github-security-report 0.1.0__py3-none-any.whl

github_security_report/render/slack.py

@@ -0,0 +1,215 @@
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: 2026 The Linux Foundation
+"""Slack rendering.
+
+Slack mrkdwn cannot render Markdown tables, so the digest uses fixed-width
+code-fenced blocks (the only way to align columns) showing the worst N
+offenders per signal, plus a prominent link to the full GitHub Pages report.
+Produces a ``chat.postMessage`` payload. See ``docs/BRIEF.md`` section 11.
+"""
+
+from __future__ import annotations
+
+from github_security_report.models import RepoSignal, SignalType
+from github_security_report.report import (
+    OrgReport,
+    SignalSection,
+    TableSection,
+    truncate,
+)
+
+# Slack rejects a chat.postMessage with more than 50 blocks, so a digest
+# spanning many orgs must be capped or the whole message fails to deliver.
+_SLACK_MAX_BLOCKS = 50
+
+
+def _plain_columns(signal: SignalType) -> list[str]:
+    if signal is SignalType.SECRET_SCANNING:
+        return ["repo", "open"]
+    if signal is SignalType.SCORECARD:
+        return ["repo", "score", "C", "H", "M", "L"]
+    return ["repo", "C", "H", "M", "L"]
+
+
+def _plain_row(sig: RepoSignal) -> list[str]:
+    c = sig.counts
+    if sig.signal is SignalType.SECRET_SCANNING:
+        return [sig.repo.name, str(c.total)]
+    if sig.signal is SignalType.SCORECARD:
+        score = f"{sig.score:.1f}" if sig.score is not None else "-"
+        return [sig.repo.name, score, str(c.critical), str(c.high), str(c.medium), str(c.low)]
+    return [sig.repo.name, str(c.critical), str(c.high), str(c.medium), str(c.low)]
+
+
+def _fixed_table(section: SignalSection, top_n: int) -> str:
+    cols = _plain_columns(section.signal)
+    shown, hidden = truncate(section.offenders, top_n)
+    rows = [_plain_row(s) for s in shown]
+    widths = [len(c) for c in cols]
+    for row in rows:
+        for i, cell in enumerate(row):
+            widths[i] = max(widths[i], len(cell))
+    # First column left-aligned (repo name), numeric columns right-aligned.
+    def fmt(row: list[str]) -> str:
+        cells = [row[0].ljust(widths[0])]
+        cells += [row[i].rjust(widths[i]) for i in range(1, len(row))]
+        return "  ".join(cells)
+
+    lines = [fmt(cols)] + [fmt(row) for row in rows]
+    if hidden:
+        # Match the posture/release tables: surface the hidden count.
+        lines.append(f"… and {hidden} more")
+    return "\n".join(lines)
+
+
+def _summary(section: SignalSection) -> str:
+    bits = []
+    if section.offenders:
+        bits.append(f"{len(section.offenders)} with findings")
+    if section.clean_count:
+        bits.append(f"{section.clean_count} clean")
+    if section.nag_repos:
+        bits.append(f"{len(section.nag_repos)} not enabled")
+    if section.unknown_count:
+        bits.append(f"{section.unknown_count} unknown")
+    return ", ".join(bits) or "no data"
+
+
+def _fixed_table_generic(columns: tuple[str, ...], rows: list[list[str]]) -> str:
+    """Fixed-width text table for a generic posture/freshness table."""
+    widths = [len(c) for c in columns]
+    for row in rows:
+        for i, cell in enumerate(row):
+            widths[i] = max(widths[i], len(cell))
+
+    def fmt(row: list[str]) -> str:
+        return "  ".join(cell.ljust(widths[i]) for i, cell in enumerate(row))
+
+    lines = [fmt(list(columns))] + [fmt(row) for row in rows]
+    return "\n".join(lines)
+
+
+def _table_block(section: TableSection, top_n: int) -> dict | None:
+    """A Slack section block for a posture/freshness table (None when empty).
+
+    Emoji cell glyphs are dropped from the fixed-width rendering so columns stay
+    aligned in Slack's monospace block; only the worst ``top_n`` rows are shown.
