github-security-report 0.12.0__tar.gz → 0.13.0__tar.gz

{github_security_report-0.12.0 → github_security_report-0.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: github-security-report
-Version: 0.12.0
+Version: 0.13.0
 Summary: Security and quality reporting across GitHub organisations
 Project-URL: Homepage, https://github.com/lfreleng-actions/github-security-report-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github-security-report-action
@@ -31,12 +31,12 @@ Requires-Dist: pyyaml==6.0.3
 Requires-Dist: rich==15.0.0
 Requires-Dist: typer==0.27.1
 Provides-Extra: dev
-Requires-Dist: mypy==2.3.0; extra == 'dev'
+Requires-Dist: mypy==2.3.1; extra == 'dev'
 Requires-Dist: pytest-asyncio==1.4.0; extra == 'dev'
 Requires-Dist: pytest-cov==7.1.0; extra == 'dev'
 Requires-Dist: pytest==9.1.1; extra == 'dev'
 Requires-Dist: respx==0.23.1; extra == 'dev'
-Requires-Dist: ruff==0.16.2; extra == 'dev'
+Requires-Dist: ruff==0.16.3; extra == 'dev'
 Requires-Dist: syrupy==5.5.3; extra == 'dev'
 Requires-Dist: types-jsonschema==4.26.0.20260518; extra == 'dev'
 Requires-Dist: types-pyyaml==6.0.12.20250915; extra == 'dev'
@@ -95,8 +95,8 @@ no alerts, no analyses on a sample of repositories — gets a single
 `⏩ Skipping feature: organisation support missing` line for that section
 instead of a nag list. See the
 [organisation scan setup guide](docs/org-scan-setup.md) for the required
-workflows, and disable the check with `report.gating: false` if you want to
-probe everything regardless.
+workflows, and disable the check with `report.gating: false` (or `--no-gating`)
+if you want to probe everything regardless.
 
