github-security-report 0.11.0__tar.gz → 0.11.3__tar.gz

{github_security_report-0.11.0 → github_security_report-0.11.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: github-security-report
-Version: 0.11.0
+Version: 0.11.3
 Summary: Security and quality reporting across GitHub organisations
 Project-URL: Homepage, https://github.com/lfreleng-actions/github-security-report-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github-security-report-action
@@ -393,6 +393,19 @@ config asked for an uncapped one. `0` means "no limit" at every level. In a
 shared Slack channel the most generous value any contributing org configured for
 that category wins, matching the visibility rule above.
 
+On Slack, `0` is best-effort rather than absolute. Slack imposes hard structural
+limits on a message — 50 blocks per post, 3,000 characters per text object (a
+section body or a context note) and 150 for a header — and rejects the **whole**
+post if any is breached, so an uncapped table would cost the entire digest rather
+than merely overflowing. The digest therefore sizes itself to fit: repository
+name lists are trimmed first, then table rows, and whatever is left out is
+reported by the usual `… and N more` tally so the numbers on screen stay honest.
+Counts are never dropped, only names and rows. The other three surfaces have no
+Slack-style ceiling, but they still apply their own row limits — only the
+`report.json` artifact is unconditionally complete. The digest links to the
+GitHub Pages report whenever `pages_url` is set and short enough to render as a
+link.
+
 ### Per-category row ordering
 
 Each table ships a sensible default ordering — largest backlog first, stalest

{github_security_report-0.11.0 → github_security_report-0.11.3}/README.md

@@ -349,6 +349,19 @@ config asked for an uncapped one. `0` means "no limit" at every level. In a
 shared Slack channel the most generous value any contributing org configured for
 that category wins, matching the visibility rule above.
 
+On Slack, `0` is best-effort rather than absolute. Slack imposes hard structural
+limits on a message — 50 blocks per post, 3,000 characters per text object (a
+section body or a context note) and 150 for a header — and rejects the **whole**
+post if any is breached, so an uncapped table would cost the entire digest rather
+than merely overflowing. The digest therefore sizes itself to fit: repository
+name lists are trimmed first, then table rows, and whatever is left out is
+reported by the usual `… and N more` tally so the numbers on screen stay honest.
+Counts are never dropped, only names and rows. The other three surfaces have no
+Slack-style ceiling, but they still apply their own row limits — only the
+`report.json` artifact is unconditionally complete. The digest links to the
+GitHub Pages report whenever `pages_url` is set and short enough to render as a
+link.
+
 ### Per-category row ordering
 
 Each table ships a sensible default ordering — largest backlog first, stalest

{github_security_report-0.11.0 → github_security_report-0.11.3}/src/github_security_report/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.11.0'
-__version_tuple__ = version_tuple = (0, 11, 0)
+__version__ = version = '0.11.3'
+__version_tuple__ = version_tuple = (0, 11, 3)
 
 __commit_id__ = commit_id = None

{github_security_report-0.11.0 → github_security_report-0.11.3}/src/github_security_report/client/__init__.py

@@ -11,8 +11,9 @@ See ``docs/BRIEF.md`` sections 9, 13 and ``docs/phase0-findings.md``.
 The implementation is split across ``endpoints`` (environment-resolved API URLs
 and the shared retry/backoff policy), ``queries`` (GraphQL documents),
 ``parsers`` (pure header/node parsing), ``transport`` (connection lifecycle and
-the retrying request primitives), ``reads`` (the reporting reads) and ``writes``
-(the remediation writes plus the public :class:`GitHubClient`). This module
+the retrying request primitives), ``org_reads`` (the reads issued once per
+organisation), ``reads`` (the per-repository reads) and ``writes`` (the
+remediation writes plus the public :class:`GitHubClient`). This module
 re-exports the public surface, so importing from
 ``github_security_report.client`` is unchanged.
 """
@@ -32,6 +33,7 @@ from github_security_report.client.endpoints import (
     SCORECARD_API,
     _https_endpoint,
 )
+from github_security_report.client.org_reads import OrgReadClient
 from github_security_report.client.parsers import (
     _last_published,
     _next_page_url,
@@ -66,6 +68,7 @@ __all__ = [
     "SCORECARD_API",
     "GitHubClient",
     "NetworkError",
+    "OrgReadClient",
     "ReadClient",
     "Transport",
     "_CODE_SCANNING_SIGNAL_TOOLS",

