(
     readonly severity?: string;      // LOW, MODERATE, HIGH, CRITICAL
     readonly maxResults?: number;
     readonly repo?: string;         // "owner/repo" format
+    readonly signal?: AbortSignal;
   },
 ): Promise<GitHubResult> {
+  const startTime = Date.now();
   const maxResults = options?.maxResults ?? DEFAULT_MAX_RESULTS;
+  // GitHub caps per_page at 100 server-side and these paths do not follow the Link header,
+  // so a request for >100 silently returns ≤100 with no signal that more exist — a security
+  // tool must not imply completeness it didn't fetch. Clamp the page size and warn.
+  const perPage = Math.min(100, maxResults);
+  if (maxResults > 100) {
+    logger.warn(`[github-advisories] maxResults=${maxResults} exceeds GitHub's 100-per-page cap and these paths don't paginate; returning up to 100. Results may be incomplete.`);
+  }
   const advisories: Advisory[] = [];
   let error: string | undefined = undefined;
 
@@ -345,22 +100,27 @@ export async function searchGitHubAdvisories(
       }
 
       const [owner, name] = repoParts;
-      const url = `${GITHUB_API_BASE}/repos/${owner}/${name}/security-advisories?per_page=${maxResults}`;
+      // Constrain to GitHub's allowed owner/repo character set before interpolating
+      // into the API path. encodeURIComponent already neutralises traversal, but this
+      // rejects malformed input early instead of issuing a doomed request.
+      const repoNameRe = /^[A-Za-z0-9._-]+$/;
+      if (!repoNameRe.test(owner!) || !repoNameRe.test(name!)) {
+        throw new Error(`Invalid repo format: "${options.repo}". Owner and name may only contain letters, digits, '.', '_' and '-'.`);
+      }
+      const url = `${GITHUB_API_BASE}/repos/${encodeURIComponent(owner!)}/${encodeURIComponent(name!)}/security-advisories?per_page=${perPage}`;
 
-      const response = await retryWithBackoff(async (): Promise<Response> => {
+      const response = await githubCircuitBreaker.execute(() => retryWithBackoff(async () => {
         const resp = await fetch(url, {
-          headers: {
-            'User-Agent': 'pi-research/2.0',
-            'Accept': 'application/vnd.github.v3+json',
-          },
-          signal: createTimeoutSignal(30000),
+          headers: githubHeaders(),
+          signal: createTimeoutSignal(10000, options?.signal),
         });
 
-        if (resp.ok === false) {
+        if (!resp.ok) {
           if (resp.status === 404) {
             throw new Error(`Repository "${owner}/${name}" not found or no access to security advisories.`);
           }
           if (resp.status === 403) {
+            metrics.increment('github_ratelimit_hits_total', 1, { endpoint: 'repo_advisories' });
             throw new Error('GitHub API rate limit exceeded (HTTP 403). Retrying with backoff...');
           }
           if (resp.status >= 500) {
@@ -369,20 +129,37 @@ export async function searchGitHubAdvisories(
           throw new Error(`GitHub API error (${resp.status}): ${resp.statusText}`);
         }
 
+        // Track rate limit headers
+        const rateLimitRemaining = resp.headers?.get ? resp.headers.get('X-RateLimit-Remaining') : null;
+        const rateLimitLimit = resp.headers?.get ? resp.headers.get('X-RateLimit-Limit') : null;
+        if (rateLimitRemaining !== null) {
+          metrics.setGauge('github_ratelimit_remaining', parseInt(rateLimitRemaining, 10), { endpoint: 'repo_advisories' });
+        }
+        if (rateLimitLimit !== null) {
+          metrics.setGauge('github_ratelimit_limit', parseInt(rateLimitLimit, 10), { endpoint: 'repo_advisories' });
+        }
+        
+        metrics.increment('github_requests_total', 1, { endpoint: 'repo_advisories', status: 'success' });
         return resp;
       }, {
         maxRetries: 2,
         initialDelay: 1000,
         maxDelay: 5000,
-      });
-
-      const data = await response.json();
+        signal: options?.signal,
+      }));
+
+      let data: unknown;
+      try {
+        data = await response.json();
+      } catch {
+        metrics.increment('github_search_errors_total', 1, { error_type: 'malformed_json' });
+        throw new Error('GitHub API returned a malformed JSON response (repo advisories).');
+      }
       let repoAdvisories: readonly GitHubAdvisoryRaw[] = [];
 
