feat: Support gitea

.eslintrc.json

@@ -6,17 +6,14 @@
     "parserOptions": {
         "project": "./tsconfig.json"
     },
-    "plugins": [
+    "plugins": ["@typescript-eslint"],
-        "@typescript-eslint"
-    ],
     "extends": [
         "eslint:recommended",
         "plugin:@typescript-eslint/eslint-recommended",
         "plugin:@typescript-eslint/recommended-requiring-type-checking",
         "plugin:@typescript-eslint/recommended",
         "plugin:prettier/recommended",
-        "prettier",
+        "prettier"
-        "prettier/@typescript-eslint"
     ],
     "rules": {
         "@typescript-eslint/explicit-function-return-type": 0

.github/workflows/ci.yml

@@ -9,7 +9,7 @@ jobs:
       - name: Create npm configuration
         run: echo "//npm.pkg.github.com/:_authToken=${token}" >> ~/.npmrc
         env:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.GH_TOKEN }}
 
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4

CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Changed
+
+- Update the GitHub Action runtime and local Node tooling target to Node 24.
+
 ## [1.4.1] - 2023-04-04
 
 ### Fixed

README.md

@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: rustsec/audit-check@v1.4.1
+      - uses: rustsec/audit-check@v2.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 ```
@@ -36,7 +36,6 @@ It is recommended to add the `paths:` section into the workflow file,
 as it would effectively speed up the CI pipeline, since the audit process
 will not be performed if no dependencies were changed.
 
