github-security-report 0.18.1__tar.gz → 0.19.1__tar.gz

{github_security_report-0.18.1 → github_security_report-0.19.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: github-security-report
-Version: 0.18.1
+Version: 0.19.1
 Summary: Security and quality reporting across GitHub organisations
 Project-URL: Homepage, https://github.com/lfreleng-actions/github-security-report-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github-security-report-action
@@ -36,7 +36,7 @@ Requires-Dist: pytest-asyncio==1.4.0; extra == 'dev'
 Requires-Dist: pytest-cov==7.1.0; extra == 'dev'
 Requires-Dist: pytest==9.1.1; extra == 'dev'
 Requires-Dist: respx==0.23.1; extra == 'dev'
-Requires-Dist: ruff==0.17.0; extra == 'dev'
+Requires-Dist: ruff==0.17.1; extra == 'dev'
 Requires-Dist: syrupy==6.1.1; extra == 'dev'
 Requires-Dist: types-jsonschema==4.26.0.20261006; extra == 'dev'
 Requires-Dist: types-pyyaml==6.0.12.20250915; extra == 'dev'
@@ -76,7 +76,9 @@ states and rendered worst-first:
 
 Every category renders the same **standardised summary footer** beneath its
 table: remediation-first count lines (failures, disabled, unknown, then the
-healthy pass line, then excluded). The pass line reads **"All <state>"** when
+healthy pass line, then excluded). A category may add a note qualifying the
+pass line (Code Quality's per-language breakdown) and a **Not applicable**
+count, both shown on every surface. The pass line reads **"All <state>"** when
 nothing needs attention, or **"N <state>"** otherwise. The terminal and Slack
 stay brevity-first; the explanatory per-category description and documentation
 link are shown only on the richer Markdown and HTML (GitHub Pages) outputs.
@@ -154,6 +156,26 @@ tables (org mode):
   window a reviewed dependency update sits in while the vulnerability it fixes
   stays unpatched. Read from the batched GraphQL prefetch, so it costs no extra
   request; hide it with the `auto_merge` render toggle.
+- **Code Quality** — repositories where
+  [GitHub Code Quality](https://docs.github.com/en/code-security/concepts/code-quality/code-quality)
+  is **Disabled**, or **Partial**: configured, but without a language the
+  repository holds. Code Quality analyses six language families, so each
+  repository is first classified from its GitHub Linguist languages, read
+  from the batched GraphQL prefetch: Python (`python`), Go (`go`), Java and
+  Kotlin (`java-kotlin`), JavaScript and TypeScript
+  (`javascript-typescript`), Ruby (`ruby`) and C# (`csharp`). A repository
+  with none of them, such as one holding only shell scripts and workflow
+  files, is **Not applicable**: counted on a line of its own and never
+  reported as off. Only applicable repositories have their setup read, with
+  `GET /repos/{owner}/{repo}/code-quality/setup`; one whose setup or languages
+  cannot be read, or that holds more than the twenty languages the prefetch
+  reads, is counted as **Unreadable**, never as Disabled. The
+  **Missing** column names the languages each listed repository still needs,
+  and a footer line on every surface, the terminal included, gives the
+  enabled count out of the applicable count per language, such as
+  `python 30/32 · go 5/5 · javascript-typescript 10/12`. See
+  [ADR-0006](docs/adr/0006-github-code-quality.md); hide it with the
+  `code_quality` render toggle.
 
 The four enablement categories count the repositories with and without the
 feature (plus any whose state could not be read), and by default name whichever
@@ -192,7 +214,13 @@ signal is skipped and every other part of the report is unaffected, so the
 minimal tokens below omit it. Grant the org-admin permission only if you want
 ruleset-based tool coverage.
 
