github-security-report 0.17.0__tar.gz → 0.18.0__tar.gz

{github_security_report-0.17.0 → github_security_report-0.18.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: github-security-report
-Version: 0.17.0
+Version: 0.18.0
 Summary: Security and quality reporting across GitHub organisations
 Project-URL: Homepage, https://github.com/lfreleng-actions/github-security-report-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github-security-report-action
@@ -36,7 +36,7 @@ Requires-Dist: pytest-asyncio==1.4.0; extra == 'dev'
 Requires-Dist: pytest-cov==7.1.0; extra == 'dev'
 Requires-Dist: pytest==9.1.1; extra == 'dev'
 Requires-Dist: respx==0.23.1; extra == 'dev'
-Requires-Dist: ruff==0.16.8; extra == 'dev'
+Requires-Dist: ruff==0.16.9; extra == 'dev'
 Requires-Dist: syrupy==6.1.1; extra == 'dev'
 Requires-Dist: types-jsonschema==4.26.0.20260518; extra == 'dev'
 Requires-Dist: types-pyyaml==6.0.12.20250915; extra == 'dev'
@@ -345,6 +345,8 @@ environment-variable name, never embedded.
     "repo_min_age_days": 28,
     "release_max_age_days": 60,
     "codeql_stale_days": 30,
+    "issue_age_warn_days": 30,
+    "issue_age_error_days": 60,
     "graph_batch": 10,
     "order": { "style": "auto" }
   },
@@ -837,6 +839,38 @@ with HTTP 200 and this one field null, so affected repositories are reported as
 `❓ Unknown` rather than counted as having no open issues — an unreadable backlog
 is never presented as a clean one.
 
+#### Issue colours and age thresholds
+
+On the terminal the counts are coloured so the table reads at a glance: `Bug`
+and `Untriaged` **red**, `Docs` **green**. As in the Pull Requests table, only
+**non-zero** counts are coloured, so the eye lands on the rows with something
+in them. The colours follow the column **name** (case-insensitively), so they
+apply to a custom `issue_labels` that keeps a `Bug` or `Docs` column and simply
+do not appear for one that renames them.
+
+`Oldest` is coloured against two age thresholds, in days:
+
+```json
+{
+  "report": {
+    "issue_age_warn_days": 30,
+    "issue_age_error_days": 60
+  },
+  "organizations": [{ "name": "lfreleng-actions" }]
+}
+```
+
+- **Green** while the oldest open issue is at most `issue_age_warn_days`
+  (default `30`) old.
+- **Yellow** once it is older than `issue_age_warn_days`.
+- **Red** once it is older than `issue_age_error_days` (default `60`).
+
+An `unknown` age is never coloured. Either threshold may be set to `0` to
+switch that level off; with both off the column is left uncoloured.
+`issue_age_error_days` must be **strictly greater** than `issue_age_warn_days`
+(or `0`), otherwise the yellow level could never be reached, so it is rejected
+at load. Both are settable per organisation.
+
 ### Pull Requests
 
 The `pull_requests` category counts each repository's **open pull requests**,

{github_security_report-0.17.0 → github_security_report-0.18.0}/README.md

@@ -301,6 +301,8 @@ environment-variable name, never embedded.
     "repo_min_age_days": 28,
     "release_max_age_days": 60,
     "codeql_stale_days": 30,
+    "issue_age_warn_days": 30,
+    "issue_age_error_days": 60,
     "graph_batch": 10,
     "order": { "style": "auto" }
   },
@@ -793,6 +795,38 @@ with HTTP 200 and this one field null, so affected repositories are reported as
 `❓ Unknown` rather than counted as having no open issues — an unreadable backlog
 is never presented as a clean one.
 