-
 In case of any security advisories found, [status check](https://help.github.com/en/articles/about-status-checks)
 created by this Action will be marked as "failed".\
 Note that informational advisories are not affecting the check status.
@@ -60,9 +59,9 @@ github-token:
     checks-reason: to create check
 ```
 
-The action does not raise issues when it is not triggered from a "cron" scheduled workflow.
+This action only raises issues when it's triggered from a `cron` scheduled workflow or on manual `workflow_dispatch`
 
-When running the action as scheduled it will crate issues but e.g. in PR / push fails the action.
+When running the action as scheduled it will create issues but e.g. in PR / push fails the action.
 
 #### Limitations
 
@@ -87,7 +86,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: rustsec/audit-check@v1.4.1
+      - uses: rustsec/audit-check@v2.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 ```
@@ -105,5 +104,26 @@ For each new advisory (including informal) an issue will be created:
 | `token`     | ✓        | [GitHub token], usually a `${{ secrets.GITHUB_TOKEN }}`                    | string |         |
 | `ignore`    |          | Comma-separated list of advisory ids to ignore                             | string |         |
 | `working-directory`|   | The directory of the Cargo.toml / Cargo.lock files to scan.                | string | `.`     |
+| `new-issue-labels` |   | Comma-separated list of Labes to be added to new issues                    | string | `.`     |
 
 [GitHub token]: https://help.github.com/en/actions/configuring-and-managing-workflows/authenticating-with-the-github_token
+
+## Contribute
+
+### Setting up npm login
+
+This repo uses some npm packages hosted on github.
+To be able to pull these you need to:
+
+1. Under <https://github.com/settings/tokens> - create a `personal access token (classic)` with `read:packages` scope
+
+2. Authenticate to the github npm registry
+
+```sh
+npm login --scope=@clechasseur --auth-type=legacy --registry=https://npm.pkg.github.com
+```
+
+```txt
+Username = Github Username
+Password = Token
+```

action.yml

@@ -17,5 +17,5 @@ inputs:
     default: .
 
 runs:
-  using: 'node20'
+  using: 'node24'
   main: 'dist/index.js'

package-lock.json

@@ -1,20 +1,24 @@
 {
     "name": "rust-audit-check",
-    "version": "1.4.1",
+    "version": "2.0.0",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {
         "": {
             "name": "rust-audit-check",
-            "version": "1.4.1",
+            "version": "2.0.0",
             "license": "MIT",
             "dependencies": {
+                "@actions/core": "^1.11.1",
+                "@actions/github": "^6.0.1",
                 "@clechasseur/rs-actions-core": "^3.0.5",
+                "gitea-js": "^1.23.0",
                 "nunjucks": "^3.2.4"
             },
             "devDependencies": {
                 "@types/jest": "^29.5.12",
-                "@types/node": "^20.11.17",
+                "@types/node": "^24.0.0",
+                "@types/nunjucks": "^3.2.4",
                 "@typescript-eslint/eslint-plugin": "^6.21.0",
                 "@typescript-eslint/parser": "^6.21.0",
                 "@vercel/ncc": "0.38.1",
@@ -56,22 +60,13 @@
             }
         },
         "node_modules/@actions/core": {
-            "version": "1.10.1",
+            "version": "1.11.1",
-            "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.10.1.tgz",
+            "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
-            "integrity": "sha512-3lBR9EDAY+iYIpTnTIXmWcNbX3T2kCkAEQGIQx4NVQ0575nk2k3GRZDTPQG+vVtS2izSLmINlxXf0uLtnrTP+g==",
+            "integrity": "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==",
             "license": "MIT",
             "dependencies": {
-                "@actions/http-client": "^2.0.1",
+                "@actions/exec": "^1.1.1",
-                "uuid": "^8.3.2"
+                "@actions/http-client": "^2.0.1"
-            }
-        },
-        "node_modules/@actions/core/node_modules/uuid": {
-            "version": "8.3.2",
-            "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
-            "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
-            "license": "MIT",
-            "bin": {
-                "uuid": "dist/bin/uuid"
             }
         },
         "node_modules/@actions/exec": {
@@ -84,15 +79,18 @@
             }
         },
         "node_modules/@actions/github": {
-            "version": "6.0.0",
+            "version": "6.0.1",
-            "resolved": "https://registry.npmjs.org/@actions/github/-/github-6.0.0.tgz",
+            "resolved": "https://registry.npmjs.org/@actions/github/-/github-6.0.1.tgz",
-            "integrity": "sha512-alScpSVnYmjNEXboZjarjukQEzgCRmjMv6Xj47fsdnqGS73bjJNDpiiXmp8jr0UZLdUB6d9jW63IcmddUP+l0g==",
+            "integrity": "sha512-xbZVcaqD4XnQAe35qSQqskb3SqIAfRyLBrHMd/8TuL7hJSz2QtbDwnNM8zWx4zO5l2fnGtseNE3MbEvD7BxVMw==",
             "license": "MIT",
             "dependencies": {
                 "@actions/http-client": "^2.2.0",
                 "@octokit/core": "^5.0.1",