+    """
+    if not section.rows:
+        return None
+    shown, hidden = truncate(section.rows, top_n)
+    rows = [
+        [row.repo.name, *(cell.replace("✅", "y").replace("❌", "n").replace("❓", "?") for cell in row.cells)]
+        for row in shown
+    ]
+    table = _fixed_table_generic(section.columns, rows)
+    if hidden:
+        table += f"\n… and {hidden} more"
+    return {
+        "type": "section",
+        "text": {"type": "mrkdwn", "text": f"*{section.title}*\n```\n{table}\n```"},
+    }
+
+
+def render_org_blocks(org: OrgReport, *, top_n: int, pages_url: str | None) -> list[dict]:
+    """Slack blocks for one organisation."""
+    blocks: list[dict] = [
+        {
+            "type": "header",
+            "text": {"type": "plain_text", "text": f"🔐 Security report: {org.org}"},
+        }
+    ]
+    if org.partial:
+        blocks.append(
+            {
+                "type": "context",
+                "elements": [
+                    {
+                        "type": "mrkdwn",
+                        "text": "⚠️ Incomplete: the repository listing could not "
+                        "be fully read; some repositories may be missing.",
+                    }
+                ],
+            }
+        )
+    if org.excluded_repos:
+        shown, hidden = truncate(org.excluded_repos, top_n)
+        names = ", ".join(r.name for r in shown)
+        if hidden:
+            names += f" … (+{hidden} more)"
+        blocks.append(
+            {
+                "type": "context",
+                "elements": [
+                    {
+                        "type": "mrkdwn",
+                        "text": f"⏩ Excluded from analysis "
+                        f"({len(org.excluded_repos)}): {names}",
+                    }
+                ],
+            }
+        )
+    for section in org.sections:
+        summary = _summary(section)
+        text = f"*{section.signal.heading}* — {summary}"
+        if section.offenders:
+            table = _fixed_table(section, top_n)
+            text += f"\n```\n{table}\n```"
+        blocks.append({"type": "section", "text": {"type": "mrkdwn", "text": text}})
+        # Dependabot posture sub-tables follow the Dependabot signal block.
+        if section.signal is SignalType.DEPENDABOT:
+            for table_section in org.dependabot_tables:
+                block = _table_block(table_section, top_n)
+                if block is not None:
+                    blocks.append(block)
+    if org.releases is not None:
+        block = _table_block(org.releases, top_n)
+        if block is not None:
+            blocks.append(block)
+    if pages_url:
+        blocks.append(
+            {
+                "type": "context",
+                "elements": [
+                    {"type": "mrkdwn", "text": f"<{pages_url}|View the full report>"}
+                ],
+            }
+        )
+    return blocks
+
+
+def _enforce_block_limit(blocks: list[dict], pages_url: str | None) -> list[dict]:
+    """Cap blocks at Slack's per-message limit, noting any truncation.
+
+    A digest covering many orgs can exceed 50 blocks, which makes Slack reject
+    the entire message (no digest delivered). Keep the first blocks and replace
+    the overflow with a single note pointing at the full report.
+    """
+    if len(blocks) <= _SLACK_MAX_BLOCKS:
+        return blocks
+    if pages_url:
+        note = (
+            f"… digest truncated to Slack's {_SLACK_MAX_BLOCKS}-block limit; "
+            f"<{pages_url}|view the full report>."
+        )
+    else:
+        note = f"… digest truncated to Slack's {_SLACK_MAX_BLOCKS}-block limit."
+    kept = blocks[: _SLACK_MAX_BLOCKS - 1]
+    kept.append({"type": "context", "elements": [{"type": "mrkdwn", "text": note}]})
+    return kept
+
+
+def render_payload(
+    orgs: list[OrgReport], *, channel: str, top_n: int = 10, pages_url: str | None = None
+) -> dict:
+    """Build a ``chat.postMessage`` payload across one or more organisations."""
+    blocks: list[dict] = []
+    for org in orgs:
+        blocks.extend(render_org_blocks(org, top_n=top_n, pages_url=pages_url))
+    blocks = _enforce_block_limit(blocks, pages_url)
+    names = ", ".join(o.org for o in orgs)
+    return {
+        "channel": channel,
+        "text": f"🔐 Security report: {names}",
+        "blocks": blocks,
+    }

github_security_report/render/terminal.py

@@ -0,0 +1,163 @@
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: 2026 The Linux Foundation
+"""Rich terminal rendering.
+
+The default presentation for local/TTY runs: one coloured table per signal,
+worst-first, with clean/nag/unknown summaries beneath. The CLI falls back to a
+plain console (no colour) in CI / non-TTY contexts. See ``docs/BRIEF.md``
+sections 10-11.