 Further sections report **configuration posture** and **freshness** as plain
 tables (org mode):
@@ -223,7 +223,8 @@ organisations. Grant these scopes:
     scope: "org"
     config: "${{ secrets.GSR_CONFIG || vars.GSR_CONFIG }}"
     token: "${{ secrets.LFRELENG_ACTIONS_REPORT_PAT }}"
-    # Must match the per-org "token_env" in your config (below).
+    # Exports the token under this name, and overrides the per-org
+    # "token_env" in the config (below) so the two cannot drift apart.
     token_env: "LFRELENG_ACTIONS_REPORT_PAT"
     output_dir: "site"
     pages_url: "https://lfreleng-actions.github.io/github-security-report-action/"
@@ -246,6 +247,15 @@ digest only on the configured `report_day` (default Tuesday).
   # requires: permissions: { security-events: read }
 ```
 
+Repo mode renders one repository to the terminal and the job summary. It
+honours `top_n`, `top_n_report`, `top_n_cli`, `hide`, and the `report` block of
+a supplied `config` (including every `report.categories.*` toggle). The inputs
+that only shape an organisation-wide run — `output_dir`, `pages_url`,
+`slack_channel`, `force_notify`, `top_n_slack`, and the Releases/Tagging levers
+— are **rejected** with exit code 2 rather than accepted and discarded, so a
+misconfigured workflow says so instead of quietly producing a report that
+ignores them.
+
 ## Configuration
 
 Configuration is JSON, supplied as a plain `vars.` entry or base64-encoded in a
@@ -264,7 +274,8 @@ environment-variable name, never embedded.
     "include_archived": false,
     "include_test": false,
     "repo_min_age_days": 28,
-    "release_max_age_days": 60
+    "release_max_age_days": 60,
+    "order": { "style": "auto" }
   },
   "organizations": [
     {
@@ -300,7 +311,12 @@ The Releases / Tagging section has two independent freshness levers:
   repositories drop out of the table. CLI: `--release-max-age-days`.
 
 The per-org `releases_exclude` (CLI `--releases-exclude`, repeatable) drops
-named repositories from the section entirely.
+named repositories from the section entirely. The flag *replaces* the
+configured list rather than adding to it, and cannot say which organisation it
+means, so it is refused when the run covers more than one — set
+`releases_exclude` per organisation in the configuration for that case. The two
+age levers above are scalar policy and do apply to every configured
+organisation, as `--top-n` does.
 
 > The former `release_min_age_days` key was a misleading name for
 > `repo_min_age_days` (it gates *repository* age, not *release* age). It is
@@ -311,6 +327,10 @@ The per-org `exclude` list removes repositories from analysis entirely; they are
 reported as **excluded** (distinct from "not enabled"), so an intentional
 exclusion is visible rather than silently dropped.
 
+Archived and test repositories are excluded from analysis by default. Opt them
+back in with `report.include_archived` / `report.include_test` in the config, or
+for a single run with `--include-archived` / `--include-test`.
+
 ### Per-category render toggles
 
 Every reporting category can be switched on or off, globally and per output
@@ -487,6 +507,92 @@ a column list — Scorecard cascades through the worst severity rung any offende
 actually carries, so a lone Critical is never buried by a weaker repository with
 a lower score.
 
+### Output order
+
+`sort` above orders the rows *within* a table. `report.order` orders the
+**sections themselves** — which category a reader meets first.
+
+By default the report sorts its sections into three bands:
+
+| Band | Contains | Why |
+| ---- | -------- | --- |
+| **Priority** | Secret Scanning, Dependabot: Security Alerts, CodeQL, Mutable Releases | Findings worth acting on today |
+| **Middle** | Everything else | Neither urgent nor constant |
+| **BAU** | OpenSSF Scorecard, GitHub Issues, Pull Requests, Assigned to Me | Carry data every run, so none of it is news |
+
+The bands are not fixed slots. **A band member with nothing to report moves
+into the middle**: a clean priority category is noise at the top of a page, and
+a clean BAU category has stopped being background. Demoted priority categories
+sit at the top of the middle band and demoted BAU ones at the bottom, so
+whatever survives in each band still bounds the middle from its own side.
+
+"Nothing to report" means no rows and no named repositories — no offenders, and
+nobody nagged for having the tool disabled. The bare counts every category
+prints regardless (`All Clean`, an unknown tally) do not hold a band position. A
+section skipped by [feature gating](#organisation-feature-gating) renders a
+notice rather than results, so it demotes too.
+
+The order is resolved **once**, when the report is assembled, and every surface
+draws it — the terminal, the Slack digest, the Markdown artifact and the Pages
+HTML cannot disagree. `report.json` publishes the resolved sequence as
+`section_order`, listing each nested posture table after the signal it renders
+beneath, so a machine consumer can reproduce the same layout.
+
+Four styles are available via `report.order.style`:
+
+| Style | Reads | Behaviour |
+| ----- | ----- | --------- |
+| `auto` (default) | — | The bands above, with the built-in membership. `automatic` is accepted as the same thing |
+| `dual` | `priority`, `bau` | The same algorithm over your own band lists. Omit either to keep the built-in one |
+| `single` | `sequence` | A strict hierarchy, applied verbatim with **no** demotion. Categories the list omits keep their assembly order behind it |
+| `fixed` | — | No reordering at all — the order this tool produced before `report.order` existed |
+
+Two bands of your own:
+
+```json
+{
+  "report": {
+    "order": {
+      "style": "dual",
+      "priority": ["secret_scanning", "codeql"],
+      "bau": ["github_issues", "pull_requests"]
+    }
+  },
+  "organizations": [{ "name": "lfreleng-actions" }]
+}
+```
+
+Or one strict hierarchy, honoured whatever the data says:
+
+```json
+{
+  "report": {
+    "order": {
+      "style": "single",
+      "sequence": ["secret_scanning", "dependabot_alerts", "codeql"]
+    }
+  },
+  "organizations": [{ "name": "lfreleng-actions" }]
+}
+```
+
+A list key paired with a style that does not read it is an **error** rather than
+a silent no-op: writing a `priority` band and leaving the style at `auto` asks
+for a custom band and would otherwise quietly get the built-in one. Listing a
+category twice, or in both bands, is rejected for the same reason — a category
+holds exactly one position.
+
+An organisation inherits the global `order` block and may override it. Setting
+`style` back to `"auto"` restores the built-in bands rather than keeping the
+ones a global `dual` block supplied, since the built-in bands are what `auto`
+means.
+
+The three Dependabot posture tables (alerts enabled, security updates enabled,
+cooldown) are not independently placeable. They render beneath the Dependabot
+Alerts signal on every surface and travel with it, since three near-identical
+headings adrift in the report would not say which signal they qualified.
+Naming one in an ordering list is rejected rather than accepted and ignored.
+
 ### GitHub Issues
 
 The `github_issues` category counts each repository's **open issues**, split by
@@ -942,7 +1048,8 @@ code-scanning alerts from the tool, analyses on a sample of repositories, or
 **skipped** — not probed per repository, not classified — and its section
 shows a single `⏩ Skipping feature: organisation support missing` line
 linking the setup guide, on every output surface. Set `report.gating` to
-`false` (globally or per organisation) to always probe everything:
+`false` (globally or per organisation), or pass `--no-gating` for a single run,
+to always probe everything:
 