-A token without that permission gets a `404` from the endpoint, which the tool
+GitHub Code Quality is gated the same way: a fine-grained token needs
+repository Administration **write** to read a repository's Code Quality setup,
+even though the report only reads it. Without it every repository Code Quality
+applies to is reported as **Unreadable** in that one category; a classic PAT's
+`repo` scope already covers the read.
+
+A token without the org-admin permission gets a `404` from the endpoint, which the tool
 reports at **INFO** — so it is invisible unless you pass `--verbose`:
 
 ```text
@@ -212,7 +240,7 @@ A fine-grained PAT is bound to one resource owner, so it works for a report
 covering a **single** organisation. Create it with **Resource owner** set to the
 organisation and **Repository access** set to *All repositories*, then grant:
 
-**Repository permissions** (all Read-only):
+**Repository permissions** (Read-only unless noted):
 
 | Permission | Used for |
 | ---------- | -------- |
@@ -222,7 +250,7 @@ organisation and **Repository access** set to *All repositories*, then grant:
 | Code scanning alerts | CodeQL / Scorecard / zizmor / aislop findings |
 | Secret scanning alerts | Open secret-scanning alerts, across every GitHub pattern category |
 | Issues | Open issues and their labels (GitHub Issues table) |
-| Administration | Dependabot enablement + security-updates status, and effective branch rules |
+| Administration | Dependabot enablement + security-updates status, and effective branch rules. *Optional* **write** reads the Code Quality setup, which GitHub gates behind write |
 | Actions | Workflow state behind a stale CodeQL configuration |
 
 **Organization permissions:**
@@ -232,7 +260,7 @@ organisation and **Repository access** set to *All repositories*, then grant:
 | Administration | Read (write for rulesets) | *Optional*, and the only permission here with a write variant. **Read** keeps the token read-only and unlocks GitHub's secret-scanning pattern inventory (see below). **Write** additionally unlocks organisation rulesets (detecting tools enforced through an org ruleset), which GitHub gates behind Administration write. Omit the permission entirely to skip both; everything else is unaffected. |
 
 > Read-only is enough for everything except the optional ruleset coverage
-> above. A fine-grained token cannot span organisations. For a report covering
+> and the Code Quality setup read above. A fine-grained token cannot span organisations. For a report covering
 > more than one org, use a classic PAT (below).
 
 ### Multiple organisations — classic PAT
@@ -464,10 +492,11 @@ Pages output. The valid category keys are: `codeql`,
 `zizmor`, `aislop`, `dependabot_alerts`, `secret_scanning`,
 `dependabot_alerts_enabled`, `dependabot_updates_enabled`,
 `dependabot_cooldown`, `releases`, `mutable_releases`,
-`private_vulnerability_reporting`, `auto_merge`, `github_issues`,
-`pull_requests`, `pull_requests_assigned`. Like the other `report` settings,
-`categories` can be set globally and overridden per organisation (overrides
-merge key-by-key, so flipping one output leaves the rest untouched). The
+`private_vulnerability_reporting`, `auto_merge`, `code_quality`,
+`github_issues`, `pull_requests`, `pull_requests_assigned`. Like the other
+`report` settings, `categories` can be set globally and overridden per
+organisation (overrides merge key-by-key, so flipping one output leaves the
+rest untouched). The
 machine-readable `report.json` artifact always contains the complete dataset,
 regardless of these toggles.
 
@@ -1281,10 +1310,13 @@ see the relationship reports it), but one naming an outsider proves nothing,
 because that is exactly how a private member appears to an under-privileged
 token. Those authors are reported as indeterminate rather than external, so
 `Ext` **undercounts and should be read as a lower bound** — the table says so in
-its description whenever this happens, and the run logs a warning. Membership is
-never used partially: a failed page or an organisation beyond the pagination
-guard is treated as unreadable rather than as a member list with people missing
-from it, since every absent member would otherwise read as an outsider.
+its description whenever this happens, and the terminal report prints one
+warning line under each affected organisation's heading, naming the cause: a
+token without the membership permission, a token whose account is not a member,
+or a read that failed. Membership is never used partially: a failed page or an
+organisation beyond the pagination guard is treated as unreadable rather than as
+a member list with people missing from it, since every absent member would
+otherwise read as an outsider.
 
 **Automation is never counted as external.** Bots are outsiders by association —
 `dependabot[bot]` genuinely reports `CONTRIBUTOR` or `NONE` — so counting on
@@ -1297,8 +1329,9 @@ association value GitHub has newly introduced — is **not** counted as external
 The column understates rather than inventing an outsider.
 
 **Permissions.** Reading organisation membership needs `read:org` (classic) or
-**Members: read** (fine-grained). Without it the tool logs a warning and
-reports externally-raised counts as a lower bound rather than guessing from
+**Members: read** (fine-grained). Without it the terminal report prints
+`⚠️ Token lacks read/organisation permission; results incomplete for <org>`
+and reports externally-raised counts as a lower bound rather than guessing from
 `authorAssociation` alone.
 
 ### Organisation feature gating
@@ -1648,8 +1681,8 @@ the run, rather than falling back to every repository. The run then collects
 exactly the repositories that check validated, without listing the
 organisation again, and prints `Limited to:` beneath its heading.
 
-The remediable categories are the simple on/off features with a documented
-enablement endpoint:
+The remediable categories are the features with a documented enablement
+endpoint:
 
 | `--category` | Enables |
 |---|---|
@@ -1659,15 +1692,48 @@ enablement endpoint:
 | `dependabot_updates_enabled` | Dependabot security updates (plus alerts) |
 | `private_vulnerability_reporting` | Private vulnerability reporting |
 | `auto_merge` | The repository's "Allow auto-merge" setting |
+| `code_quality` | GitHub Code Quality, per language (named only; billed) |
+| `codeql_stale_configurations` | Stale CodeQL cleanup (named only; deletes) |
 
 Qualitative findings (Scorecard, zizmor, open Dependabot alerts, cooldown,
 release freshness/mutability) are reported but not auto-remediated. Remediation
 is organisation-scoped (`--scope org`, the default and only supported scope).
 
+The last two run **only when named** with `--category`, and the no-argument
+run never includes them: `code_quality`, because GitHub bills it,
+and `codeql_stale_configurations`, because it deletes data.
+
+### Enabling GitHub Code Quality
+
+GitHub Code Quality is billed per active committer and uses GitHub Actions
+minutes, so switching it on is a spending decision a routine run must not
+make:
+
+```bash
+# Preview: each repository with the languages it would get.
+uvx github-security-report remediate --org lfreleng-actions \
+  --category code_quality
+
+# Apply.
+uvx github-security-report remediate --org lfreleng-actions \
+  --category code_quality --apply
+```
+
+It acts on the rows of **Code Quality**, the Disabled and Partial
+repositories. Each one is configured for the union of the languages its
+setup already analyses and the ones its Linguist languages make applicable,
+so a write never drops a configured language; the dry run names them, as in
+`dependamerge (python, javascript-typescript)`. Not applicable and Unreadable
+repositories are never written. GitHub provisions the first analysis
+asynchronously. A `409` (an update already in progress), a `403` (an archived
+repository, or Code Quality not allowed for it) or a `422` fails that
+repository only and names the cause. The token needs the classic `repo`
+scope, or a fine-grained token's Administration: write. See
+[ADR-0006](docs/adr/0006-github-code-quality.md) for the reasoning.
+
 ### Cleaning up stale CodeQL configurations
 
-One category is **destructive**, so it runs only when named. The no-argument
-run never includes it:
+This category is **destructive**, so it runs only when named:
 