github_security_report-0.11.3/src/github_security_report/client/org_reads.py

@@ -0,0 +1,239 @@
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: 2026 The Linux Foundation
+"""Org-scope GitHub reads: repository listing, bulk sweeps and prefetch.
+
+:class:`OrgReadClient` holds the reads issued once per organisation -- the
+repository listing, the org-bulk alert sweeps, the org ruleset fetch and the
+batched GraphQL prefetch -- leaving the per-repository probes to
+:class:`~github_security_report.client.reads.ReadClient`, which extends it.
+Methods return raw parsed JSON (and HTTP status where the status itself is the
+signal, e.g. 404 = feature disabled).
+"""
+
+from __future__ import annotations
+
+import logging
+
+from github_security_report.client.endpoints import BULK_KINDS
+from github_security_report.client.parsers import _parse_iso, _parse_repo_node
+from github_security_report.client.queries import _REPO_GRAPH_FRAGMENT
+from github_security_report.client.transport import NetworkError, Transport
+from github_security_report.models import Repo, RepoGraphData
+
+log = logging.getLogger(__name__)
+
+
+def _aliases_with_errors(errors: object, alias_count: int) -> set[str]:
+    """Alias keys implicated by a batched query's ``errors`` array.
+
+    GitHub reports a *field-level* failure with HTTP 200: the alias is still a
+    populated dictionary, the field that failed is null, and an ``errors``
+    entry carries its path (e.g. ``["r3", "latestRelease"]``). Parsing such a
+    node would convert a read failure into a confident negative -- a nulled
+    ``latestRelease`` is indistinguishable from "never released" -- so the
+    whole alias is treated as unreadable rather than partially trusted.
+
+    The alias is failed wholesale rather than per field: a finer-grained flag
+    per field would have to be threaded through every table to be honest
+    about which half of a row is trustworthy, whereas one unknown repository
+    is already a state every table renders correctly.
+
+    An error whose path names no alias cannot be attributed, so it implicates
+    every alias in the batch: with no way to tell which repositories it
+    touched, treating any of them as successfully read would be a guess.
+    """
+    all_aliases = {f"r{i}" for i in range(alias_count)}
+    if not isinstance(errors, list):
+        return set()
+    affected: set[str] = set()
+    for entry in errors:
+        path = entry.get("path") if isinstance(entry, dict) else None
+        head = path[0] if isinstance(path, list) and path else None
+        if isinstance(head, str) and head in all_aliases:
+            affected.add(head)
+        else:
+            return all_aliases
+    return affected
+
+
+class OrgReadClient(Transport):
+    """The org-scope reads: listing, bulk sweeps, rulesets and prefetch."""
+
+    # ------------------------------------------------------------------ #
+    # Repositories
+    # ------------------------------------------------------------------ #
+    async def list_org_repos(self, org: str) -> tuple[int, list[Repo]]:
+        """List an organisation's repositories, skipping disabled/empty ones.
+
+        Returns the listing status alongside the repos: a non-200 (a failed or
+        mid-pagination-truncated listing) means the set is incomplete, so the
+        caller can flag a partial report rather than silently omitting repos
+        (and their offenders).
+        """
+        status, raws = await self._get_list(
+            f"{self._api_url}/orgs/{org}/repos", type="all"
+        )
+        repos: list[Repo] = []
+        for raw in raws:
+            if raw.get("disabled") or raw.get("size", 0) == 0:
+                log.info("skipping %s: disabled or empty", raw.get("full_name"))
+                continue
+            repos.append(
+                Repo(
+                    name=raw["name"],
+                    full_name=raw["full_name"],
+                    html_url=raw["html_url"],
+                    archived=raw.get("archived", False),
+                    fork=raw.get("fork", False),
+                    is_template=raw.get("is_template", False),
+                    private=raw.get("private", False),
+                    created_at=_parse_iso(raw.get("created_at")),
+                )
+            )
+        return status, repos
+
+    # ------------------------------------------------------------------ #
+    # Org-bulk alert sweeps
+    # ------------------------------------------------------------------ #
+    async def org_bulk_alerts(self, org: str, kind: str) -> tuple[int, list[dict]]:
+        """Sweep all open alerts of one kind across the org.
+
+        Returns the first-page HTTP status alongside the alerts so callers can
+        tell an authoritative empty result (200 ``[]``) apart from an unreadable
+        sweep (403/404/5xx), which must never be reported as "clean".
+        """
+        path = BULK_KINDS[kind]
+        return await self._get_list(f"{self._api_url}/orgs/{org}/{path}", state="open")
+
+    # ------------------------------------------------------------------ #
+    # Organisation rulesets (workflow-driven tool enablement)
+    # ------------------------------------------------------------------ #
+    async def org_workflow_rulesets(self, org: str) -> tuple[int, list[dict]]:
+        """Active, branch-targeted org rulesets, each with full rule details.
+
+        Returns ``(status, details)``; status is the org-rulesets list status
+        (e.g. 403 when the token lacks org access) so coverage can degrade
+        gracefully. The list endpoint returns summaries, so each active branch
+        ruleset is fetched in detail to expose its rules and conditions.
+        """
+        status, summaries = await self._get_list(f"{self._api_url}/orgs/{org}/rulesets")