 ```json
 {
@@ -951,6 +1058,10 @@ linking the setup guide, on every output surface. Set `report.gating` to
 }
 ```
 
+Because a skipped section is the most likely prompt for "why is zizmor missing
+from my report?", `--no-gating` exists so that question can be answered without
+writing a configuration file to set one boolean.
+
 Gating decides **collection**; the per-category render toggles above decide
 **presentation**. A skipped section still renders (as the one-line notice)
 unless its category is also disabled.
@@ -1021,7 +1132,7 @@ and the Slack **bot token** is consumed by the workflow, not the CLI.
 | `org` | No | — | Single organisation (shorthand for org mode) |
 | `repo` | No | detected | `owner/name` for repo mode |
 | `token` | No | `${{ github.token }}` | PAT (org mode) or `GITHUB_TOKEN` (repo mode) |
-| `token_env` | No | `GITHUB_TOKEN` | Env var name the token is exported under. In org mode it **must match** the per-org `token_env` in your config (e.g. `LFRELENG_ACTIONS_REPORT_PAT`), otherwise the tool looks up an unset variable and reports no token. |
+| `token_env` | No | `GITHUB_TOKEN` | Env var name the token is exported under. When set it **overrides** the per-org `token_env` in your config, so the two no longer have to be kept in step; leave it unset to let each organisation use its own configured variable. |
 | `output_dir` | No | — | Directory for Pages output (org mode) |
 | `pages_url` | No | — | Published Pages URL (used in the Slack link) |
 | `slack_channel` | No | — | Slack channel ID; overrides the config `slack.channel` (e.g. the `SLACK_CHANNEL_ID` variable) |

{github_security_report-0.12.0 → github_security_report-0.13.0}/README.md

@@ -51,8 +51,8 @@ no alerts, no analyses on a sample of repositories — gets a single
 `⏩ Skipping feature: organisation support missing` line for that section
 instead of a nag list. See the
 [organisation scan setup guide](docs/org-scan-setup.md) for the required
-workflows, and disable the check with `report.gating: false` if you want to
-probe everything regardless.
+workflows, and disable the check with `report.gating: false` (or `--no-gating`)
+if you want to probe everything regardless.
 
 Further sections report **configuration posture** and **freshness** as plain
 tables (org mode):
@@ -179,7 +179,8 @@ organisations. Grant these scopes:
     scope: "org"
     config: "${{ secrets.GSR_CONFIG || vars.GSR_CONFIG }}"
     token: "${{ secrets.LFRELENG_ACTIONS_REPORT_PAT }}"
-    # Must match the per-org "token_env" in your config (below).
+    # Exports the token under this name, and overrides the per-org
+    # "token_env" in the config (below) so the two cannot drift apart.
     token_env: "LFRELENG_ACTIONS_REPORT_PAT"
     output_dir: "site"
     pages_url: "https://lfreleng-actions.github.io/github-security-report-action/"
@@ -202,6 +203,15 @@ digest only on the configured `report_day` (default Tuesday).
   # requires: permissions: { security-events: read }
 ```
 
+Repo mode renders one repository to the terminal and the job summary. It
+honours `top_n`, `top_n_report`, `top_n_cli`, `hide`, and the `report` block of
+a supplied `config` (including every `report.categories.*` toggle). The inputs
+that only shape an organisation-wide run — `output_dir`, `pages_url`,
+`slack_channel`, `force_notify`, `top_n_slack`, and the Releases/Tagging levers
+— are **rejected** with exit code 2 rather than accepted and discarded, so a
+misconfigured workflow says so instead of quietly producing a report that
+ignores them.
+
 ## Configuration
 