 ```bash
 # Preview: which configurations would go, and which are refused and why.

{github_security_report-0.18.1 → github_security_report-0.19.1}/README.md

@@ -32,7 +32,9 @@ states and rendered worst-first:
 
 Every category renders the same **standardised summary footer** beneath its
 table: remediation-first count lines (failures, disabled, unknown, then the
-healthy pass line, then excluded). The pass line reads **"All <state>"** when
+healthy pass line, then excluded). A category may add a note qualifying the
+pass line (Code Quality's per-language breakdown) and a **Not applicable**
+count, both shown on every surface. The pass line reads **"All <state>"** when
 nothing needs attention, or **"N <state>"** otherwise. The terminal and Slack
 stay brevity-first; the explanatory per-category description and documentation
 link are shown only on the richer Markdown and HTML (GitHub Pages) outputs.
@@ -110,6 +112,26 @@ tables (org mode):
   window a reviewed dependency update sits in while the vulnerability it fixes
   stays unpatched. Read from the batched GraphQL prefetch, so it costs no extra
   request; hide it with the `auto_merge` render toggle.
+- **Code Quality** — repositories where
+  [GitHub Code Quality](https://docs.github.com/en/code-security/concepts/code-quality/code-quality)
+  is **Disabled**, or **Partial**: configured, but without a language the
+  repository holds. Code Quality analyses six language families, so each
+  repository is first classified from its GitHub Linguist languages, read
+  from the batched GraphQL prefetch: Python (`python`), Go (`go`), Java and
+  Kotlin (`java-kotlin`), JavaScript and TypeScript
+  (`javascript-typescript`), Ruby (`ruby`) and C# (`csharp`). A repository
+  with none of them, such as one holding only shell scripts and workflow
+  files, is **Not applicable**: counted on a line of its own and never
+  reported as off. Only applicable repositories have their setup read, with
+  `GET /repos/{owner}/{repo}/code-quality/setup`; one whose setup or languages
+  cannot be read, or that holds more than the twenty languages the prefetch
+  reads, is counted as **Unreadable**, never as Disabled. The
+  **Missing** column names the languages each listed repository still needs,
+  and a footer line on every surface, the terminal included, gives the
+  enabled count out of the applicable count per language, such as
+  `python 30/32 · go 5/5 · javascript-typescript 10/12`. See
+  [ADR-0006](docs/adr/0006-github-code-quality.md); hide it with the
+  `code_quality` render toggle.
 