+        if status != 200:
+            return status, []
+        details: list[dict] = []
+        for summary in summaries:
+            if summary.get("enforcement") != "active":
+                continue
+            if summary.get("target") not in (None, "branch"):
+                continue
+            resp = await self._request(
+                "GET", f"{self._api_url}/orgs/{org}/rulesets/{summary['id']}"
+            )
+            if resp.status_code == 200:
+                details.append(resp.json())
+            await resp.aclose()  # release the connection once the body is read
+        return 200, details
+
+    # ------------------------------------------------------------------ #
+    # Batched per-repo prefetch (one query for many repositories)
+    # ------------------------------------------------------------------ #
+    async def repo_graph_batch(
+        self, org: str, names: list[str]
+    ) -> dict[str, RepoGraphData]:
+        """Prefetch per-repo data for many repositories in one GraphQL query.
+
+        Returns a ``RepoGraphData`` per requested name. This data is
+        load-bearing for whole report sections (releases/tags, Dependabot
+        enablement, open issues), and its defaults are indistinguishable from
+        confident negatives ("never released"), so a wholly failed query --
+        a non-200 response that survived the shared retry/backoff policy, or
+        a 200 carrying no ``data`` object -- raises :class:`NetworkError` to
+        abort the run rather than fabricating results. A repository that
+        cannot be fully read -- a ``null`` alias, or a populated alias whose
+        ``errors`` entry shows a field failed to resolve -- degrades to
+        ``RepoGraphData(unreadable=True)`` so downstream tables report it as
+        unknown. An empty ``names`` issues no request.
+        """
+        # Seed every requested name as unreadable; only a successfully parsed
+        # alias replaces its entry, so nothing failed can masquerade as read.
+        out = {name: RepoGraphData(unreadable=True) for name in names}
+        if not names:
+            return out
+        aliases = "\n".join(
+            f"  r{i}: repository(owner: $owner, name: $n{i}) {{ ...RepoData }}"
+            for i in range(len(names))
+        )
+        var_decls = "".join(f", $n{i}: String!" for i in range(len(names)))
+        query = (
+            f"query($owner: String!{var_decls}) {{\n{aliases}\n}}\n"
+            f"{_REPO_GRAPH_FRAGMENT}"
+        )
+        variables: dict[str, str] = {"owner": org}
+        for i, name in enumerate(names):
+            variables[f"n{i}"] = name
+        resp = await self._request(
+            "POST",
+            self._graphql_url,
+            json={"query": query, "variables": variables},
+        )
+        if resp.status_code != 200:
+            status = resp.status_code
+            await resp.aclose()  # unread body would leak a pooled connection
+            raise NetworkError(
+                f"GraphQL prefetch for {org} failed with HTTP {status} after "
+                "exhausting retries; aborting because the release/tag, "
+                "Dependabot-enablement and open-issues data for "
+                f"{len(names)} repositories would otherwise be fabricated "
+                "from defaults (e.g. reported as never released)."
+            )
+        body = resp.json()
+        data = body.get("data")
+        await resp.aclose()  # release the connection once the body is read
+        # GitHub answers a partially-refused query with HTTP 200: the readable
+        # aliases populated, the rest null or missing individual fields, and an
+        # ``errors`` array explaining why. The paths are both logged for
+        # diagnosis and used to fail the affected aliases, since a field nulled
+        # by a failed read is indistinguishable from a genuine absence.
+        errors = body.get("errors")
+        errored_aliases = _aliases_with_errors(errors, len(names))
+        if errors:
+            log.warning(
+                "GraphQL prefetch for %s returned %d error(s); affected data is "
+                "reported as unknown: %s",
+                org,
+                len(errors),
+                "; ".join(
+                    f"{'.'.join(str(p) for p in (e.get('path') or []))}: "
+                    f"{e.get('message', '')}"
+                    for e in errors[:5]
+                    if isinstance(e, dict)
+                ),
+            )
+        if not isinstance(data, dict):
+            # HTTP 200 with no data object at all: the whole batch failed
+            # (e.g. a timed-out or refused query). Same stakes as a non-200.
+            raise NetworkError(
+                f"GraphQL prefetch for {org} returned no data for any of "
+                f"{len(names)} repositories; aborting rather than reporting "
+                "fabricated defaults. "
+                f"errors={errors!r}"
+            )
+        for i, name in enumerate(names):
+            alias = f"r{i}"
+            if alias in errored_aliases:
+                # A field of this alias failed to resolve, so its null fields
+                # cannot be told apart from genuine absences. Leave the
+                # pre-seeded unreadable default in place.
+                continue
+            node = data.get(alias)
+            if isinstance(node, dict):
+                out[name] = _parse_repo_node(node)
+        unreadable = sorted(name for name, d in out.items() if d.unreadable)
+        if unreadable:
+            log.warning(
+                "GraphQL prefetch for %s could not read %d repositories "
+                "(reported as unknown): %s",
+                org,
+                len(unreadable),
+                ", ".join(unreadable),
+            )
+        return out