+#### Issue colours and age thresholds
+
+On the terminal the counts are coloured so the table reads at a glance: `Bug`
+and `Untriaged` **red**, `Docs` **green**. As in the Pull Requests table, only
+**non-zero** counts are coloured, so the eye lands on the rows with something
+in them. The colours follow the column **name** (case-insensitively), so they
+apply to a custom `issue_labels` that keeps a `Bug` or `Docs` column and simply
+do not appear for one that renames them.
+
+`Oldest` is coloured against two age thresholds, in days:
+
+```json
+{
+  "report": {
+    "issue_age_warn_days": 30,
+    "issue_age_error_days": 60
+  },
+  "organizations": [{ "name": "lfreleng-actions" }]
+}
+```
+
+- **Green** while the oldest open issue is at most `issue_age_warn_days`
+  (default `30`) old.
+- **Yellow** once it is older than `issue_age_warn_days`.
+- **Red** once it is older than `issue_age_error_days` (default `60`).
+
+An `unknown` age is never coloured. Either threshold may be set to `0` to
+switch that level off; with both off the column is left uncoloured.
+`issue_age_error_days` must be **strictly greater** than `issue_age_warn_days`
+(or `0`), otherwise the yellow level could never be reached, so it is rejected
+at load. Both are settable per organisation.
+
 ### Pull Requests
 
 The `pull_requests` category counts each repository's **open pull requests**,

{github_security_report-0.17.0 → github_security_report-0.18.0}/pyproject.toml

@@ -65,7 +65,7 @@ dev = [
   "respx==0.23.1",
   "syrupy==6.1.1",
   "mypy==2.3.1",
-  "ruff==0.16.8",
+  "ruff==0.16.9",
   "types-jsonschema==4.26.0.20260518",
   "types-PyYAML==6.0.12.20250915",
 ]
@@ -97,7 +97,7 @@ dev = [
   "respx==0.23.1",
   "syrupy==6.1.1",
   "mypy==2.3.1",
-  "ruff==0.16.8",
+  "ruff==0.16.9",
   "types-jsonschema==4.26.0.20260518",
   "types-PyYAML==6.0.12.20250915",
 ]

{github_security_report-0.17.0 → github_security_report-0.18.0}/src/github_security_report/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.17.0'
-__version_tuple__ = version_tuple = (0, 17, 0)
+__version__ = version = '0.18.0'
+__version_tuple__ = version_tuple = (0, 18, 0)
 
 __commit_id__ = commit_id = None

{github_security_report-0.17.0 → github_security_report-0.18.0}/src/github_security_report/collect/extras.py

@@ -129,6 +129,8 @@ async def attach_extra_tables(
         in_scope,
         generated_at=report.generated_at,
         label_columns=report_cfg.issue_labels,
+        age_warn_days=report_cfg.issue_age_warn_days,
+        age_error_days=report_cfg.issue_age_error_days,
         members=members,
     )
     report.pull_requests = build_pull_requests_table(

{github_security_report-0.17.0 → github_security_report-0.18.0}/src/github_security_report/config/loader.py