+"""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Sequence
+
+from rich.console import Console
+from rich.table import Table
+
+from github_security_report.models import Repo, RepoSignal, SignalType
+from github_security_report.report import (
+    OrgReport,
+    SignalSection,
+    TableSection,
+    truncate,
+)
+
+_SEVERITY_STYLE = {"critical": "bold red", "high": "red", "medium": "yellow", "low": "dim"}
+
+
+def _split_sentences(text: str) -> list[str]:
+    """Split a footnote into one sentence per line for readable terminal output.
+
+    Splits on a sentence-ending period followed by whitespace, keeping the
+    period. A semicolon does not end a sentence, so a clause such as
+    "mandatory; any value passes." stays on one line. A single-sentence note is
+    returned unchanged as one line.
+    """
+    parts = re.split(r"(?<=\.)\s+", text.strip())
+    return [part for part in parts if part]
+
+
+def _add_columns(table: Table, signal: SignalType) -> None:
+    table.add_column("Repository", overflow="fold")
+    if signal is SignalType.SECRET_SCANNING:
+        table.add_column("Open", justify="right")
+        return
+    if signal is SignalType.SCORECARD:
+        table.add_column("Score", justify="right")
+    for name, style in _SEVERITY_STYLE.items():
+        table.add_column(name.capitalize(), justify="right", style=style)
+    if signal is not SignalType.SCORECARD:
+        table.add_column("Total", justify="right")
+
+
+def _row(sig: RepoSignal) -> list[str]:
+    c = sig.counts
+    if sig.signal is SignalType.SECRET_SCANNING:
+        return [sig.repo.name, str(c.total)]
+    base = [str(c.critical), str(c.high), str(c.medium), str(c.low)]
+    if sig.signal is SignalType.SCORECARD:
+        score = f"{sig.score:.1f}" if sig.score is not None else "—"
+        return [sig.repo.name, score, *base]
+    return [sig.repo.name, *base, str(c.total)]
+
+
+def _names(repos: Sequence[Repo], top_n: int | None) -> str:
+    """Comma-joined repo names limited to ``top_n`` with a '(+N more)' tail."""
+    shown, hidden = truncate(repos, top_n)
+    text = ", ".join(r.name for r in shown)
+    if hidden:
+        text += f" … (+{hidden} more)"
+    return text
+
+
+def render_section(
+    section: SignalSection,
+    console: Console,
+    *,
+    excluded: Sequence[Repo] = (),
+    top_n: int | None = None,
+) -> None:
+    offenders, hidden_offenders = truncate(section.offenders, top_n)
+    if offenders:
+        table = Table(title=section.signal.heading, title_justify="left", title_style="bold")
+        _add_columns(table, section.signal)
+        for sig in offenders:
+            table.add_row(*_row(sig))
+        console.print(table)
+        if hidden_offenders:
+            console.print(f"  [dim]… and {hidden_offenders} more[/dim]")
+    else:
+        console.print(f"[bold]{section.signal.heading}[/bold]")
+    # Numerical totals first (each on its own line, always the true total), then
+    # the repository-name breakdowns -- numbers and names are never mixed on one
+    # line, and the name lists honour the same offender limit as the tables.
+    totals: list[str] = []
+    if section.clean_count:
+        totals.append(f"[green]✅ {section.clean_count} Clean[/green]")
+    if section.nag_repos:
+        totals.append(f"[yellow]❌ {len(section.nag_repos)} Disabled[/yellow]")
+    if excluded:
+        totals.append(f"[blue]⏩ {len(excluded)} Excluded[/blue]")
+    if section.unknown_count:
+        totals.append(f"[dim]❓ {section.unknown_count} Unknown[/dim]")
+    if not (offenders or totals):
+        totals.append("[dim]No data[/dim]")
+    for line in totals:
+        console.print("  " + line)
+    if section.nag_repos:
+        console.print(f"  [yellow]Disabled:[/yellow] {_names(section.nag_repos, top_n)}")
+    if excluded:
+        console.print(f"  [blue]Excluded:[/blue] {_names(excluded, top_n)}")
+    console.print()
+
+
+def render_table_section(
+    section: TableSection, console: Console, *, top_n: int | None = None
+) -> None:
+    """Render a generic posture/freshness table to the terminal."""