{github_security_report-0.11.0 → github_security_report-0.11.3}/src/github_security_report/client/reads.py

@@ -1,10 +1,12 @@
 # SPDX-License-Identifier: Apache-2.0
 # SPDX-FileCopyrightText: 2026 The Linux Foundation
-"""Read-only GitHub API surface: repo listing, sweeps, probes and prefetch.
+"""Per-repository GitHub reads: enabled-probes, alerts and posture flags.
 
-:class:`ReadClient` adds every reporting read to :class:`Transport`. Methods
-return raw parsed JSON (and HTTP status where the status itself is the signal,
-e.g. 404 = feature disabled).
+:class:`ReadClient` completes the reporting read surface by adding the reads
+issued once per repository to the org-scope reads of
+:class:`~github_security_report.client.org_reads.OrgReadClient`. Methods return
+raw parsed JSON (and HTTP status where the status itself is the signal, e.g.
+404 = feature disabled).
 """
 
 from __future__ import annotations
@@ -12,67 +14,19 @@ from __future__ import annotations
 import asyncio
 import logging
 
-from github_security_report.client.endpoints import BULK_KINDS
-from github_security_report.client.parsers import _parse_iso, _parse_repo_node
+from github_security_report.client.org_reads import OrgReadClient
+from github_security_report.client.parsers import _parse_iso
 from github_security_report.client.queries import (
     _CODE_SCANNING_SIGNAL_TOOLS,
     _DEPENDABOT_ENABLED_QUERY,
-    _REPO_GRAPH_FRAGMENT,
 )
-from github_security_report.client.transport import Transport
-from github_security_report.models import Repo, RepoGraphData
+from github_security_report.models import Repo
 
 log = logging.getLogger(__name__)
 