 Configuration is JSON, supplied as a plain `vars.` entry or base64-encoded in a
@@ -220,7 +230,8 @@ environment-variable name, never embedded.
     "include_archived": false,
     "include_test": false,
     "repo_min_age_days": 28,
-    "release_max_age_days": 60
+    "release_max_age_days": 60,
+    "order": { "style": "auto" }
   },
   "organizations": [
     {
@@ -256,7 +267,12 @@ The Releases / Tagging section has two independent freshness levers:
   repositories drop out of the table. CLI: `--release-max-age-days`.
 
 The per-org `releases_exclude` (CLI `--releases-exclude`, repeatable) drops
-named repositories from the section entirely.
+named repositories from the section entirely. The flag *replaces* the
+configured list rather than adding to it, and cannot say which organisation it
+means, so it is refused when the run covers more than one — set
+`releases_exclude` per organisation in the configuration for that case. The two
+age levers above are scalar policy and do apply to every configured
+organisation, as `--top-n` does.
 
 > The former `release_min_age_days` key was a misleading name for
 > `repo_min_age_days` (it gates *repository* age, not *release* age). It is
@@ -267,6 +283,10 @@ The per-org `exclude` list removes repositories from analysis entirely; they are
 reported as **excluded** (distinct from "not enabled"), so an intentional
 exclusion is visible rather than silently dropped.
 
+Archived and test repositories are excluded from analysis by default. Opt them
+back in with `report.include_archived` / `report.include_test` in the config, or
+for a single run with `--include-archived` / `--include-test`.
+
 ### Per-category render toggles
 
 Every reporting category can be switched on or off, globally and per output
@@ -443,6 +463,92 @@ a column list — Scorecard cascades through the worst severity rung any offende
 actually carries, so a lone Critical is never buried by a weaker repository with
 a lower score.
 
+### Output order
+
+`sort` above orders the rows *within* a table. `report.order` orders the
+**sections themselves** — which category a reader meets first.
+
+By default the report sorts its sections into three bands:
+
+| Band | Contains | Why |
+| ---- | -------- | --- |
+| **Priority** | Secret Scanning, Dependabot: Security Alerts, CodeQL, Mutable Releases | Findings worth acting on today |
+| **Middle** | Everything else | Neither urgent nor constant |
+| **BAU** | OpenSSF Scorecard, GitHub Issues, Pull Requests, Assigned to Me | Carry data every run, so none of it is news |
+
+The bands are not fixed slots. **A band member with nothing to report moves
+into the middle**: a clean priority category is noise at the top of a page, and
+a clean BAU category has stopped being background. Demoted priority categories
+sit at the top of the middle band and demoted BAU ones at the bottom, so
+whatever survives in each band still bounds the middle from its own side.
+
+"Nothing to report" means no rows and no named repositories — no offenders, and
+nobody nagged for having the tool disabled. The bare counts every category
+prints regardless (`All Clean`, an unknown tally) do not hold a band position. A
+section skipped by [feature gating](#organisation-feature-gating) renders a
+notice rather than results, so it demotes too.
+
+The order is resolved **once**, when the report is assembled, and every surface
+draws it — the terminal, the Slack digest, the Markdown artifact and the Pages
+HTML cannot disagree. `report.json` publishes the resolved sequence as
+`section_order`, listing each nested posture table after the signal it renders
+beneath, so a machine consumer can reproduce the same layout.
+
+Four styles are available via `report.order.style`:
+
+| Style | Reads | Behaviour |
+| ----- | ----- | --------- |
+| `auto` (default) | — | The bands above, with the built-in membership. `automatic` is accepted as the same thing |
+| `dual` | `priority`, `bau` | The same algorithm over your own band lists. Omit either to keep the built-in one |
+| `single` | `sequence` | A strict hierarchy, applied verbatim with **no** demotion. Categories the list omits keep their assembly order behind it |
+| `fixed` | — | No reordering at all — the order this tool produced before `report.order` existed |
+
+Two bands of your own:
+
+```json
+{
+  "report": {
+    "order": {
+      "style": "dual",
+      "priority": ["secret_scanning", "codeql"],
+      "bau": ["github_issues", "pull_requests"]
+    }
+  },
+  "organizations": [{ "name": "lfreleng-actions" }]
+}
+```
+
+Or one strict hierarchy, honoured whatever the data says:
+
+```json
+{
+  "report": {
+    "order": {
+      "style": "single",
+      "sequence": ["secret_scanning", "dependabot_alerts", "codeql"]
+    }
+  },
+  "organizations": [{ "name": "lfreleng-actions" }]
+}
+```
+
+A list key paired with a style that does not read it is an **error** rather than
+a silent no-op: writing a `priority` band and leaving the style at `auto` asks
+for a custom band and would otherwise quietly get the built-in one. Listing a
+category twice, or in both bands, is rejected for the same reason — a category
+holds exactly one position.
+
+An organisation inherits the global `order` block and may override it. Setting
+`style` back to `"auto"` restores the built-in bands rather than keeping the
+ones a global `dual` block supplied, since the built-in bands are what `auto`
+means.
+
+The three Dependabot posture tables (alerts enabled, security updates enabled,
+cooldown) are not independently placeable. They render beneath the Dependabot
+Alerts signal on every surface and travel with it, since three near-identical
+headings adrift in the report would not say which signal they qualified.
+Naming one in an ordering list is rejected rather than accepted and ignored.
+
 ### GitHub Issues
 