       if (isGitHubAdvisoryArray(data)) {
         repoAdvisories = data;
       } else if (isGitHubAdvisoryListResponse(data) && isArray(data.items)) {
-        // Filter to ensure only valid advisory objects
         repoAdvisories = data.items.filter(isGitHubAdvisoryRaw);
       } else if (isSingleGitHubAdvisory(data)) {
         repoAdvisories = [data];
@@ -390,41 +167,50 @@ export async function searchGitHubAdvisories(
 
       allAdvisories = repoAdvisories.map(mapGitHubAdvisory);
     } else {
-      // Search global advisories.
-      // The GitHub advisories API supports cve_id and ghsa_id as query params,
-      // so use those for precise lookups; fall back to a general listing for
-      // keyword terms (client-side filtering is applied afterwards).
-      const termResults: Advisory[] = [];
-
-      for (const term of terms) {
+      // Search global advisories. Each term is fetched independently through the
+      // circuit breaker and settled in isolation (Promise.allSettled) so one bad
+      // term — a transient 5xx, a malformed body, an exhausted retry — never
+      // discards the advisories already gathered for the others.
+      const fetchTerm = async (term: string): Promise<Advisory[]> => {
         const termUpper = term.toUpperCase();
         let apiUrl: string;
+        let endpointType: string;
 
         if (termUpper.startsWith('CVE-')) {
-          // Use cve_id param for CVE lookups
-          apiUrl = `${GITHUB_API_BASE}/advisories?cve_id=${encodeURIComponent(termUpper)}&per_page=${maxResults}`;
+          apiUrl = `${GITHUB_API_BASE}/advisories?cve_id=${encodeURIComponent(termUpper)}&per_page=${perPage}`;
+          endpointType = 'cve_lookup';
         } else if (termUpper.startsWith('GHSA-')) {
-          // Direct advisory lookup by GHSA ID
           apiUrl = `${GITHUB_API_BASE}/advisories/${encodeURIComponent(term)}`;
+          endpointType = 'ghsa_lookup';
         } else {
-          // Keyword: fetch recent published advisories and filter client-side
-          apiUrl = `${GITHUB_API_BASE}/advisories?per_page=${maxResults}&state=published&direction=desc`;
+          // Server-side narrowing so the term can match beyond just the newest
+          // `maxResults` global advisories. GitHub's /advisories endpoint has no
+          // free-text search, but it does support `affects=<package>`; a single-token
+          // term (npm/pip/maven package identifiers never contain whitespace, incl.
+          // scoped `@scope/name` and `group:artifact`) is treated as a package name.
+          // Multi-word terms keep the newest-N + client-side substring path, since
+          // `affects` on a non-package phrase would just return nothing.
+          const ecosystemParam =
+            options?.ecosystem !== undefined && options.ecosystem !== ''
+              ? `&ecosystem=${encodeURIComponent(normalizeEcosystem(options.ecosystem, 'github'))}`
+              : '';
+          const affectsParam = !/\s/.test(term) ? `&affects=${encodeURIComponent(term)}` : '';
+          apiUrl = `${GITHUB_API_BASE}/advisories?per_page=${perPage}&state=published&direction=desc${ecosystemParam}${affectsParam}`;
+          endpointType = 'search';
         }
 
-        const response = await retryWithBackoff(async (): Promise<Response> => {
+        const response = await githubCircuitBreaker.execute(() => retryWithBackoff(async () => {
           const resp = await fetch(apiUrl, {
-            headers: {
-              'User-Agent': 'pi-research/2.0',
-              'Accept': 'application/vnd.github.v3+json',
-            },
-            signal: createTimeoutSignal(30000),
+            headers: githubHeaders(),
+            signal: createTimeoutSignal(10000, options?.signal),
           });
 
-          if (resp.ok === false) {
+          if (!resp.ok) {
             if (resp.status === 404) {
               throw new Error('Advisory not found (HTTP 404)');
             }
             if (resp.status === 403) {
+              metrics.increment('github_ratelimit_hits_total', 1, { endpoint: endpointType });
               throw new Error('GitHub API rate limit exceeded (HTTP 403). Retrying with backoff...');
             }
             if (resp.status >= 500) {
@@ -433,17 +219,33 @@ export async function searchGitHubAdvisories(
             throw new Error(`HTTP ${resp.status}: ${resp.statusText}`);
           }
 