 
-class ReadClient(Transport):
-    """The reporting reads: sweeps, per-repo probes and batched prefetch."""
-
-    # ------------------------------------------------------------------ #
-    # Repositories
-    # ------------------------------------------------------------------ #
-    async def list_org_repos(self, org: str) -> tuple[int, list[Repo]]:
-        """List an organisation's repositories, skipping disabled/empty ones.
-
-        Returns the listing status alongside the repos: a non-200 (a failed or
-        mid-pagination-truncated listing) means the set is incomplete, so the
-        caller can flag a partial report rather than silently omitting repos
-        (and their offenders).
-        """
-        status, raws = await self._get_list(
-            f"{self._api_url}/orgs/{org}/repos", type="all"
-        )
-        repos: list[Repo] = []
-        for raw in raws:
-            if raw.get("disabled") or raw.get("size", 0) == 0:
-                log.info("skipping %s: disabled or empty", raw.get("full_name"))
-                continue
-            repos.append(
-                Repo(
-                    name=raw["name"],
-                    full_name=raw["full_name"],
-                    html_url=raw["html_url"],
-                    archived=raw.get("archived", False),
-                    fork=raw.get("fork", False),
-                    is_template=raw.get("is_template", False),
-                    private=raw.get("private", False),
-                    created_at=_parse_iso(raw.get("created_at")),
-                )
-            )
-        return status, repos
-
-    # ------------------------------------------------------------------ #
-    # Org-bulk alert sweeps
-    # ------------------------------------------------------------------ #
-    async def org_bulk_alerts(self, org: str, kind: str) -> tuple[int, list[dict]]:
-        """Sweep all open alerts of one kind across the org.
-
-        Returns the first-page HTTP status alongside the alerts so callers can
-        tell an authoritative empty result (200 ``[]``) apart from an unreadable
-        sweep (403/404/5xx), which must never be reported as "clean".
-        """
-        path = BULK_KINDS[kind]
-        return await self._get_list(f"{self._api_url}/orgs/{org}/{path}", state="open")
+class ReadClient(OrgReadClient):
+    """The reporting reads: org sweeps plus the per-repository probes."""
 
     # ------------------------------------------------------------------ #
     # Per-repo enabled-probes
@@ -193,34 +147,6 @@ class ReadClient(Transport):
         await resp.aclose()  # release the connection once the body is read
         return 200, score
 
-    # ------------------------------------------------------------------ #
-    # Repository rulesets (workflow-driven tool enablement)
-    # ------------------------------------------------------------------ #
-    async def org_workflow_rulesets(self, org: str) -> tuple[int, list[dict]]:
-        """Active, branch-targeted org rulesets, each with full rule details.
-
-        Returns ``(status, details)``; status is the org-rulesets list status
-        (e.g. 403 when the token lacks org access) so coverage can degrade
-        gracefully. The list endpoint returns summaries, so each active branch
-        ruleset is fetched in detail to expose its rules and conditions.
-        """
-        status, summaries = await self._get_list(f"{self._api_url}/orgs/{org}/rulesets")
-        if status != 200:
-            return status, []
-        details: list[dict] = []
-        for summary in summaries:
-            if summary.get("enforcement") != "active":
-                continue
-            if summary.get("target") not in (None, "branch"):
-                continue
-            resp = await self._request(
-                "GET", f"{self._api_url}/orgs/{org}/rulesets/{summary['id']}"
-            )
-            if resp.status_code == 200:
-                details.append(resp.json())
-            await resp.aclose()  # release the connection once the body is read
-        return 200, details
-
     async def repo_branch_rules(
         self, org: str, repo: str, branch: str
     ) -> tuple[int, list[dict]]:
@@ -328,64 +254,3 @@ class ReadClient(Transport):
         data = resp.json()
         await resp.aclose()  # release the connection once the body is read
         return bool(data.get("enabled"))
-
-    async def repo_graph_batch(
-        self, org: str, names: list[str]
-    ) -> dict[str, RepoGraphData]:
-        """Prefetch per-repo data for many repositories in one GraphQL query.
-
-        Returns a ``RepoGraphData`` per requested name. Repositories that cannot
-        be read (a ``null`` alias) or a wholly failed query degrade to default
-        ``RepoGraphData``, so they drop out of the dependent tables rather than
-        being mislabelled. An empty ``names`` issues no request.
-        """
-        out = {name: RepoGraphData() for name in names}
-        if not names:
-            return out
-        aliases = "\n".join(
-            f"  r{i}: repository(owner: $owner, name: $n{i}) {{ ...RepoData }}"
-            for i in range(len(names))
-        )
-        var_decls = "".join(f", $n{i}: String!" for i in range(len(names)))
-        query = (
-            f"query($owner: String!{var_decls}) {{\n{aliases}\n}}\n"
-            f"{_REPO_GRAPH_FRAGMENT}"
-        )
-        variables: dict[str, str] = {"owner": org}
-        for i, name in enumerate(names):
-            variables[f"n{i}"] = name
-        resp = await self._request(
-            "POST",
-            self._graphql_url,
-            json={"query": query, "variables": variables},
-        )
-        if resp.status_code != 200:
-            await resp.aclose()  # unread body would leak a pooled connection
-            return out
-        body = resp.json()
-        data = body.get("data") or {}
-        await resp.aclose()  # release the connection once the body is read
-        # GitHub answers a partially-refused query with HTTP 200: the readable
-        # aliases populated, the rest null, and an ``errors`` array explaining
-        # why. Silently dropping it hides exactly the case where a field was
-        # served as null because the token could not read it, so the paths are
-        # logged once per batch for diagnosis.
-        errors = body.get("errors")
-        if errors:
-            log.warning(
-                "GraphQL prefetch for %s returned %d error(s); affected data is "
-                "reported as unknown: %s",
-                org,
-                len(errors),
-                "; ".join(
-                    f"{'.'.join(str(p) for p in (e.get('path') or []))}: "
-                    f"{e.get('message', '')}"
-                    for e in errors[:5]
-                    if isinstance(e, dict)
-                ),
-            )
-        for i, name in enumerate(names):
-            node = data.get(f"r{i}")
-            if isinstance(node, dict):
-                out[name] = _parse_repo_node(node)
-        return out