@@ -167,6 +167,8 @@ def _report_from(data: dict, base: ReportConfig) -> ReportConfig:
                 "codeql_stale_days",
                 "dependabot_warn_threshold",
                 "dependabot_error_threshold",
+                "issue_age_warn_days",
+                "issue_age_error_days",
                 "gating",
                 "graph_batch",
             }
@@ -195,24 +197,33 @@ def _report_from(data: dict, base: ReportConfig) -> ReportConfig:
         result = replace(
             result, excluded_display=ExcludedDisplay(data["excluded_display"])
         )
-    if (
-        result.dependabot_error_threshold
-        and result.dependabot_error_threshold <= result.dependabot_warn_threshold
-    ):
-        # The error level is checked first and inclusively (``>= error``), so a
-        # warning threshold at or above it can never be reached: every value
-        # that would warn has already errored. Rejecting beats silently
-        # ignoring one of the two knobs the operator deliberately set. A zero
-        # error threshold is exempt -- that is the documented way to turn the
-        # error level off, leaving a warning-only configuration.
+    _require_reachable_warning(
+        result, "dependabot_warn_threshold", "dependabot_error_threshold"
+    )
+    _require_reachable_warning(result, "issue_age_warn_days", "issue_age_error_days")
+    return result
+
+
+def _require_reachable_warning(
+    report: ReportConfig, warn_name: str, error_name: str
+) -> None:
+    """Reject an error threshold that leaves its warning level unreachable.
+
+    The error level is checked first, so a warning threshold at or above it
+    can never be reached: every value that would warn has already errored.
+    Rejecting beats silently ignoring one of the two knobs the operator
+    deliberately set. A zero error threshold is exempt -- that is the
+    documented way to turn the error level off, leaving a warning-only
+    configuration.
+    """
+    warn = getattr(report, warn_name)
+    error = getattr(report, error_name)
+    if error and error <= warn:
         raise ConfigError(
-            "report.dependabot_error_threshold "
-            f"({result.dependabot_error_threshold}) must be greater than "
-            "report.dependabot_warn_threshold "
-            f"({result.dependabot_warn_threshold}), or 0 to disable the error "
-            "level; otherwise the warning level can never be reached"
+            f"report.{error_name} ({error}) must be greater than "
+            f"report.{warn_name} ({warn}), or 0 to disable the error level; "
+            "otherwise the warning level can never be reached"
         )
-    return result
 
 
 def _categories_from(

{github_security_report-0.17.0 → github_security_report-0.18.0}/src/github_security_report/config/models.py

@@ -178,6 +178,12 @@ class ReportConfig:
     # Error (red) at or above this many: GitHub's default open-pull-requests
     # limit, at which no further updates arrive for that ecosystem.
     dependabot_error_threshold: int = 5
+    # Age thresholds, in days, colouring the GitHub Issues table's Oldest
+    # column: green at or below the warn threshold, yellow once the oldest open
+    # issue is older than it, red once it is older than the error threshold.
+    # 0 switches that level off.
+    issue_age_warn_days: int = 30
+    issue_age_error_days: int = 60
     # Organisation feature gating for the workflow-driven signals (Scorecard,
     # zizmor, aislop): when true, each is collected only after a cheap check
     # finds organisation support (an org ruleset requiring the workflow,

{github_security_report-0.17.0 → github_security_report-0.18.0}/src/github_security_report/config/schema.py

@@ -147,6 +147,12 @@ CONFIG_SCHEMA: dict = {
                 # ecosystem while Auto counts every automation author.
                 "dependabot_warn_threshold": {"type": "integer", "minimum": 0},
                 "dependabot_error_threshold": {"type": "integer", "minimum": 0},
+                # Oldest-issue age thresholds colouring the GitHub Issues
+                # table's Oldest column: yellow once the oldest open issue is
+                # older than the first, red once older than the second
+                # (0 switches that level off).
+                "issue_age_warn_days": {"type": "integer", "minimum": 0},
+                "issue_age_error_days": {"type": "integer", "minimum": 0},
                 # Organisation feature gating: when true (the default) the
                 # workflow-driven signals (Scorecard, zizmor, aislop) are
                 # probed only after a cheap support check (org ruleset,

{github_security_report-0.17.0 → github_security_report-0.18.0}/src/github_security_report/issues.py

@@ -33,7 +33,13 @@ from collections.abc import Mapping, Set
 from github_security_report.authors import is_external_author
 from github_security_report.categories import CategoryKey, category_meta
 from github_security_report.models import IssueRef, Repo, RepoGraphData
-from github_security_report.report import TableRow, TableSection
+from github_security_report.report import (
+    CELL_BAD,
+    CELL_GOOD,
+    CELL_WARN,
+    TableRow,
+    TableSection,
+)
 
 # Columns appended after the configured label classes. ``Other`` is "labelled,
 # but not as anything we were asked about"; ``Untriaged`` is "not labelled at
@@ -68,6 +74,17 @@ TRUNCATED_MARKER = "+"
 # distinct from an absent backlog: the repository has open issues either way.
 UNKNOWN_AGE = "unknown"
 