+          const rateLimitRemaining = resp.headers?.get ? resp.headers.get('X-RateLimit-Remaining') : null;
+          const rateLimitLimit = resp.headers?.get ? resp.headers.get('X-RateLimit-Limit') : null;
+          if (rateLimitRemaining !== null) {
+            metrics.setGauge('github_ratelimit_remaining', parseInt(rateLimitRemaining, 10), { endpoint: endpointType });
+          }
+          if (rateLimitLimit !== null) {
+            metrics.setGauge('github_ratelimit_limit', parseInt(rateLimitLimit, 10), { endpoint: endpointType });
+          }
+          metrics.increment('github_requests_total', 1, { endpoint: endpointType, status: 'success' });
           return resp;
         }, {
           maxRetries: 2,
           initialDelay: 1000,
           maxDelay: 5000,
-        });
-
-        const data = await response.json();
+          signal: options?.signal,
+        }));
+
+        // A 404 on a direct GHSA/CVE lookup means "no such advisory", not failure.
+        let data: unknown;
+        try {
+          data = await response.json();
+        } catch {
+          metrics.increment('github_search_errors_total', 1, { error_type: 'malformed_json', endpoint: endpointType });
+          throw new Error(`GitHub API returned a malformed JSON response for term "${term}".`);
+        }
         let items: readonly GitHubAdvisoryRaw[] = [];
 
-        // GHSA direct lookup returns an object; list endpoints return arrays
         if (isGitHubAdvisoryArray(data)) {
           items = data;
         } else if (isSingleGitHubAdvisory(data)) {
@@ -452,45 +254,72 @@ export async function searchGitHubAdvisories(
           items = data.items.filter(isGitHubAdvisoryRaw);
         }
 
-        termResults.push(...items.map(mapGitHubAdvisory));
+        metrics.increment(items.length > 0 ? 'github_cache_hits_total' : 'github_cache_misses_total', 1, { term, endpoint: endpointType });
+
+        return items.map(mapGitHubAdvisory);
+      };
+
+      const settled = await Promise.allSettled(terms.map(fetchTerm));
+      const termResults: Advisory[] = [];
+      const failures: string[] = [];
+      settled.forEach((result, i) => {
+        if (result.status === 'fulfilled') {
+          termResults.push(...result.value);
+        } else {
+          const reason = result.reason instanceof Error ? result.reason.message : String(result.reason);
+          // A direct-lookup 404 is an expected "not found", not a real failure.
+          if (!reason.includes('HTTP 404')) failures.push(`${terms[i]} (${reason})`);
+        }
+      });
+      if (failures.length > 0 && failures.length === terms.length) {
+        // Every term failed — surface it; partial failures are tolerated silently.
+        throw new Error(`All GitHub advisory lookups failed: ${failures.join('; ')}`);
+      } else if (failures.length > 0) {
+        error = `Some GitHub advisory lookups failed: ${failures.join('; ')}`;
       }
 
       // Deduplicate by GHSA ID
       const seen = new Set<string>();
       for (const adv of termResults) {
-        if (!seen.has(adv.id)) {
+        if (adv.id && !seen.has(adv.id)) {
           seen.add(adv.id);
           allAdvisories.push(adv);
+        } else if (!adv.id) {
+           allAdvisories.push(adv);
         }
       }
     }
 
     // Filter by search terms if provided (OR logic: match any term)
     if (terms.length > 0) {
-      allAdvisories = allAdvisories.filter((adv): boolean =>
-        terms.some((term): boolean => {
+      allAdvisories = allAdvisories.filter((adv): boolean => {
+        if (terms.length === 0) return true;
+        
+        return terms.some((term): boolean => {
           const t = term.toLowerCase();
-          const advId = adv.id.toLowerCase();
-          const advSummary = adv.summary.toLowerCase();
-          const advDescription = adv.description !== undefined
-            ? adv.description.toLowerCase()
-            : '';
-          const advCveId = adv.cveId !== undefined
-            ? adv.cveId.toLowerCase()
-            : '';
+          const advId = (adv.id || '').toLowerCase();
+          const advSummary = (adv.summary || '').toLowerCase();
+          const advDescription = (adv.description || '').toLowerCase();
+          const advCveId = (adv.cveId || '').toLowerCase();
 