 The four enablement categories count the repositories with and without the
 feature (plus any whose state could not be read), and by default name whichever
@@ -148,7 +170,13 @@ signal is skipped and every other part of the report is unaffected, so the
 minimal tokens below omit it. Grant the org-admin permission only if you want
 ruleset-based tool coverage.
 
-A token without that permission gets a `404` from the endpoint, which the tool
+GitHub Code Quality is gated the same way: a fine-grained token needs
+repository Administration **write** to read a repository's Code Quality setup,
+even though the report only reads it. Without it every repository Code Quality
+applies to is reported as **Unreadable** in that one category; a classic PAT's
+`repo` scope already covers the read.
+
+A token without the org-admin permission gets a `404` from the endpoint, which the tool
 reports at **INFO** — so it is invisible unless you pass `--verbose`:
 
 ```text
@@ -168,7 +196,7 @@ A fine-grained PAT is bound to one resource owner, so it works for a report
 covering a **single** organisation. Create it with **Resource owner** set to the
 organisation and **Repository access** set to *All repositories*, then grant:
 
-**Repository permissions** (all Read-only):
+**Repository permissions** (Read-only unless noted):
 
 | Permission | Used for |
 | ---------- | -------- |
@@ -178,7 +206,7 @@ organisation and **Repository access** set to *All repositories*, then grant:
 | Code scanning alerts | CodeQL / Scorecard / zizmor / aislop findings |
 | Secret scanning alerts | Open secret-scanning alerts, across every GitHub pattern category |
 | Issues | Open issues and their labels (GitHub Issues table) |
-| Administration | Dependabot enablement + security-updates status, and effective branch rules |
+| Administration | Dependabot enablement + security-updates status, and effective branch rules. *Optional* **write** reads the Code Quality setup, which GitHub gates behind write |
 | Actions | Workflow state behind a stale CodeQL configuration |
 
 **Organization permissions:**
@@ -188,7 +216,7 @@ organisation and **Repository access** set to *All repositories*, then grant:
 | Administration | Read (write for rulesets) | *Optional*, and the only permission here with a write variant. **Read** keeps the token read-only and unlocks GitHub's secret-scanning pattern inventory (see below). **Write** additionally unlocks organisation rulesets (detecting tools enforced through an org ruleset), which GitHub gates behind Administration write. Omit the permission entirely to skip both; everything else is unaffected. |
 
 > Read-only is enough for everything except the optional ruleset coverage
-> above. A fine-grained token cannot span organisations. For a report covering
+> and the Code Quality setup read above. A fine-grained token cannot span organisations. For a report covering
 > more than one org, use a classic PAT (below).
 
 ### Multiple organisations — classic PAT
@@ -420,10 +448,11 @@ Pages output. The valid category keys are: `codeql`,
 `zizmor`, `aislop`, `dependabot_alerts`, `secret_scanning`,
 `dependabot_alerts_enabled`, `dependabot_updates_enabled`,
 `dependabot_cooldown`, `releases`, `mutable_releases`,
-`private_vulnerability_reporting`, `auto_merge`, `github_issues`,
-`pull_requests`, `pull_requests_assigned`. Like the other `report` settings,
-`categories` can be set globally and overridden per organisation (overrides
-merge key-by-key, so flipping one output leaves the rest untouched). The
+`private_vulnerability_reporting`, `auto_merge`, `code_quality`,
+`github_issues`, `pull_requests`, `pull_requests_assigned`. Like the other
+`report` settings, `categories` can be set globally and overridden per
+organisation (overrides merge key-by-key, so flipping one output leaves the
+rest untouched). The
 machine-readable `report.json` artifact always contains the complete dataset,
 regardless of these toggles.
 
@@ -1237,10 +1266,13 @@ see the relationship reports it), but one naming an outsider proves nothing,
 because that is exactly how a private member appears to an under-privileged
 token. Those authors are reported as indeterminate rather than external, so
 `Ext` **undercounts and should be read as a lower bound** — the table says so in
-its description whenever this happens, and the run logs a warning. Membership is
-never used partially: a failed page or an organisation beyond the pagination