+    rows, hidden = truncate(section.rows, top_n)
+    if rows:
+        table = Table(title=section.title, title_justify="left", title_style="bold")
+        for i, col in enumerate(section.columns):
+            table.add_column(col, overflow="fold", justify="left" if i == 0 else "right")
+        for row in rows:
+            table.add_row(row.repo.name, *row.cells)
+        console.print(table)
+        if hidden:
+            console.print(f"  [dim]… and {hidden} more[/dim]")
+        if section.note:
+            # A long footnote reads better split one sentence per line. It only
+            # describes a populated table, so it is omitted when empty.
+            for sentence in _split_sentences(section.note):
+                console.print(f"  [dim]{sentence}[/dim]")
+    else:
+        console.print(f"[bold]{section.title}[/bold]")
+        if section.empty_note:
+            console.print(f"  [green]✅ {section.empty_note}[/green]")
+    console.print()
+
+
+def render_org(org: OrgReport, console: Console, *, top_n: int | None = None) -> None:
+    console.rule(f"[bold]Security report: {org.org}[/bold]")
+    console.print(f"[dim]{org.repo_count} repositories analysed[/dim]\n")
+    if org.partial:
+        console.print(
+            "[yellow]⚠ Incomplete: the repository listing could not be fully "
+            "read; some repositories may be missing.[/yellow]\n"
+        )
+    for section in org.sections:
+        render_section(section, console, excluded=org.excluded_repos, top_n=top_n)
+        if section.signal is SignalType.DEPENDABOT:
+            for table in org.dependabot_tables:
+                render_table_section(table, console, top_n=top_n)
+    if org.releases is not None:
+        render_table_section(org.releases, console, top_n=top_n)
+
+
+def render_orgs(
+    orgs: list[OrgReport], console: Console, *, top_n: int | None = None
+) -> None:
+    for org in orgs:
+        render_org(org, console, top_n=top_n)

github_security_report/report.py

@@ -0,0 +1,173 @@
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: 2026 The Linux Foundation
+"""Report aggregation.
+
+Groups classified :class:`RepoSignal` results into the renderable report
+structure: one section per signal, each with ranked offenders (full list -- the
+top-N limit applies only to Slack), a clean count, a nag list (archived/test
+repos excluded), and an unknown count. See ``docs/BRIEF.md`` sections 4-6, 11.
+"""
+
+from __future__ import annotations
+
+import datetime as dt
+from collections.abc import Sequence
+from dataclasses import dataclass, field
+from typing import TypeVar
+
+from github_security_report import scope
+from github_security_report.models import (
+    Repo,
+    RepoSignal,
+    RepoState,
+    SignalType,
+    rank_offenders,
+)
+
+# Render order for the five sections.
+SIGNAL_ORDER: tuple[SignalType, ...] = (
+    SignalType.CODEQL,
+    SignalType.SCORECARD,
+    SignalType.ZIZMOR,
+    SignalType.DEPENDABOT,
+    SignalType.SECRET_SCANNING,
+)
+
+
+@dataclass
+class SignalSection:
+    """One signal's results for one organisation."""
+
+    signal: SignalType
+    offenders: list[RepoSignal] = field(default_factory=list)  # ranked worst-first
+    clean_count: int = 0
+    nag_repos: list[Repo] = field(default_factory=list)
+    unknown_count: int = 0
+
+    def top(self, n: int) -> list[RepoSignal]:
+        """The worst N offenders (used for the Slack digest only)."""
+        return self.offenders[:n]
+
+
+@dataclass
+class TableRow:
+    """A generic, repository-keyed table row with pre-formatted cells.
+
+    Used by the Dependabot posture and Releases/Tagging tables, which do not fit
+    the four-state :class:`SignalSection` model. ``cells`` excludes the leading
+    repository link cell (each renderer supplies that from ``repo``).
+    """
+
+    repo: Repo
+    cells: tuple[str, ...]
+
+
+@dataclass
+class TableSection:
+    """A generic titled table rendered as a sub-section under a heading.
+
+    The **first** column is always the repository column -- every renderer puts
+    the repository link/name there (from each :class:`TableRow`'s ``repo``).
+    Its header *label* is free-form (usually ``"Repository"``, but a single-list
+    table may describe its contents instead, e.g. ``"Repositories NOT
+    Enabled"``); downstream consumers should treat column 0 as the repository
+    regardless of the label.