 The `github_issues` category counts each repository's **open issues**, split by
@@ -898,7 +1004,8 @@ code-scanning alerts from the tool, analyses on a sample of repositories, or
 **skipped** — not probed per repository, not classified — and its section
 shows a single `⏩ Skipping feature: organisation support missing` line
 linking the setup guide, on every output surface. Set `report.gating` to
-`false` (globally or per organisation) to always probe everything:
+`false` (globally or per organisation), or pass `--no-gating` for a single run,
+to always probe everything:
 
 ```json
 {
@@ -907,6 +1014,10 @@ linking the setup guide, on every output surface. Set `report.gating` to
 }
 ```
 
+Because a skipped section is the most likely prompt for "why is zizmor missing
+from my report?", `--no-gating` exists so that question can be answered without
+writing a configuration file to set one boolean.
+
 Gating decides **collection**; the per-category render toggles above decide
 **presentation**. A skipped section still renders (as the one-line notice)
 unless its category is also disabled.
@@ -977,7 +1088,7 @@ and the Slack **bot token** is consumed by the workflow, not the CLI.
 | `org` | No | — | Single organisation (shorthand for org mode) |
 | `repo` | No | detected | `owner/name` for repo mode |
 | `token` | No | `${{ github.token }}` | PAT (org mode) or `GITHUB_TOKEN` (repo mode) |
-| `token_env` | No | `GITHUB_TOKEN` | Env var name the token is exported under. In org mode it **must match** the per-org `token_env` in your config (e.g. `LFRELENG_ACTIONS_REPORT_PAT`), otherwise the tool looks up an unset variable and reports no token. |
+| `token_env` | No | `GITHUB_TOKEN` | Env var name the token is exported under. When set it **overrides** the per-org `token_env` in your config, so the two no longer have to be kept in step; leave it unset to let each organisation use its own configured variable. |
 | `output_dir` | No | — | Directory for Pages output (org mode) |
 | `pages_url` | No | — | Published Pages URL (used in the Slack link) |
 | `slack_channel` | No | — | Slack channel ID; overrides the config `slack.channel` (e.g. the `SLACK_CHANNEL_ID` variable) |

{github_security_report-0.12.0 → github_security_report-0.13.0}/pyproject.toml

@@ -64,8 +64,8 @@ dev = [
   "pytest-cov==7.1.0",
   "respx==0.23.1",
   "syrupy==5.5.3",
-  "mypy==2.3.0",
-  "ruff==0.16.2",
+  "mypy==2.3.1",
+  "ruff==0.16.3",
   "types-jsonschema==4.26.0.20260518",
   "types-PyYAML==6.0.12.20250915",
 ]
@@ -96,8 +96,8 @@ dev = [
   "pytest-cov==7.1.0",
   "respx==0.23.1",
   "syrupy==5.5.3",
-  "mypy==2.3.0",
-  "ruff==0.16.2",
+  "mypy==2.3.1",
+  "ruff==0.16.3",
   "types-jsonschema==4.26.0.20260518",
   "types-PyYAML==6.0.12.20250915",
 ]

