fix: Resolve lint errors from API version 2026-03-10 migration

Rename CVSS struct fields to use all-caps initialism (CvssV3 → CVSSV3,
CvssV4 → CVSSV4, CvssSeverities → CVSSSeverities), update the
verifyartifact example to fetch bundles via BundleURL instead of the
removed Bundle field, and fix gci formatting.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: maxffarrell

example/verifyartifact/main.go

@@ -15,7 +15,9 @@ import (
 	"encoding/json"
 	"flag"
 	"fmt"
+	"io"
 	"log"
+	"net/http"
 	"os"
 
 	"github.com/google/go-github/v84/github"
@@ -102,16 +104,25 @@ func main() {
 		log.Fatal(err)
 	}
 
-	var b *bundle.Bundle
 	for _, attestation := range attestations.Attestations {
-		if err := json.Unmarshal(attestation.Bundle, &b); err != nil {
+		resp, err := http.Get(attestation.GetBundleURL())
+		if err != nil {
 			log.Fatal(err)
 		}
-
-		err := runVerification(sev, pb, b)
+		body, err := io.ReadAll(resp.Body)
+		resp.Body.Close()
 		if err != nil {
 			log.Fatal(err)
 		}
+
+		var b *bundle.Bundle
+		if err := json.Unmarshal(body, &b); err != nil {
+			log.Fatal(err)
+		}
+
+		if err := runVerification(sev, pb, b); err != nil {
+			log.Fatal(err)
+		}
 	}
 }
 

github/dependabot_alerts.go

@@ -25,8 +25,8 @@ type AdvisoryCVSS struct {
 
 // AdvisoryCvssSeverities contains CVSS v3 and v4 severity information for a security advisory.
 type AdvisoryCvssSeverities struct {
-	CvssV3 *AdvisoryCVSS `json:"cvss_v3,omitempty"`
-	CvssV4 *AdvisoryCVSS `json:"cvss_v4,omitempty"`
+	CVSSV3 *AdvisoryCVSS `json:"cvss_v3,omitempty"`
+	CVSSV4 *AdvisoryCVSS `json:"cvss_v4,omitempty"`
 }
 
 // AdvisoryCWEs represent the advisory pertaining to Common Weakness Enumeration.
@@ -53,7 +53,7 @@ type DependabotSecurityAdvisory struct {
 	Vulnerabilities []*AdvisoryVulnerability `json:"vulnerabilities,omitempty"`
 	Severity        *string                  `json:"severity,omitempty"`
 	CVSS            *AdvisoryCVSS            `json:"cvss,omitempty"`
-	CvssSeverities  *AdvisoryCvssSeverities  `json:"cvss_severities,omitempty"`
+	CVSSSeverities  *AdvisoryCvssSeverities  `json:"cvss_severities,omitempty"`
 	CWEs            []*AdvisoryCWEs          `json:"cwes,omitempty"`
 	EPSS            *AdvisoryEPSS            `json:"epss,omitempty"`
 	Identifiers     []*AdvisoryIdentifier    `json:"identifiers,omitempty"`

github/event_types.go

@@ -1884,7 +1884,7 @@ type WorkflowRunEvent struct {
 // GitHub API docs: https://docs.github.com/developers/webhooks-and-events/webhooks/webhook-events-and-payloads#security_advisory
 type SecurityAdvisory struct {
 	CVSS               *AdvisoryCVSS                 `json:"cvss,omitempty"`
-	CvssSeverities     *AdvisoryCvssSeverities       `json:"cvss_severities,omitempty"`
+	CVSSSeverities     *AdvisoryCvssSeverities       `json:"cvss_severities,omitempty"`
 	CWEs               []*AdvisoryCWEs               `json:"cwes,omitempty"`
 	GHSAID             *string                       `json:"ghsa_id,omitempty"`
 	Summary            *string                       `json:"summary,omitempty"`

github/github-accessors.go

@@ -87,10 +87,10 @@ func (i Issue) IsPullRequest() bool {
 // It is separate from Issue above because otherwise Labels
 // and Assignees fail to serialize to the correct JSON.
 type IssueRequest struct {
-	Title    *string   `json:"title,omitempty"`
-	Body     *string   `json:"body,omitempty"`
-	Labels   *[]string `json:"labels,omitempty"`
-	State    *string   `json:"state,omitempty"`
+	Title  *string   `json:"title,omitempty"`
+	Body   *string   `json:"body,omitempty"`
+	Labels *[]string `json:"labels,omitempty"`
+	State  *string   `json:"state,omitempty"`
 	// StateReason can be 'completed' or 'not_planned'.
 	StateReason *string   `json:"state_reason,omitempty"`
 	Milestone   *int      `json:"milestone,omitempty"`