+          // Precise match for IDs
+          if (advId === t || advCveId === t) return true;
+
+          // Partial match for everything else. Include affectedPackages so a
+          // server-side `affects=<package>` hit is not then dropped just because
+          // the advisory summary/description doesn't repeat the package name.
           return (
             advId.includes(t) ||
             advCveId.includes(t) ||
             advSummary.includes(t) ||
-            advDescription.includes(t)
+            advDescription.includes(t) ||
+            adv.affectedPackages.some(p => p.toLowerCase().includes(t))
           );
-        }),
-      );
+        });
+      });
     }
 
     // Filter by severity if provided
-    // GitHub uses "MODERATE" where the rest of the industry uses "MEDIUM"
     if (options?.severity !== undefined && options.severity !== '') {
       const severity = options.severity.toUpperCase();
       const githubSeverity = severity === 'MEDIUM' ? 'MODERATE' : severity;
@@ -503,6 +332,10 @@ export async function searchGitHubAdvisories(
 
   } catch (err: unknown) {
     error = err instanceof Error ? err.message : String(err);
+    metrics.increment('github_search_errors_total', 1, { error_type: err instanceof Error ? err.name : 'unknown' });
+  } finally {
+    const duration = Date.now() - startTime;
+    metrics.observe('github_search_duration_ms', duration, { has_error: error ? 'true' : 'false' });
   }
 
   return {
@@ -512,96 +345,3 @@ export async function searchGitHubAdvisories(
   };
 }
 
-/**
- * Get specific advisory by GHSA ID or CVE ID
- *
- * @param id - The GHSA ID or CVE ID to fetch
- * @returns Promise resolving to Advisory or null if not found
- */
-export async function getAdvisoryById(id: string): Promise<Advisory | null> {
-  try {
-    if (id === '') {
-      return null;
-    }
-
-    const url = `${GITHUB_API_BASE}/advisories/${encodeURIComponent(id)}`;
-
-    const response = await retryWithBackoff(async (): Promise<Response> => {
-      const resp = await fetch(url, {
-        headers: {
-          'User-Agent': 'pi-research/2.0',
-          'Accept': 'application/vnd.github.v3+json',
-        },
-        signal: createTimeoutSignal(30000),
-      });
-
-      if (resp.ok === false) {
-        if (resp.status === 404) {
-          throw new Error('Advisory not found (HTTP 404)');
-        }
-        if (resp.status === 403) {
-          throw new Error('GitHub API rate limit exceeded (HTTP 403). Retrying with backoff...');
-        }
-        if (resp.status >= 500) {
-          throw new Error(`GitHub server error (HTTP ${resp.status}). Retrying with backoff...`);
-        }
-        throw new Error(`HTTP ${resp.status}: ${resp.statusText}`);
-      }
-
-      return resp;
-    }, {
-      maxRetries: 2,
-      initialDelay: 1000,
-      maxDelay: 5000,
-    });
-
-    const data = await response.json();
-
-    if (isGitHubAdvisoryRaw(data)) {
-      return mapGitHubAdvisory(data);
-    }
-
-    return null;
-  } catch (err: unknown) {
-    // Check if it's a 404 error (not found) - return null instead of throwing
-    if (err instanceof Error && err.message.includes('HTTP 404')) {
-      logger.warn(`[GitHub Advisories] Advisory ${id} not found`);
-      return null;
-    }
-    logger.error(`[GitHub Advisories] Error fetching advisory ${id}:`, err);
-    return null;
-  }
-}
-
-/**
- * Map GitHub advisory to our Advisory interface
- *
- * @param item - Raw GitHub advisory object
- * @returns Mapped Advisory object
- */
-function mapGitHubAdvisory(item: GitHubAdvisoryRaw): Advisory {
-  const ghsaId = item.ghsa_id ?? item.id ?? '';
-  const summary = item.summary ?? '';
-  const description = item.description ?? '';
-  const severityRaw = item.severity ?? 'UNKNOWN';
-  const severity = severityRaw.toUpperCase();
-  const published = item.published_at ?? '';
-  const modified = item.updated_at ?? '';
-  const cveId = item.cve_id ?? '';
-
-  const affectedPackages = extractAffectedPackages(item);
-  const references = extractReferences(item);
-
-  return {
-    id: ghsaId,
-    source: 'github',
-    severity,
-    summary,
-    description,
-    published,
-    modified,
-    cveId,
-    references,
-    affectedPackages,
-  };
-}