{github_security_report-0.11.0 → github_security_report-0.11.3}/src/github_security_report/client/transport.py

@@ -35,15 +35,17 @@ _TransportT = TypeVar("_TransportT", bound="Transport")
 
 
 class NetworkError(RuntimeError):
-    """The GitHub API was unreachable after exhausting the retry budget.
+    """The GitHub API was unusable after exhausting the retry budget.
 
     Raised for transport-level failures (DNS, connection, TLS, or read
     timeout) against the GitHub API that persist across every retry within
-    ``API_MAX_TOTAL_WAIT_SECONDS``. The run aborts rather than rendering a
-    report from missing data: when the API itself cannot be reached, an empty
-    or "all clean / all unknown" report is actively misleading. Transport
-    failures against the third-party Scorecard endpoint do not raise this --
-    they degrade that one signal instead.
+    ``API_MAX_TOTAL_WAIT_SECONDS``, and by callers whose data is load-bearing
+    for the whole report (the batched GraphQL prefetch) when GitHub keeps
+    answering with server errors. The run aborts rather than rendering a
+    report from missing data: when the API itself cannot be relied on, an
+    empty or "all clean / all unknown" report is actively misleading.
+    Transport failures against the third-party Scorecard endpoint do not
+    raise this -- they degrade that one signal instead.
     """
 