-guard is treated as unreadable rather than as a member list with people missing
-from it, since every absent member would otherwise read as an outsider.
+its description whenever this happens, and the terminal report prints one
+warning line under each affected organisation's heading, naming the cause: a
+token without the membership permission, a token whose account is not a member,
+or a read that failed. Membership is never used partially: a failed page or an
+organisation beyond the pagination guard is treated as unreadable rather than as
+a member list with people missing from it, since every absent member would
+otherwise read as an outsider.
 
 **Automation is never counted as external.** Bots are outsiders by association —
 `dependabot[bot]` genuinely reports `CONTRIBUTOR` or `NONE` — so counting on
@@ -1253,8 +1285,9 @@ association value GitHub has newly introduced — is **not** counted as external
 The column understates rather than inventing an outsider.
 
 **Permissions.** Reading organisation membership needs `read:org` (classic) or
-**Members: read** (fine-grained). Without it the tool logs a warning and
-reports externally-raised counts as a lower bound rather than guessing from
+**Members: read** (fine-grained). Without it the terminal report prints
+`⚠️ Token lacks read/organisation permission; results incomplete for <org>`
+and reports externally-raised counts as a lower bound rather than guessing from
 `authorAssociation` alone.
 
 ### Organisation feature gating
@@ -1604,8 +1637,8 @@ the run, rather than falling back to every repository. The run then collects
 exactly the repositories that check validated, without listing the
 organisation again, and prints `Limited to:` beneath its heading.
 
-The remediable categories are the simple on/off features with a documented
-enablement endpoint:
+The remediable categories are the features with a documented enablement
+endpoint:
 
 | `--category` | Enables |
 |---|---|
@@ -1615,15 +1648,48 @@ enablement endpoint:
 | `dependabot_updates_enabled` | Dependabot security updates (plus alerts) |
 | `private_vulnerability_reporting` | Private vulnerability reporting |
 | `auto_merge` | The repository's "Allow auto-merge" setting |
+| `code_quality` | GitHub Code Quality, per language (named only; billed) |
+| `codeql_stale_configurations` | Stale CodeQL cleanup (named only; deletes) |
 
 Qualitative findings (Scorecard, zizmor, open Dependabot alerts, cooldown,
 release freshness/mutability) are reported but not auto-remediated. Remediation
 is organisation-scoped (`--scope org`, the default and only supported scope).
 
+The last two run **only when named** with `--category`, and the no-argument
+run never includes them: `code_quality`, because GitHub bills it,
+and `codeql_stale_configurations`, because it deletes data.
+
+### Enabling GitHub Code Quality
+
+GitHub Code Quality is billed per active committer and uses GitHub Actions
+minutes, so switching it on is a spending decision a routine run must not
+make:
+
+```bash
+# Preview: each repository with the languages it would get.
+uvx github-security-report remediate --org lfreleng-actions \
+  --category code_quality
+
+# Apply.
+uvx github-security-report remediate --org lfreleng-actions \
+  --category code_quality --apply
+```
+
+It acts on the rows of **Code Quality**, the Disabled and Partial
+repositories. Each one is configured for the union of the languages its
+setup already analyses and the ones its Linguist languages make applicable,
+so a write never drops a configured language; the dry run names them, as in
+`dependamerge (python, javascript-typescript)`. Not applicable and Unreadable
+repositories are never written. GitHub provisions the first analysis
+asynchronously. A `409` (an update already in progress), a `403` (an archived
+repository, or Code Quality not allowed for it) or a `422` fails that
+repository only and names the cause. The token needs the classic `repo`
+scope, or a fine-grained token's Administration: write. See
+[ADR-0006](docs/adr/0006-github-code-quality.md) for the reasoning.
+
 ### Cleaning up stale CodeQL configurations
 
-One category is **destructive**, so it runs only when named. The no-argument
-run never includes it:
+This category is **destructive**, so it runs only when named:
 
 ```bash
 # Preview: which configurations would go, and which are refused and why.