-                "@octokit/plugin-paginate-rest": "^9.0.0",
+                "@octokit/plugin-paginate-rest": "^9.2.2",
-                "@octokit/plugin-rest-endpoint-methods": "^10.0.0"
+                "@octokit/plugin-rest-endpoint-methods": "^10.4.0",
+                "@octokit/request": "^8.4.1",
+                "@octokit/request-error": "^5.1.1",
+                "undici": "^5.28.5"
             }
         },
         "node_modules/@actions/glob": {
@@ -1744,9 +1742,9 @@
             }
         },
         "node_modules/@octokit/endpoint": {
-            "version": "9.0.5",
+            "version": "9.0.6",
-            "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-9.0.5.tgz",
+            "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-9.0.6.tgz",
-            "integrity": "sha512-ekqR4/+PCLkEBF6qgj8WqJfvDq65RH85OAgrtnVp1mSxaXF03u2xW/hUdweGS5654IlC0wkNYC18Z50tSYTAFw==",
+            "integrity": "sha512-H1fNTMA57HbkFESSt3Y9+FBICv+0jFceJFPWDePYlR/iMGrwM5ph+Dd4XRQs+8X+PUFURLQgX9ChPfhJ/1uNQw==",
             "license": "MIT",
             "dependencies": {
                 "@octokit/types": "^13.1.0",
@@ -1777,9 +1775,9 @@
             "license": "MIT"
         },
         "node_modules/@octokit/plugin-paginate-rest": {
-            "version": "9.2.1",
+            "version": "9.2.2",
-            "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-9.2.1.tgz",
+            "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-9.2.2.tgz",
-            "integrity": "sha512-wfGhE/TAkXZRLjksFXuDZdmGnJQHvtU/joFQdweXUgzo1XwvBCD4o4+75NtFfjfLK5IwLf9vHTfSiU3sLRYpRw==",
+            "integrity": "sha512-u3KYkGF7GcZnSD/3UP0S7K5XUFT2FkOQdcfXZGZQPGv3lm4F2Xbf71lvjldr8c1H3nNbF+33cLEkWYbokGWqiQ==",
             "license": "MIT",
             "dependencies": {
                 "@octokit/types": "^12.6.0"
@@ -1837,13 +1835,13 @@
             }
         },
         "node_modules/@octokit/request": {
-            "version": "8.4.0",
+            "version": "8.4.1",
-            "resolved": "https://registry.npmjs.org/@octokit/request/-/request-8.4.0.tgz",
+            "resolved": "https://registry.npmjs.org/@octokit/request/-/request-8.4.1.tgz",
-            "integrity": "sha512-9Bb014e+m2TgBeEJGEbdplMVWwPmL1FPtggHQRkV+WVsMggPtEkLKPlcVYm/o8xKLkpJ7B+6N8WfQMtDLX2Dpw==",
+            "integrity": "sha512-qnB2+SY3hkCmBxZsR/MPCybNmbJe4KAlfWErXq+rBKkQJlbjdJeS85VI9r8UqeLYLvnAenU8Q1okM/0MBsAGXw==",
             "license": "MIT",
             "dependencies": {
-                "@octokit/endpoint": "^9.0.1",
+                "@octokit/endpoint": "^9.0.6",
-                "@octokit/request-error": "^5.1.0",
+                "@octokit/request-error": "^5.1.1",
                 "@octokit/types": "^13.1.0",
                 "universal-user-agent": "^6.0.0"
             },
@@ -1852,9 +1850,9 @@
             }
         },
         "node_modules/@octokit/request-error": {
-            "version": "5.1.0",
+            "version": "5.1.1",
-            "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.0.tgz",
+            "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.1.tgz",
-            "integrity": "sha512-GETXfE05J0+7H2STzekpKObFe765O5dlAKUTLNGeH+x47z7JjXHfsHKo5z21D/o/IOZTUEI6nyWyR+bZVP/n5Q==",
+            "integrity": "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g==",
             "license": "MIT",
             "dependencies": {
                 "@octokit/types": "^13.1.0",
@@ -2043,15 +2041,22 @@
             "license": "MIT"
         },
         "node_modules/@types/node": {
-            "version": "20.14.10",
+            "version": "24.12.0",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-20.14.10.tgz",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-24.12.0.tgz",
-            "integrity": "sha512-MdiXf+nDuMvY0gJKxyfZ7/6UFsETO7mGKF54MVD/ekJS6HdFtpZFBgrh6Pseu64XTb2MLyFPlbW6hj8HYRQNOQ==",
+            "integrity": "sha512-GYDxsZi3ChgmckRT9HPU0WEhKLP08ev/Yfcq2AstjrDASOYCSXeyjDsHg4v5t4jOj7cyDX3vmprafKlWIG9MXQ==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "undici-types": "~5.26.4"
+                "undici-types": "~7.16.0"
             }
         },
+        "node_modules/@types/nunjucks": {
+            "version": "3.2.6",
+            "resolved": "https://registry.npmjs.org/@types/nunjucks/-/nunjucks-3.2.6.tgz",
+            "integrity": "sha512-pHiGtf83na1nCzliuAdq8GowYiXvH5l931xZ0YEHaLMNFgynpEqx+IPStlu7UaDkehfvl01e4x/9Tpwhy7Ue3w==",
+            "dev": true,
+            "license": "MIT"
+        },
         "node_modules/@types/semver": {
             "version": "7.5.8",
             "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.5.8.tgz",
@@ -3720,6 +3725,12 @@
                 "url": "https://github.com/sponsors/sindresorhus"
             }
         },
+        "node_modules/gitea-js": {
+            "version": "1.23.0",
+            "resolved": "https://registry.npmjs.org/gitea-js/-/gitea-js-1.23.0.tgz",
+            "integrity": "sha512-f4+UPoWgDetZeZ+Awo5iI1nVdO5bjxA8+2QCeLo3oYWUYxKyzLfXgbW1EPD635wb8hLgS0DRBu5XhtiuYKEeUA==",
+            "license": "MIT"
+        },
         "node_modules/glob": {
             "version": "7.2.3",