+# Emphasis for the count columns, keyed case-insensitively by header so it
+# follows ``Bug`` and ``Docs`` into an ``issue_labels`` that keeps those names,
+# and simply does not apply to one that renames them. Untriaged is the triage
+# gap the table exists to surface, and Bug the class most likely to hurt a
+# user, so both are red; documentation work is a healthy backlog, so green.
+_COLUMN_LEVELS: Mapping[str, str] = {
+    "bug": CELL_BAD,
+    "docs": CELL_GOOD,
+    UNTRIAGED_COLUMN.casefold(): CELL_BAD,
+}
+
 
 def classify_issue(
     issue: IssueRef, label_columns: Mapping[str, tuple[str, ...]]
@@ -160,6 +177,43 @@ def _oldest_cell(age: int | None, truncated: bool) -> str:
     return f"{text} {TRUNCATED_MARKER}" if truncated else text
 
 
+def age_level(age: int | None, *, warn_days: int, error_days: int) -> str | None:
+    """Emphasis for an oldest open issue that is ``age`` days old.
+
+    Both thresholds read "older than": warning once the age exceeds
+    ``warn_days``, error once it exceeds ``error_days``, and good at or below
+    every active threshold. Either may be ``0`` to turn that level off, matching
+    the ``0 = no limit`` idiom used elsewhere; with both off the column is left
+    plain rather than painted uniformly green. An unknown age has nothing to
+    measure, so it is never coloured.
+    """
+    if age is None or not (warn_days or error_days):
+        return None
+    if error_days and age > error_days:
+        return CELL_BAD
+    if warn_days and age > warn_days:
+        return CELL_WARN
+    return CELL_GOOD
+
+
+def _cell_levels(
+    columns: tuple[str, ...],
+    counts: Mapping[str, int],
+    age: str | None,
+) -> tuple[str | None, ...]:
+    """Semantic emphasis for one row's cells, parallel to its columns.
+
+    Only *non-zero* counts are emphasised, as in the Pull Requests table: a
+    column of red zeros trains the reader to ignore the colour. Total and Ext
+    carry none -- Total sums classes that disagree about what good looks like.
+    """
+    counted = (
+        _COLUMN_LEVELS.get(column.casefold()) if counts[column] else None
+        for column in columns
+    )
+    return (*counted, None, None, age)
+
+
 def _describe(base: str, age_cells: list[str], members: Set[str] | None) -> str:
     """Extend the category description with the caveats the table earned.
 
@@ -198,6 +252,8 @@ def build_issues_table(
     *,
     generated_at: dt.datetime,
     label_columns: Mapping[str, tuple[str, ...]],
+    age_warn_days: int,
+    age_error_days: int,
     members: Set[str] | None = frozenset(),
 ) -> TableSection:
     """The GitHub Issues table, largest backlog first.
@@ -209,7 +265,8 @@ def build_issues_table(
     with equal backlogs surface the less-triaged one first.
 
     ``members`` is the organisation's membership, used to count the issues
-    raised from outside it (see :mod:`authors`).
+    raised from outside it (see :mod:`authors`). ``age_warn_days`` and
+    ``age_error_days`` colour the Oldest column (see :func:`age_level`).
     """
     columns = (*label_columns, OTHER_COLUMN, UNTRIAGED_COLUMN)
     rows: list[tuple[int, int, str, TableRow]] = []
@@ -266,7 +323,20 @@ def build_issues_table(
                 data.open_issues,
                 counts[UNTRIAGED_COLUMN],
                 repo.name,
-                TableRow(repo=repo, cells=cells, sort_values=sort_values),
+                TableRow(
+                    repo=repo,
+                    cells=cells,
+                    sort_values=sort_values,
+                    cell_levels=_cell_levels(
+                        columns,
+                        counts,
+                        age_level(
+                            oldest,
+                            warn_days=age_warn_days,
+                            error_days=age_error_days,
+                        ),
+                    ),
+                ),
             )
         )
     # Negated numerics so the whole sort runs ascending, keeping the name