{github_security_report-0.12.0 → github_security_report-0.13.0}/src/github_security_report/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.12.0'
-__version_tuple__ = version_tuple = (0, 12, 0)
+__version__ = version = '0.13.0'
+__version_tuple__ = version_tuple = (0, 13, 0)
 
 __commit_id__ = commit_id = None

{github_security_report-0.12.0 → github_security_report-0.13.0}/src/github_security_report/categories.py

@@ -337,6 +337,33 @@ def category_meta(key: CategoryKey) -> CategoryMeta:
     return _CATEGORIES[key]
 
 
+# Categories rendered as sub-tables beneath another category rather than as
+# sections of their own. The three Dependabot posture tables qualify their
+# parent signal -- "Alerts Enabled" means nothing adrift from "Dependabot:
+# Security Alerts" -- so they travel with it and cannot be positioned
+# independently. Named here rather than in the layout module so the config
+# schema can refuse to accept one in an ordering list, which would otherwise be
+# a setting that validates and then does nothing.
+NESTED_CATEGORIES: frozenset[CategoryKey] = frozenset(
+    {
+        CategoryKey.DEPENDABOT_ALERTS_ENABLED,
+        CategoryKey.DEPENDABOT_UPDATES_ENABLED,
+        CategoryKey.DEPENDABOT_COOLDOWN,
+    }
+)
+
+
+def orderable_categories() -> tuple[CategoryMeta, ...]:
+    """Categories an ordering list may name, in registry order.
+
+    Every category except the nested ones, which have no position of their own
+    to configure.
+    """
+    return tuple(
+        meta for meta in _CATEGORIES.values() if meta.key not in NESTED_CATEGORIES
+    )
+
+
 def all_categories() -> tuple[CategoryMeta, ...]:
     """Every category's metadata, in registry (render) order."""
     return tuple(_CATEGORIES.values())

{github_security_report-0.12.0 → github_security_report-0.13.0}/src/github_security_report/cli/__init__.py

@@ -11,6 +11,8 @@ The command surface is split across:
 
 - :mod:`cli.app` -- the Typer application, options and validation
 - :mod:`cli.modes` -- the org, repo and remediate run modes
+- :mod:`cli.options` -- what a run takes from the command line
+- :mod:`cli.publish` -- the Pages files, Slack digest and job summary
 - :mod:`cli.outputs` -- offender limits, category visibility, file writing
 - :mod:`cli.serialise` -- the machine-readable ``report.json`` shape
 """
@@ -25,8 +27,6 @@ from github_security_report.cli.app import (
     report,
 )
 from github_security_report.cli.modes import (
-    OrgRunOptions,
-    ReleaseOverrides,
     _abort_auth,
     _abort_network,
     _load_config,
@@ -34,6 +34,7 @@ from github_security_report.cli.modes import (
     _run_remediate,
     _run_repo,
 )
+from github_security_report.cli.options import OrgRunOptions, ReportOverrides
 from github_security_report.cli.outputs import (
     TopNLimits,
     _safe_component,
@@ -42,12 +43,18 @@ from github_security_report.cli.outputs import (
 )
 from github_security_report.cli.serialise import _org_to_dict, _table_to_dict
 
-# The package façade: every name previously importable from
-# ``github_security_report.cli`` still is, including the private helpers the
-# tests reach for, so splitting the module changed no caller's import path.
+# The package façade: every name the module split moved is still importable
+# from ``github_security_report.cli``, including the private helpers the tests
+# reach for, so relocating a definition changes no caller's import path.
+#
+# ``ReleaseOverrides`` is the one deliberate exception. It gained the gating
+# and inclusion overrides and became ``ReportOverrides``, so it is a rename
+# rather than a move. No alias is kept: the old name now describes only a third
+# of what the class carries, and a façade entry that points somewhere
+# misleading is worse than an import error that says exactly what happened.
 __all__ = [
     "OrgRunOptions",
-    "ReleaseOverrides",
+    "ReportOverrides",
     "TopNLimits",
     "_abort_auth",
     "_abort_network",