             "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
@@ -6085,9 +6096,9 @@
             }
         },
         "node_modules/undici": {
-            "version": "5.28.4",
+            "version": "5.29.0",
-            "resolved": "https://registry.npmjs.org/undici/-/undici-5.28.4.tgz",
+            "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
-            "integrity": "sha512-72RFADWFqKmUb2hmmvNODKL3p9hcB6Gt2DOQMis1SEBaV6a4MH8soBvzg+95CYhCKPFedut2JY9bMfrDl9D23g==",
+            "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
             "license": "MIT",
             "dependencies": {
                 "@fastify/busboy": "^2.0.0"
@@ -6097,9 +6108,9 @@
             }
         },
         "node_modules/undici-types": {
-            "version": "5.26.5",
+            "version": "7.16.0",
-            "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz",
+            "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
-            "integrity": "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA==",
+            "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
             "dev": true,
             "license": "MIT"
         },

package.json

@@ -18,7 +18,7 @@
     },
     "repository": {
         "type": "git",
-        "url": "git+https://github.com/actions-rs/audit.git"
+        "url": "github:rustsec/audit-check"
     },
     "keywords": [
         "actions",
@@ -31,25 +31,29 @@
     "author": "actions-rs",
     "license": "MIT",
     "bugs": {
-        "url": "https://github.com/actions-rs/audit-check/issues"
+        "url": "https://github.com/rustsec/audit-check/issues"
     },
     "dependencies": {
+        "@actions/core": "^1.11.1",
+        "@actions/github": "^6.0.1",
         "@clechasseur/rs-actions-core": "^3.0.5",
+        "gitea-js": "^1.23.0",
         "nunjucks": "^3.2.4"
     },
     "devDependencies": {
-        "@typescript-eslint/parser": "^6.21.0",
+        "@types/jest": "^29.5.12",
+        "@types/node": "^24.0.0",
+        "@types/nunjucks": "^3.2.4",
         "@typescript-eslint/eslint-plugin": "^6.21.0",
-        "ts-node": "^10.9.2",
+        "@typescript-eslint/parser": "^6.21.0",
+        "@vercel/ncc": "0.38.1",
         "eslint": "^8.56.0",
         "eslint-config-prettier": "^9.1.0",
         "eslint-plugin-prettier": "^5.1.3",
-        "@types/jest": "^29.5.12",
-        "@types/node": "^20.11.17",
-        "@vercel/ncc": "0.38.1",
         "jest": "^29.7.0",
+        "prettier": "^3.2.5",
         "ts-jest": "^29.1.2",
-        "typescript": "^5.3.3",
+        "ts-node": "^10.9.2",
-        "prettier": "^3.2.5"
+        "typescript": "^5.3.3"
     }
 }

src/input.ts

@@ -8,6 +8,7 @@ import { input } from '@clechasseur/rs-actions-core';
 export interface Input {
     token: string;
     ignore: string[];
+    new_issue_labels: string[];
     workingDirectory: string;
 }
 
@@ -15,6 +16,10 @@ export function get(): Input {
     return {
         token: input.getInput('token', { required: true }),
         ignore: input.getInputList('ignore', { required: false }),
-        workingDirectory: input.getInput('working-directory', { required: false }) ?? '.',
+        new_issue_labels: input.getInputList('new-issue-labels', {
+            required: false,
+        }),
+        workingDirectory:
+            input.getInput('working-directory', { required: false }) ?? '.',
     };
 }

src/main.ts

@@ -1,5 +1,5 @@
-import * as process from 'process';
 import * as os from 'os';
+import * as process from 'process';
 
 import * as core from '@actions/core';
 import * as github from '@actions/github';
@@ -54,6 +54,7 @@ function removeTrailingSlash(str) {
 }
 
 export async function run(actionInput: input.Input): Promise<void> {
+    const labels = actionInput.new_issue_labels;
     const ignore = actionInput.ignore;
     const workingDirectory = removeTrailingSlash(actionInput.workingDirectory);
     const report = await getData(ignore, workingDirectory);
@@ -90,11 +91,19 @@ export async function run(actionInput: input.Input): Promise<void> {
 
     // const octokit = github.getOctokit(actionInput.token, {userAgent: USER_AGENT});
     const advisories = report.vulnerabilities.list;
-    if (github.context.eventName == 'schedule') {
+    if (
+        github.context.eventName == 'schedule' ||
+        github.context.eventName == 'workflow_dispatch'
+    ) {
         core.debug(
             'Action was triggered on a schedule event, creating an Issues report',
         );
-        await reporter.reportIssues(actionInput.token, advisories, warnings);
+        await reporter.reportIssues(
+            actionInput.token,
+            advisories,
+            warnings,
+            labels,
+        );
     } else {
         core.debug(
             `Action was triggered on a ${github.context.eventName} event, creating a Check report`,

src/reporter.ts

@@ -4,12 +4,9 @@ import * as core from '@actions/core';
 import * as github from '@actions/github';
 import * as nunjucks from 'nunjucks';
 
-import { checks } from '@clechasseur/rs-actions-core';
 import * as interfaces from './interfaces';
