github-security-report 0.21.0__tar.gz → 0.21.1__tar.gz

{github_security_report-0.21.0 → github_security_report-0.21.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: github-security-report
-Version: 0.21.0
+Version: 0.21.1
 Summary: Security and quality reporting across GitHub organisations
 Project-URL: Homepage, https://github.com/lfreleng-actions/github-security-report-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github-security-report-action
@@ -32,11 +32,11 @@ Requires-Dist: rich==15.0.0
 Requires-Dist: typer==0.27.3
 Provides-Extra: dev
 Requires-Dist: mypy==2.4.0; extra == 'dev'
-Requires-Dist: pytest-asyncio==1.4.0; extra == 'dev'
+Requires-Dist: pytest-asyncio==1.4.1; extra == 'dev'
 Requires-Dist: pytest-cov==7.1.0; extra == 'dev'
 Requires-Dist: pytest==9.1.1; extra == 'dev'
 Requires-Dist: respx==0.23.1; extra == 'dev'
-Requires-Dist: ruff==0.17.1; extra == 'dev'
+Requires-Dist: ruff==0.17.3; extra == 'dev'
 Requires-Dist: syrupy==6.1.1; extra == 'dev'
 Requires-Dist: types-jsonschema==4.26.0.20261006; extra == 'dev'
 Requires-Dist: types-pyyaml==6.0.12.20250915; extra == 'dev'
@@ -415,6 +415,18 @@ that only shape an organisation-wide run — `output_dir`, `pages_url`,
 misconfigured workflow says so instead of quietly producing a report that
 ignores them.
 
+### Runtime isolation
+
+The action installs its own uv-managed Python and runs the tool from an
+action-owned virtual environment with `python -I`, so interpreter settings an
+earlier step of the caller's job exports (`UV_PYTHON`, `VIRTUAL_ENV`,
+`CONDA_PREFIX`, `PYTHONPATH` and similar) cannot choose what runs.
+
+The action trusts the caller's `PATH`. The runner resolves `bash` for every
+`shell: bash` step on it, and setup-uv runs helpers such as `tar` from it, so
+no composite action can defend against a caller that has put a directory from
+its checkout on `PATH`.
+
 ## Configuration
 
 Configuration is JSON, supplied as a plain `vars.` entry or base64-encoded in a

{github_security_report-0.21.0 → github_security_report-0.21.1}/README.md

@@ -371,6 +371,18 @@ that only shape an organisation-wide run — `output_dir`, `pages_url`,
 misconfigured workflow says so instead of quietly producing a report that
 ignores them.
 
+### Runtime isolation
+
+The action installs its own uv-managed Python and runs the tool from an
+action-owned virtual environment with `python -I`, so interpreter settings an
+earlier step of the caller's job exports (`UV_PYTHON`, `VIRTUAL_ENV`,
+`CONDA_PREFIX`, `PYTHONPATH` and similar) cannot choose what runs.
+
+The action trusts the caller's `PATH`. The runner resolves `bash` for every
+`shell: bash` step on it, and setup-uv runs helpers such as `tar` from it, so
+no composite action can defend against a caller that has put a directory from
+its checkout on `PATH`.
+
 ## Configuration
 
 Configuration is JSON, supplied as a plain `vars.` entry or base64-encoded in a

{github_security_report-0.21.0 → github_security_report-0.21.1}/pyproject.toml

@@ -60,12 +60,12 @@ Issues = "https://github.com/lfreleng-actions/github-security-report-action/issu
 [project.optional-dependencies]
 dev = [
   "pytest==9.1.1",
-  "pytest-asyncio==1.4.0",
+  "pytest-asyncio==1.4.1",
   "pytest-cov==7.1.0",
   "respx==0.23.1",
   "syrupy==6.1.1",
   "mypy==2.4.0",
-  "ruff==0.17.1",
+  "ruff==0.17.3",
   "types-jsonschema==4.26.0.20261006",
   "types-PyYAML==6.0.12.20250915",
 ]
@@ -92,12 +92,12 @@ include = ["src", "README.md", "LICENSE*", "pyproject.toml"]
 [dependency-groups]
 dev = [
   "pytest==9.1.1",
-  "pytest-asyncio==1.4.0",
+  "pytest-asyncio==1.4.1",
   "pytest-cov==7.1.0",
   "respx==0.23.1",
   "syrupy==6.1.1",
   "mypy==2.4.0",
-  "ruff==0.17.1",
+  "ruff==0.17.3",
   "types-jsonschema==4.26.0.20261006",
   "types-PyYAML==6.0.12.20250915",
 ]

{github_security_report-0.21.0 → github_security_report-0.21.1}/src/github_security_report/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.21.0'
-__version_tuple__ = version_tuple = (0, 21, 0)
+__version__ = version = '0.21.1'
+__version_tuple__ = version_tuple = (0, 21, 1)
 
 __commit_id__ = commit_id = None