github-security-report 0.21.0__tar.gz → 0.22.0__tar.gz

{github_security_report-0.21.0 → github_security_report-0.22.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: github-security-report
-Version: 0.21.0
+Version: 0.22.0
 Summary: Security and quality reporting across GitHub organisations
 Project-URL: Homepage, https://github.com/lfreleng-actions/github-security-report-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github-security-report-action
@@ -32,11 +32,11 @@ Requires-Dist: rich==15.0.0
 Requires-Dist: typer==0.27.3
 Provides-Extra: dev
 Requires-Dist: mypy==2.4.0; extra == 'dev'
-Requires-Dist: pytest-asyncio==1.4.0; extra == 'dev'
+Requires-Dist: pytest-asyncio==1.4.1; extra == 'dev'
 Requires-Dist: pytest-cov==7.1.0; extra == 'dev'
 Requires-Dist: pytest==9.1.1; extra == 'dev'
 Requires-Dist: respx==0.23.1; extra == 'dev'
-Requires-Dist: ruff==0.17.1; extra == 'dev'
+Requires-Dist: ruff==0.17.3; extra == 'dev'
 Requires-Dist: syrupy==6.1.1; extra == 'dev'
 Requires-Dist: types-jsonschema==4.26.0.20261006; extra == 'dev'
 Requires-Dist: types-pyyaml==6.0.12.20250915; extra == 'dev'
@@ -209,7 +209,9 @@ tables (org mode):
   pull request could have caught them. Each row gives **Failed** (runs that
   concluded `failure`, `startup_failure`, `timed_out` or `action_required`),
   **Runs** (every concluded run of every workflow in the repository),
-  **Fail %** (failed over failed *plus passed*, so skips never dilute it),
+  **Fail %** (failed over failed *plus passed*, so skips never dilute it;
+  on the terminal, red above `workflow_runs.fail_rate_error_threshold`, 5%
+  by default, and yellow for any lower non-zero rate),
   **Skipped** (skipped, cancelled, neutral and stale runs — a cancelled run
   reached no verdict, and a bulk-merge round cancels hundreds of superseded
   ones), **Retried** (runs that passed on a later attempt, a direct sign of
@@ -415,6 +417,18 @@ that only shape an organisation-wide run — `output_dir`, `pages_url`,
 misconfigured workflow says so instead of quietly producing a report that
 ignores them.
 
+### Runtime isolation
+
+The action installs its own uv-managed Python and runs the tool from an
+action-owned virtual environment with `python -I`, so interpreter settings an
+earlier step of the caller's job exports (`UV_PYTHON`, `VIRTUAL_ENV`,
+`CONDA_PREFIX`, `PYTHONPATH` and similar) cannot choose what runs.
+
+The action trusts the caller's `PATH`. The runner resolves `bash` for every
+`shell: bash` step on it, and setup-uv runs helpers such as `tar` from it, so
+no composite action can defend against a caller that has put a directory from
+its checkout on `PATH`.
+
 ## Configuration
 
 Configuration is JSON, supplied as a plain `vars.` entry or base64-encoded in a
@@ -1606,6 +1620,7 @@ like every other `report` key. Every key with its default:
       "collapse_matrix": true,
       "persistent_threshold": 0.9,
       "min_runs": 3,
+      "fail_rate_error_threshold": 0.05,
       "cache": true
     }
   },
@@ -1647,6 +1662,13 @@ fewer than `min_runs` runs that reached a verdict *insufficient* to say. Both
 judge the same pass-or-fail population that Fail % does, so skips count
 towards neither.
 
+`fail_rate_error_threshold` colours the per-repository table's **Fail %**
+on the terminal: a repository failing more than that fraction of its
+pass-or-fail runs shows red, and any lower non-zero rate shows yellow.
+Markdown, HTML and Slack carry no cell colour, so the setting leaves them
+unchanged. It is independent of `persistent_threshold`, which judges
+single workflows.
+
 `cache` and `cache_dir` govern the **run store**, a SQLite file per
 organisation at
 