+    """
+
+    title: str
+    columns: tuple[str, ...]  # column 0 is the repository column (label varies)
+    rows: list[TableRow] = field(default_factory=list)
+    # Shown in place of the table when there are no rows (a clean state).
+    empty_note: str = ""
+    # Optional explanatory footnote rendered beneath the table.
+    note: str = ""
+
+
+@dataclass
+class OrgReport:
+    org: str
+    sections: list[SignalSection]
+    repo_count: int
+    generated_at: dt.datetime
+    # True when the repository listing was incomplete (e.g. a truncated or
+    # forbidden org repos read), so the report may omit repositories.
+    partial: bool = False
+    # Repositories removed from analysis by the per-org ``exclude`` list. These
+    # are reported as "excluded" (counted, never analysed) so an explicit
+    # exclusion is visible and distinct from a "not enabled" nag.
+    excluded_repos: list[Repo] = field(default_factory=list)
+    # Extra Dependabot posture tables rendered as sub-sections beneath the
+    # Dependabot signal heading (alerts not enabled, security updates not
+    # enabled, cooldown settings). Empty in repo mode / when not collected.
+    dependabot_tables: list[TableSection] = field(default_factory=list)
+    # The Releases / Tagging table (release and tag staleness). None only when
+    # not collected (repo mode); org mode always assigns a section, which may
+    # have zero rows and render its empty_note instead.
+    releases: TableSection | None = None
+
+
+@dataclass
+class Report:
+    orgs: list[OrgReport]
+    generated_at: dt.datetime
+
+
+_T = TypeVar("_T")
+
+
+def truncate(items: Sequence[_T], top_n: int | None) -> tuple[list[_T], int]:
+    """Limit a sequence for display, returning ``(shown, hidden_count)``.
+
+    The single place every render surface applies an offender limit, so the
+    GitHub Pages, terminal and Slack outputs truncate tables and name lists
+    identically. ``top_n`` of ``None`` or a negative value (or one at least the
+    sequence length) shows everything and reports ``0`` hidden -- the negative
+    case is a defensive no-op, since negative slicing would otherwise drop
+    items from the end.
+    """
+    seq = list(items)
+    if top_n is None or top_n < 0 or len(seq) <= top_n:
+        return seq, 0
+    return seq[:top_n], len(seq) - top_n
+
+
+def build_org_report(
+    org: str,
+    repo_signals: list[RepoSignal],
+    *,
+    repo_count: int,
+    generated_at: dt.datetime | None = None,
+    partial: bool = False,
+    excluded_repos: list[Repo] | None = None,
+) -> OrgReport:
+    """Assemble an :class:`OrgReport` from a flat list of classified signals."""
+    when = generated_at or dt.datetime.now(dt.timezone.utc)
+    by_signal: dict[SignalType, list[RepoSignal]] = {s: [] for s in SIGNAL_ORDER}
+    for sig in repo_signals:
+        by_signal.setdefault(sig.signal, []).append(sig)
+
+    sections: list[SignalSection] = []
+    for signal in SIGNAL_ORDER:
+        results = by_signal.get(signal, [])
+        nag = [
+            s.repo
+            for s in results
+            if s.state is RepoState.NAG and scope.in_nag_scope(s.repo)
+        ]
+        sections.append(
+            SignalSection(
+                signal=signal,
+                offenders=rank_offenders(results),
+                clean_count=sum(1 for s in results if s.state is RepoState.CLEAN),
+                nag_repos=sorted(nag, key=lambda r: r.name),
+                unknown_count=sum(1 for s in results if s.state is RepoState.UNKNOWN),
+            )
+        )
+    return OrgReport(
+        org=org,
+        sections=sections,
+        repo_count=repo_count,
+        generated_at=when,
+        partial=partial,
+        excluded_repos=sorted(excluded_repos or [], key=lambda r: r.name),
+    )

github_security_report/rulesets.py

@@ -0,0 +1,137 @@
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: 2026 The Linux Foundation
+"""Org repository-ruleset coverage for workflow-driven tools.
+
+Some tools (e.g. zizmor) are not enabled per-repository; they are enforced
+across the estate by an **organisation repository ruleset** containing a
+``workflows`` rule that requires a central workflow on every pull request. Such
+a repo runs the tool even though it has no matching ``.github/workflows`` file
+of its own, so the per-repo enabled-probe would wrongly nag it.