{github_security_report-0.18.1 → github_security_report-0.19.1}/pyproject.toml

@@ -65,7 +65,7 @@ dev = [
   "respx==0.23.1",
   "syrupy==6.1.1",
   "mypy==2.4.0",
-  "ruff==0.17.0",
+  "ruff==0.17.1",
   "types-jsonschema==4.26.0.20261006",
   "types-PyYAML==6.0.12.20250915",
 ]
@@ -97,7 +97,7 @@ dev = [
   "respx==0.23.1",
   "syrupy==6.1.1",
   "mypy==2.4.0",
-  "ruff==0.17.0",
+  "ruff==0.17.1",
   "types-jsonschema==4.26.0.20261006",
   "types-PyYAML==6.0.12.20250915",
 ]

{github_security_report-0.18.1 → github_security_report-0.19.1}/src/github_security_report/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.18.1'
-__version_tuple__ = version_tuple = (0, 18, 1)
+__version__ = version = '0.19.1'
+__version_tuple__ = version_tuple = (0, 19, 1)
 
 __commit_id__ = commit_id = None

{github_security_report-0.18.1 → github_security_report-0.19.1}/src/github_security_report/authors.py

@@ -32,7 +32,9 @@ contributors. Automation is reported in its own column instead.
 
 from __future__ import annotations
 
+import enum
 from collections.abc import Set
+from dataclasses import dataclass
 
 # --------------------------------------------------------------------------- #
 # Automation authors
@@ -218,3 +220,32 @@ def normalise_members(logins: object) -> frozenset[str]:
         for login in logins
         if isinstance(login, str) and (normalised := normalise_login(login))
     )
+
+
+class MembershipGap(enum.Enum):
+    """Why organisation membership could not be read in full.
+
+    Each names a different fix, so the run reports which one applies rather
+    than folding them into one "could not be read".
+    """
+
+    # The token lacks the organisation-membership permission (classic
+    # ``read:org``, fine-grained Members: read).
+    PERMISSION = "permission"
+    # The token's account is outside the organisation, so GitHub served only
+    # its public members.
+    NOT_MEMBER = "not_member"
+    # Anything else: a failed page, a malformed response, the page limit.
+    UNREADABLE = "unreadable"
+
+
+@dataclass(frozen=True)
+class OrgMembership:
+    """An organisation membership read: the members, or why there are none.
+
+    Exactly one of the two is set. ``members`` of ``None`` carries the meaning
+    :func:`is_external_author` gives it, and ``gap`` says why.
+    """
+
+    members: frozenset[str] | None
+    gap: MembershipGap | None = None

{github_security_report-0.18.1 → github_security_report-0.19.1}/src/github_security_report/categories/keys.py

@@ -34,6 +34,7 @@ class CategoryKey(str, Enum):
     MUTABLE_RELEASES = "mutable_releases"
     PRIVATE_VULNERABILITY_REPORTING = "private_vulnerability_reporting"
     AUTO_MERGE = "auto_merge"
+    CODE_QUALITY = "code_quality"
     GITHUB_ISSUES = "github_issues"
     PULL_REQUESTS = "pull_requests"
     PULL_REQUESTS_ASSIGNED = "pull_requests_assigned"
@@ -66,6 +67,9 @@ class CategoryMeta:
     # Alternative pass wording for the collapsed "All <label>" footer line,
     # when the counted wording would not read grammatically after "All".
     pass_all_label: str | None = None
+    # Wording for the footer's unknown line, for a category whose unknowns have
+    # one specific cause worth naming.
+    unknown_label: str = "Unknown"
     # The lowest finding severity that counts as a failure for this category.
     # A repository fails (appears as an offender) only when it carries a finding
     # at or above this rung; findings below it fold into the clean count. The

