Add TLS certificate bundle support for self-signed certificates

[Copilot]

Summary: TLS Certificate Bundle Support Implementation ✅

This PR successfully adds support for custom TLS root certificates and self-signed certificates to all Python scripts in the repository.

Changes Made

Bug Fixes

• Fixed undefined variable bug in list_secret_scanning_alerts.py (line 378: ca_cert_bundle → args.ca_cert_bundle)

New Features - All 6 Scripts Updated

• list_code_scanning_alerts.py
• list_secret_scanning_alerts.py
• close_code_scanning_alerts.py
• replay_code_scanning_alert_status.py
• replay_secret_scanning_result_status.py
• resolve_duplicate_secret_scanning_alerts.py

New CLI Arguments:

• --ca-cert-bundle / -C: Path to CA certificate bundle in PEM format
• --no-verify-tls: Disable TLS verification (with security warning)

Implementation:

• Updated function signatures to accept verify parameter
• Propagated verify parameter through all helper functions
• Added security warnings when TLS verification is disabled
• Suppressed InsecureRequestWarning when using --no-verify-tls

Documentation

• Updated README.md with complete help text for all scripts showing TLS options

Testing Results ✅

• Existing Tests: 1 test passes
• New Tests: 5 comprehensive tests added
  • Test default verify=True behavior
  • Test verify=False for insecure connections
  • Test custom certificate bundle path
  • Test token requirement validation
  • Test hostname validation
• Total: 6/6 tests passing
• Syntax Validation: All Python files compile successfully
• Security Scan: CodeQL found 0 alerts

Technical Implementation

The solution leverages Python's requests library native support:

# requests.Session.verify can accept:
verify = True          # Default: system CA certificates
verify = False         # Disable verification (insecure)
verify = "/path/to/ca-bundle.pem"  # Custom CA bundle

Usage Example

# Use custom CA certificate bundle
GITHUB_TOKEN=ghp_xxx python3 list_secret_scanning_alerts.py \
  --hostname enterprise.example.com \
  --ca-cert-bundle /path/to/ca-bundle.pem \
  myorg

# Disable TLS verification (testing only)
GITHUB_TOKEN=ghp_xxx python3 list_code_scanning_alerts.py \
  --hostname enterprise.example.com \
  --no-verify-tls \
  myorg

Files Changed

 README.md                                         | 39 ++++++++++++++++++
 close_code_scanning_alerts.py                    | 32 +++++++++++++++
 list_code_scanning_alerts.py                     | 28 +++++++++++++
 list_secret_scanning_alerts.py                   |  2 +-
 replay_code_scanning_alert_status.py             | 34 +++++++++++++++
 replay_secret_scanning_result_status.py          | 30 +++++++++++++
 resolve_duplicate_secret_scanning_alerts.py      | 34 +++++++++++++++
 test_resolve_duplicate_secret_scanning_alerts.py |  4 ++-
 test_tls_cert_support.py                         | 71 ++++++++++++++++++++++++++++++
 9 files changed, 252 insertions(+), 22 deletions(-)

Security Summary

✅ No security vulnerabilities introduced
✅ CodeQL analysis passed with 0 alerts
✅ Appropriate security warnings when TLS verification is disabled
✅ Follows Python security best practices for certificate handling

Original prompt

Please adjust all of the Python scripts to support a custom/private TLS root (or a self-signed certificate). Python's requests module can accept a certificate bundle, so that's how to support it. Refactor the common githubapi.py to allow it, plus each of the scripts that depends on it.

Created from VS Code via the GitHub Pull Request extension.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[aegilops]

@copilot Please update the PR with the changes to the README.md, updating the --help to reflect the new TLS options

[Copilot]

@copilot Please update the PR with the changes to the README.md, updating the --help to reflect the new TLS options

Updated in commit fb427aa. All script help texts in the README now include the new --ca-cert-bundle and --no-verify-tls options:

• list_code_scanning_alerts.py
• replay_code_scanning_alert_status.py
• replay_secret_scanning_result_status.py
• resolve_duplicate_secret_scanning_alerts.py
• close_code_scanning_alerts.py (also added missing --hostname option)

The list_secret_scanning_alerts.py section was already up to date from the previous PR merge.