Validate GitHub Advisory Provenance
GitHub added five nullable SecurityAdvisory GraphQL fields on 2 October, according to the current reference.
That nullability is the decision boundary. Schema availability alone is not enough to retire a retrieval path. Validation must use the advisory populations the integration actually consumes.
Start with what can be absent
cveId, sourceCodeLocation, githubReviewedAt, nvdPublishedAt and repositoryAdvisoryUrl are nullable.
Do not convert every missing value into one generic unknown. Record whether data is required for a downstream decision, whether another source should supply it and whether absence is an acceptable result.
Keep the controls and clocks separate
severities and isWithdrawn are optional. GitHub review and publication, NVD publication and update are independent clocks.
A narrower query tells you what the server returned for that request. It does not prove that the excluded population is irrelevant to another workflow. Record the filter state beside completeness results so two runs remain comparable.
Validate the decision before changing the path
BlackTree recommends the following validation sequence:
- List every downstream decision that currently depends on a REST lookup. Separate required data from enrichment that can remain absent.
- Query a representative window of the advisory populations you process. Record presence and absence per field, advisory source, withdrawal state and severity selection. Do not infer a universal null rate from that sample.
- Compare the result with the existing path before disabling anything. Record which advisories still need a fallback and why.
- Choose a removal threshold for each downstream decision. A reporting dashboard may tolerate missing enrichment that a remediation or audit workflow cannot.
- Keep an observable escape path. Schema availability can remain stable while record completeness changes with source data.
This article reports no corpus null rate, API test or implemented fallback change. The supported conclusion is narrower: nullable fields need a dataset-specific acceptance test before they replace another retrieval path.
A separate GraphQL boundary
BlackTree’s earlier confidential-comments analysis covers repository write access, comment visibility, notifications and a REST archive gap. This article concerns global-advisory provenance and linkage fields. The shared GitHub and GraphQL context does not make them the same operational decision.
Source timing
Metadata records a 7 October modification, not a described substantive release; sources were retrieved on 8 October.