 import * as templates from './templates';
-
+import { giteaApi } from 'gitea-js';
-const pkg = require('../package.json'); // eslint-disable-line @typescript-eslint/no-var-requires
-const USER_AGENT = `${pkg.name}/${pkg.version} (${pkg.bugs.url})`;
 
 interface Stats {
     critical: number;
@@ -166,15 +163,22 @@ export async function reportCheck(
     vulnerabilities: Array<interfaces.Vulnerability>,
     warnings: Array<interfaces.Warning>,
 ): Promise<void> {
-    const client = github.getOctokit(token, {userAgent: USER_AGENT});
+    const { owner, repo } = github.context.repo;
-    const reporter = new checks.CheckReporter(client.rest, 'Security audit');
+    const api = giteaApi(process.env.GITHUB_SERVER_URL!, { token });
     const stats = getStats(vulnerabilities, warnings);
     const summary = getSummary(stats);
+    const body = {
+        description: 'Security Audit',
+        context: 'security-audit',
+    };
 
     core.info(`Found ${summary}`);
 
     try {
-        await reporter.startCheck('queued');
+        await api.repos.repoCreateStatus(owner, repo, github.context.sha, {
+            ...body,
+            state: 'pending',
+        });
     } catch (error) {
         // `GITHUB_HEAD_REF` is set only for forked repos,
         // so we can check if it is a fork and not a base repo.
@@ -205,16 +209,22 @@ See https://github.com/actions-rs/clippy-check/issues/2 for details.`);
     }
 
     try {
-        const body = makeReport(vulnerabilities, warnings);
+        // const body = makeReport(vulnerabilities, warnings);
-        const output = {
+        // const output = {
-            title: 'Security advisories found',
+        //     title: 'Security advisories found',
-            summary: summary,
+        //     summary: summary,
-            text: body,
+        //     text: body,
-        };
+        // };
-        const status = stats.critical > 0 ? 'failure' : 'success';
+        const state = stats.critical > 0 ? 'failure' : 'success';
-        await reporter.finishCheck(status, output);
+        await api.repos.repoCreateStatus(owner, repo, github.context.sha, {
+            ...body,
+            state,
+        });
     } catch (error) {
-        await reporter.cancelCheck();
+        await api.repos.repoCreateStatus(owner, repo, github.context.sha, {
+            ...body,
+            state: 'error',
+        });
         throw error;
     }
 
@@ -235,13 +245,13 @@ async function alreadyReported(
     advisoryId: string,
 ): Promise<boolean> {
     const { owner, repo } = github.context.repo;
-    const client = github.getOctokit(token, {userAgent: USER_AGENT});
+    const api = giteaApi(process.env.GITHUB_SERVER_URL!, { token });
-    const results = await client.rest.search.issuesAndPullRequests({
+    const results = await api.repos.issueListIssues(owner, repo, {
-        q: `${advisoryId} in:title repo:${owner}/${repo}`,
+        q: advisoryId,
-        per_page: 1, // eslint-disable-line @typescript-eslint/camelcase
+        limit: 1,
     });
 
-    if (results.data.total_count > 0) {
+    if (results.data.length > 0) {
         core.info(
             `Seems like ${advisoryId} is mentioned already in the issues/PRs, \
 will not report an issue against it`,
@@ -256,10 +266,11 @@ export async function reportIssues(
     token: string,
     vulnerabilities: Array<interfaces.Vulnerability>,
     warnings: Array<interfaces.Warning>,
+    labels: string[],
 ): Promise<void> {
     const { owner, repo } = github.context.repo;
 
-    const client = github.getOctokit(token, {userAgent: USER_AGENT});
+    const api = giteaApi(process.env.GITHUB_SERVER_URL!, { token });
 
     for (const vulnerability of vulnerabilities) {
         const reported = await alreadyReported(
@@ -273,12 +284,13 @@ export async function reportIssues(
         const body = nunjucks.renderString(templates.VULNERABILITY_ISSUE, {
             vulnerability: vulnerability,
         });
-        const issue = await client.rest.issues.create({
+        const issue = await api.repos.issueCreateIssue(owner, repo, {
-            owner: owner,
-            repo: repo,
             title: `${vulnerability.advisory.id}: ${vulnerability.advisory.title}`,
-            body: body,
+            body,
         });
+        for (const label of labels) {
+            core.warning(`Unable to add label ${label}`);
+        }
         core.info(
             `Created an issue for ${vulnerability.advisory.id}: ${issue.data.html_url}`,
         );
@@ -314,12 +326,13 @@ export async function reportIssues(
             warning: warning,
             advisory: advisory,
         });
-        const issue = await client.rest.issues.create({
+        const issue = await api.repos.issueCreateIssue(owner, repo, {
-            owner: owner,
-            repo: repo,
             title: `${advisory.id}: ${advisory.title}`,
-            body: body,
+            body,
         });
+        for (const label of labels) {
+            core.warning(`Unable to add label ${label}`);
+        }
         core.info(
             `Created an issue for ${advisory.id}: ${issue.data.html_url}`,
         );