{github_security_report-0.21.0 → github_security_report-0.22.0}/README.md

@@ -165,7 +165,9 @@ tables (org mode):
   pull request could have caught them. Each row gives **Failed** (runs that
   concluded `failure`, `startup_failure`, `timed_out` or `action_required`),
   **Runs** (every concluded run of every workflow in the repository),
-  **Fail %** (failed over failed *plus passed*, so skips never dilute it),
+  **Fail %** (failed over failed *plus passed*, so skips never dilute it;
+  on the terminal, red above `workflow_runs.fail_rate_error_threshold`, 5%
+  by default, and yellow for any lower non-zero rate),
   **Skipped** (skipped, cancelled, neutral and stale runs — a cancelled run
   reached no verdict, and a bulk-merge round cancels hundreds of superseded
   ones), **Retried** (runs that passed on a later attempt, a direct sign of
@@ -371,6 +373,18 @@ that only shape an organisation-wide run — `output_dir`, `pages_url`,
 misconfigured workflow says so instead of quietly producing a report that
 ignores them.
 
+### Runtime isolation
+
+The action installs its own uv-managed Python and runs the tool from an
+action-owned virtual environment with `python -I`, so interpreter settings an
+earlier step of the caller's job exports (`UV_PYTHON`, `VIRTUAL_ENV`,
+`CONDA_PREFIX`, `PYTHONPATH` and similar) cannot choose what runs.
+
+The action trusts the caller's `PATH`. The runner resolves `bash` for every
+`shell: bash` step on it, and setup-uv runs helpers such as `tar` from it, so
+no composite action can defend against a caller that has put a directory from
+its checkout on `PATH`.
+
 ## Configuration
 
 Configuration is JSON, supplied as a plain `vars.` entry or base64-encoded in a
@@ -1562,6 +1576,7 @@ like every other `report` key. Every key with its default:
       "collapse_matrix": true,
       "persistent_threshold": 0.9,
       "min_runs": 3,
+      "fail_rate_error_threshold": 0.05,
       "cache": true
     }
   },
@@ -1603,6 +1618,13 @@ fewer than `min_runs` runs that reached a verdict *insufficient* to say. Both
 judge the same pass-or-fail population that Fail % does, so skips count
 towards neither.
 
+`fail_rate_error_threshold` colours the per-repository table's **Fail %**
+on the terminal: a repository failing more than that fraction of its
+pass-or-fail runs shows red, and any lower non-zero rate shows yellow.
+Markdown, HTML and Slack carry no cell colour, so the setting leaves them
+unchanged. It is independent of `persistent_threshold`, which judges
+single workflows.
+
 `cache` and `cache_dir` govern the **run store**, a SQLite file per
 organisation at
 

{github_security_report-0.21.0 → github_security_report-0.22.0}/pyproject.toml

@@ -60,12 +60,12 @@ Issues = "https://github.com/lfreleng-actions/github-security-report-action/issu
 [project.optional-dependencies]
 dev = [
   "pytest==9.1.1",
-  "pytest-asyncio==1.4.0",
+  "pytest-asyncio==1.4.1",
   "pytest-cov==7.1.0",
   "respx==0.23.1",
   "syrupy==6.1.1",
   "mypy==2.4.0",
-  "ruff==0.17.1",
+  "ruff==0.17.3",
   "types-jsonschema==4.26.0.20261006",
   "types-PyYAML==6.0.12.20250915",
 ]
@@ -92,12 +92,12 @@ include = ["src", "README.md", "LICENSE*", "pyproject.toml"]
 [dependency-groups]
 dev = [
   "pytest==9.1.1",
-  "pytest-asyncio==1.4.0",
+  "pytest-asyncio==1.4.1",
   "pytest-cov==7.1.0",
   "respx==0.23.1",
   "syrupy==6.1.1",
   "mypy==2.4.0",
-  "ruff==0.17.1",
+  "ruff==0.17.3",
   "types-jsonschema==4.26.0.20261006",
   "types-PyYAML==6.0.12.20250915",
 ]

{github_security_report-0.21.0 → github_security_report-0.22.0}/src/github_security_report/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.21.0'
-__version_tuple__ = version_tuple = (0, 21, 0)
+__version__ = version = '0.22.0'
+__version_tuple__ = version_tuple = (0, 22, 0)
 
 __commit_id__ = commit_id = None

{github_security_report-0.21.0 → github_security_report-0.22.0}/src/github_security_report/collect/workflow_runs.py

@@ -316,5 +316,6 @@ async def attach_workflow_failures(
             ),
             unknown=result.unknown,
             oldest=result.oldest,
+            fail_rate_error_threshold=cfg.fail_rate_error_threshold,
         )
     )