 
@@ -163,8 +165,11 @@ class Transport:
         -- a report built without live data would be misleading. The same
         failure against the third-party Scorecard endpoint instead degrades to
         an indeterminate 503, so one flaky external API never aborts the report.
-        Rate-limit responses (403/429) back off on the same schedule and, once
-        exhausted, return the throttled response for per-signal degradation.
+        Server errors (5xx) and rate-limit responses (403/429) back off on the
+        same schedule and, once exhausted, return the response for the caller
+        to handle: per-signal probes degrade to unknown, while callers whose
+        data is load-bearing (the GraphQL prefetch) abort the run instead of
+        fabricating results.
         """
         http = client or self._client
         is_external = http is self._ext_client
@@ -216,10 +221,11 @@ class Transport:
                 waited += delay
                 attempt += 1
                 continue
-            if resp.status_code not in (403, 429):
+            if resp.status_code not in (403, 429) and resp.status_code < 500:
                 return resp
-            # Reachable but possibly rate limited: distinguish secondary/primary
-            # rate limiting from a genuine 403, then back off on the shared
+            # Reachable but degraded: a 5xx (GitHub infrastructure trouble) or
+            # a possible rate limit. Distinguish secondary/primary rate
+            # limiting from a genuine 403, then back off on the shared
             # schedule (honouring Retry-After) within the wait budget.
             retry_after = resp.headers.get("retry-after")
             remaining = resp.headers.get("x-ratelimit-remaining")
@@ -235,18 +241,35 @@ class Transport:
             rate_limited = (
                 resp.status_code == 429 or retry_after is not None or remaining == "0"
             )
+            # Any 5xx is retried: GitHub's infrastructure wobbles produce
+            # transient 500/502/503 responses that, if returned un-retried,
+            # would silently degrade (or falsify) whole report sections.
+            server_error = resp.status_code >= 500
             delay = (
                 retry_after_secs
                 if retry_after_secs is not None
                 else self._backoff_delay(attempt)
             )
             if (
-                not rate_limited
+                not (rate_limited or server_error)
                 or attempt >= self._max_retries
                 or waited + delay > API_MAX_TOTAL_WAIT_SECONDS
             ):
+                # Retries exhausted (or a genuine 403): hand the response back
+                # so the caller can degrade its signal to unknown -- or, when
+                # its data is load-bearing, abort the run.
                 return resp
-            log.warning("rate limited on %s; backing off %.0fs", url, delay)
+            if server_error:
+                log.warning(
+                    "server error %d on %s; retrying in %.0fs (retry %d of %d)",
+                    resp.status_code,
+                    url,
+                    delay,
+                    attempt + 1,
+                    self._max_retries,
+                )
+            else:
+                log.warning("rate limited on %s; backing off %.0fs", url, delay)
             # The discarded response must be closed; we are retrying and will
             # not read its body, so leaving it open would leak a pool connection.
             await resp.aclose()

{github_security_report-0.11.0 → github_security_report-0.11.3}/src/github_security_report/client/writes.py

@@ -2,11 +2,12 @@
 # SPDX-FileCopyrightText: 2026 The Linux Foundation
 """Remediation writes, and the public :class:`GitHubClient` façade.
 
-``GitHubClient`` completes the linear ``Transport -> ReadClient ->
-GitHubClient`` chain. The chain exists so each layer stays a readable size --
-connection/retry mechanics, reporting reads, and remediation writes are
-separable concerns -- while callers still get a single object, because one
-client instance serves both the reporting reads and the remediation writes.
+``GitHubClient`` completes the linear ``Transport -> OrgReadClient ->
+ReadClient -> GitHubClient`` chain. The chain exists so each layer stays a
+readable size -- connection/retry mechanics, org-scope reads, per-repository
+reads, and remediation writes are separable concerns -- while callers still get
+a single object, because one client instance serves both the reporting reads
+and the remediation writes.
 """
 
 from __future__ import annotations

{github_security_report-0.11.0 → github_security_report-0.11.3}/src/github_security_report/collect/context.py

@@ -60,13 +60,13 @@ class OrgCollectContext:
     probe_scorecard: bool
 
     def graph_for(self, name: str) -> RepoGraphData:
-        """Prefetched GraphQL data for a repository, or empty defaults.
+        """Prefetched GraphQL data for a repository, or unreadable defaults.
 
-        A repository missing from the prefetch (an unreadable alias, or a wholly
-        failed batch) degrades to defaults so it drops out of the dependent
-        tables instead of being mislabelled.
+        A repository missing from the prefetch entirely is marked
+        ``unreadable`` so the dependent tables report it as unknown instead of
+        mislabelling it with confident negatives (e.g. "never released").
         """
-        return self.graph.get(name, RepoGraphData())
+        return self.graph.get(name, RepoGraphData(unreadable=True))
 
     def ruleset_signals(self, name: str) -> set[str]:
         """Signals an org ruleset enforces for a repository (possibly none)."""

{github_security_report-0.11.0 → github_security_report-0.11.3}/src/github_security_report/collect/extras.py

@@ -55,6 +55,7 @@ async def _posture_for_repo(repo: Repo, ctx: OrgCollectContext) -> RepoPosture:
     )
     return RepoPosture(
         repo=repo,
+        graph_unreadable=graph.unreadable,
         dependabot_alerts=graph.dependabot_alerts_enabled,
         security_updates=security_updates,
         private_vulnerability_reporting=pvr,