+
+This module reads the authoritative ruleset definitions and computes, for a
+given repository, which signals are covered. A signal is mapped to a ruleset by
+a case-insensitive keyword match against the required-workflow path (e.g. the
+``zizmor`` signal matches ``.github/workflows/zizmor.yaml``). See the
+``GET /orgs/{org}/rulesets`` and ``GET /repos/{o}/{r}/rules/branches/{branch}``
+GitHub APIs.
+"""
+
+from __future__ import annotations
+
+import fnmatch
+from collections.abc import Mapping
+from dataclasses import dataclass
+
+# Patterns GitHub uses to mean "every repository".
+_MATCH_ALL = {"*", "~all"}
+
+
+@dataclass(frozen=True)
+class WorkflowRuleset:
+    """An active org ruleset that requires one or more workflows."""
+
+    name: str
+    workflow_paths: tuple[str, ...]
+    include: tuple[str, ...]  # repository_name include patterns
+    exclude: tuple[str, ...]  # repository_name exclude patterns
+
+
+def parse_workflow_rulesets(details: list[dict]) -> list[WorkflowRuleset]:
+    """Extract active, branch-targeted rulesets that require workflows."""
+    out: list[WorkflowRuleset] = []
+    for ruleset in details:
+        if ruleset.get("enforcement") != "active":
+            continue
+        if ruleset.get("target") not in (None, "branch"):
+            continue
+        paths: list[str] = []
+        for rule in ruleset.get("rules") or []:
+            if rule.get("type") != "workflows":
+                continue
+            for wf in (rule.get("parameters") or {}).get("workflows") or []:
+                path = wf.get("path")
+                if path:
+                    paths.append(path)
+        if not paths:
+            continue
+        cond = (ruleset.get("conditions") or {}).get("repository_name") or {}
+        out.append(
+            WorkflowRuleset(
+                name=ruleset.get("name", ""),
+                workflow_paths=tuple(paths),
+                include=tuple(cond.get("include", [])),
+                exclude=tuple(cond.get("exclude", [])),
+            )
+        )
+    return out
+
+
+def _name_matches(name: str, patterns: tuple[str, ...]) -> bool:
+    candidate = name.lower()
+    for pattern in patterns:
+        lowered = pattern.lower()
+        if lowered in _MATCH_ALL or fnmatch.fnmatch(candidate, lowered):
+            return True
+    return False
+
+
+def repo_covered(name: str, ruleset: WorkflowRuleset) -> bool:
+    """Whether a repository name is targeted by the ruleset's conditions."""
+    return _name_matches(name, ruleset.include) and not _name_matches(
+        name, ruleset.exclude
+    )
+
+
+def _paths_match_keyword(paths: tuple[str, ...] | list[str], keyword: str) -> bool:
+    kw = keyword.lower()
+    # An empty keyword would substring-match every path; treat it as no match
+    # so a misconfigured mapping cannot mark every repo as covered.
+    if not kw:
+        return False
+    return any(kw in path.lower() for path in paths)
+
+
+def signals_covered(
+    name: str,
+    rulesets: list[WorkflowRuleset],
+    signal_keywords: Mapping[str, str],
+) -> set[str]:
+    """Signals (by value) that an org ruleset enforces for this repository.
+
+    ``signal_keywords`` maps a signal value (e.g. ``"zizmor"``) to a keyword
+    that must appear in a required-workflow path.
+    """
+    covered: set[str] = set()
+    for signal, keyword in signal_keywords.items():
+        for ruleset in rulesets:
+            if _paths_match_keyword(ruleset.workflow_paths, keyword) and repo_covered(
+                name, ruleset
+            ):
+                covered.add(signal)
+                break
+    return covered
+
+
+def signals_from_branch_rules(
+    rules: list[dict],
+    signal_keywords: Mapping[str, str],
+) -> set[str]:
+    """Signals covered for a single repo, from its effective branch rules.
+
+    Used in repo mode: ``GET /repos/{o}/{r}/rules/branches/{branch}`` already
+    returns the rules in effect for this repository (including inherited org
+    rulesets), so no name matching is needed.
+    """
+    paths: list[str] = []
+    for rule in rules:
+        if rule.get("type") != "workflows":
+            continue
+        for wf in (rule.get("parameters") or {}).get("workflows") or []:
+            path = wf.get("path")
+            if path:
+                paths.append(path)
+    return {
+        signal
+        for signal, keyword in signal_keywords.items()
+        if _paths_match_keyword(paths, keyword)
+    }