{github_security_report-0.18.1 → github_security_report-0.19.1}/src/github_security_report/categories/tables.py

@@ -170,6 +170,27 @@ TABLE_CATEGORIES: dict[CategoryKey, CategoryMeta] = {
             "vulnerability it fixes stays unpatched."
         ),
     ),
+    CategoryKey.CODE_QUALITY: CategoryMeta(
+        key=CategoryKey.CODE_QUALITY,
+        title="Code Quality",
+        pass_label="Enabled",
+        fail_label="Disabled or partial",
+        unknown_label="Unreadable",
+        url=(
+            "https://docs.github.com/en/code-security/concepts/code-quality/"
+            "code-quality"
+        ),
+        description=(
+            "Repositories holding a language GitHub Code Quality analyses "
+            "(python, go, java-kotlin, javascript-typescript, ruby, csharp, as "
+            "GitHub's Linguist classifies them) where Code Quality is off "
+            "(Disabled) or configured without one of those languages "
+            "(Partial). Missing names the languages to add. A repository with "
+            "none of them -- shell scripts and workflow files alone, say -- is "
+            "Not applicable and never counted as off. Unreadable counts the "
+            "repositories whose setup, or whose languages, could not be read."
+        ),
+    ),
     CategoryKey.GITHUB_ISSUES: CategoryMeta(
         key=CategoryKey.GITHUB_ISSUES,
         title="GitHub Issues",

{github_security_report-0.18.1 → github_security_report-0.19.1}/src/github_security_report/cli/app.py

@@ -199,7 +199,7 @@ def report(
     )
     hidden = boundary.resolve_hidden(console, hide)
 
-    cfg = _load_config(config_file, config_data, org, token_env, console=console)
+    cfg, config_path = _load_config(config_file, config_data, org, token_env)
     detected = boundary.detect_target(console, repo, scope)
     mode = boundary.resolve_mode(console, scope, cfg=cfg, detected=detected)
 
@@ -230,6 +230,7 @@ def report(
                 concurrency=concurrency,
             ),
             hidden=hidden,
+            config_path=config_path,
         )
         code = boundary.run_guarded(console, _run_org(cfg, options, console=console))
     else:
@@ -271,6 +272,7 @@ def report(
                 report_cfg=cfg.report if cfg is not None else None,
                 limits=TopNLimits(shared=top_n, report=top_n_report, cli=top_n_cli),
                 hidden=hidden,
+                config_path=config_path,
             ),
         )
     raise typer.Exit(code)
@@ -301,7 +303,7 @@ def remediate(
     category: list[str] | None = typer.Option(
         None,
         "--category",
-        help=f"Remediable category to act on (repeatable; default: all except the destructive {_EXPLICIT_HELP}, which run only when named). One of: {_REMEDIABLE_HELP}.",
+        help=f"Remediable category to act on (repeatable; default: all except the explicit-only {_EXPLICIT_HELP}, which delete data or incur charges and run only when named). One of: {_REMEDIABLE_HELP}.",
     ),
     token_env: str | None = typer.Option(
         None,
@@ -325,9 +327,9 @@ def remediate(
     Runs the same collection the report uses, then switches on each selected
     remediable feature wherever a repository has it confirmed off. Named
     explicitly, codeql_stale_configurations also deletes orphaned CodeQL
-    configurations. Dry run by default: pass --apply to make changes. Requires
-    a write-capable token (org admin), distinct from the read-only reporting
-    PAT.
+    configurations, and code_quality enables billed GitHub Code Quality. Dry
+    run by default: pass --apply to make changes. Requires a write-capable
+    token (org admin), distinct from the read-only reporting PAT.
     """
     console = _console(no_color)
 
@@ -363,7 +365,7 @@ def remediate(
         )
         raise typer.Exit(2)
 
-    cfg = _load_config(config_file, config_data, org, token_env, console=console)
+    cfg, config_path = _load_config(config_file, config_data, org, token_env)
     if cfg is None:
         console.print(
             "[red]No configuration: provide --config, --config-data or --org.[/red]"
@@ -390,6 +392,7 @@ def remediate(
             categories=categories,
             apply=apply,
             repos=selection,
+            config_path=config_path,
         ),
     )
     raise typer.Exit(code)