{github_security_report-0.21.0 → github_security_report-0.22.0}/src/github_security_report/config/blocks.py

@@ -178,6 +178,7 @@ def _workflow_runs_from(data: dict, base: WorkflowRunsConfig) -> WorkflowRunsCon
             "collapse_matrix",
             "persistent_threshold",
             "min_runs",
+            "fail_rate_error_threshold",
             "cache",
             "cache_dir",
         }

{github_security_report-0.21.0 → github_security_report-0.22.0}/src/github_security_report/config/models.py

@@ -188,6 +188,9 @@ class WorkflowRunsConfig:
     # intermittent. Fewer than ``min_runs`` concluded runs is too few to say.
     persistent_threshold: float = 0.9
     min_runs: int = 3
+    # A repository failing more than this share of its runs has its Fail %
+    # shown as an error; any lower non-zero rate is a warning.
+    fail_rate_error_threshold: float = 0.05
     cache: bool = True
     cache_dir: str | None = None
 

{github_security_report-0.21.0 → github_security_report-0.22.0}/src/github_security_report/config/schema.py

@@ -274,6 +274,11 @@ CONFIG_SCHEMA: dict = {
                             "maximum": 1,
                         },
                         "min_runs": {"type": "integer", "minimum": 1},
+                        "fail_rate_error_threshold": {
+                            "type": "number",
+                            "minimum": 0,
+                            "maximum": 1,
+                        },
                         "cache": {"type": "boolean"},
                         "cache_dir": {"type": "string", "minLength": 1},
                     },

{github_security_report-0.21.0 → github_security_report-0.22.0}/src/github_security_report/malware.py

@@ -29,8 +29,8 @@ _NUMERIC_COLUMNS = frozenset({4, 5})
 # A headline and its detail, split by a newline: each surface sets the detail
 # on a line of its own under the headline (see the summary renderers).
 COVERAGE_NOTE = (
-    "Malware alert enablement/status NOT currently available through APIs\n"
-    "Repositories without findings may have the feature off so coverage unknown"
+    "Enablement status of malware detection NOT currently available via APIs\n"
+    "Coverage unknown; repositories without findings may have the feature off"
 )
 
 

{github_security_report-0.21.0 → github_security_report-0.22.0}/src/github_security_report/workflow_runs/tables.py

@@ -84,8 +84,13 @@ def _percent(rate: float) -> str:
     return f"{round(rate * 100)}%"
 
 
+# The repository failure rate above which Fail % reads as an error.
+DEFAULT_FAIL_RATE_ERROR_THRESHOLD = 0.05
+
+
 def _rate_level(rate: float, threshold: float) -> str | None:
-    if rate >= threshold:
+    """Error strictly above ``threshold``, warning for any lower failure."""
+    if rate > threshold:
         return CELL_BAD
     return CELL_WARN if rate > 0 else None
 
@@ -256,6 +261,7 @@ def build_workflow_failure_tables(
     options: WindowOptions,
     unknown: frozenset[str] = frozenset(),
     oldest: Mapping[str, dt.datetime | None] | None = None,
+    fail_rate_error_threshold: float = DEFAULT_FAIL_RATE_ERROR_THRESHOLD,
 ) -> tuple[tuple[TableSection, ...], tuple[TableSection, ...]]:
     """Both tables for every window, shortest window first.
 
@@ -264,6 +270,9 @@ def build_workflow_failure_tables(
     as unreadable rather than as failure-free on every window; ``oldest``
     says how far back each repository's stored history reaches, so a window
     reaching further is noted as truncated in the footer.
+    ``fail_rate_error_threshold`` is the repository failure rate above which
+    the Fail % cell reads as an error rather than a warning; the persistent
+    threshold in ``options`` judges only the detail table's Pattern.
     """
     by_name = {repo.name: repo for repo in in_scope}
     held = list(records)
@@ -305,7 +314,7 @@ def build_workflow_failure_tables(
                 category=category_meta(CategoryKey.WORKFLOW_FAILURES),
                 columns=REPO_COLUMNS,
                 rows=[
-                    _repo_row(by_name[s.repo], s, options.persistent_threshold)
+                    _repo_row(by_name[s.repo], s, fail_rate_error_threshold)
                     for s in failing
                 ],
                 sum_columns=frozenset({1, 2, 4, 5, 6}),