github-security-report 0.21.1__tar.gz → 0.22.0__tar.gz

{github_security_report-0.21.1 → github_security_report-0.22.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: github-security-report
-Version: 0.21.1
+Version: 0.22.0
 Summary: Security and quality reporting across GitHub organisations
 Project-URL: Homepage, https://github.com/lfreleng-actions/github-security-report-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github-security-report-action
@@ -209,7 +209,9 @@ tables (org mode):
   pull request could have caught them. Each row gives **Failed** (runs that
   concluded `failure`, `startup_failure`, `timed_out` or `action_required`),
   **Runs** (every concluded run of every workflow in the repository),
-  **Fail %** (failed over failed *plus passed*, so skips never dilute it),
+  **Fail %** (failed over failed *plus passed*, so skips never dilute it;
+  on the terminal, red above `workflow_runs.fail_rate_error_threshold`, 5%
+  by default, and yellow for any lower non-zero rate),
   **Skipped** (skipped, cancelled, neutral and stale runs — a cancelled run
   reached no verdict, and a bulk-merge round cancels hundreds of superseded
   ones), **Retried** (runs that passed on a later attempt, a direct sign of
@@ -1618,6 +1620,7 @@ like every other `report` key. Every key with its default:
       "collapse_matrix": true,
       "persistent_threshold": 0.9,
       "min_runs": 3,
+      "fail_rate_error_threshold": 0.05,
       "cache": true
     }
   },
@@ -1659,6 +1662,13 @@ fewer than `min_runs` runs that reached a verdict *insufficient* to say. Both
 judge the same pass-or-fail population that Fail % does, so skips count
 towards neither.
 
+`fail_rate_error_threshold` colours the per-repository table's **Fail %**
+on the terminal: a repository failing more than that fraction of its
+pass-or-fail runs shows red, and any lower non-zero rate shows yellow.
+Markdown, HTML and Slack carry no cell colour, so the setting leaves them
+unchanged. It is independent of `persistent_threshold`, which judges
+single workflows.
+
 `cache` and `cache_dir` govern the **run store**, a SQLite file per
 organisation at
 

{github_security_report-0.21.1 → github_security_report-0.22.0}/README.md

@@ -165,7 +165,9 @@ tables (org mode):
   pull request could have caught them. Each row gives **Failed** (runs that
   concluded `failure`, `startup_failure`, `timed_out` or `action_required`),
   **Runs** (every concluded run of every workflow in the repository),
-  **Fail %** (failed over failed *plus passed*, so skips never dilute it),
+  **Fail %** (failed over failed *plus passed*, so skips never dilute it;
+  on the terminal, red above `workflow_runs.fail_rate_error_threshold`, 5%
+  by default, and yellow for any lower non-zero rate),
   **Skipped** (skipped, cancelled, neutral and stale runs — a cancelled run
   reached no verdict, and a bulk-merge round cancels hundreds of superseded
   ones), **Retried** (runs that passed on a later attempt, a direct sign of
@@ -1574,6 +1576,7 @@ like every other `report` key. Every key with its default:
       "collapse_matrix": true,
       "persistent_threshold": 0.9,
       "min_runs": 3,
+      "fail_rate_error_threshold": 0.05,
       "cache": true
     }
   },
@@ -1615,6 +1618,13 @@ fewer than `min_runs` runs that reached a verdict *insufficient* to say. Both
 judge the same pass-or-fail population that Fail % does, so skips count
 towards neither.
 
+`fail_rate_error_threshold` colours the per-repository table's **Fail %**
+on the terminal: a repository failing more than that fraction of its
+pass-or-fail runs shows red, and any lower non-zero rate shows yellow.
+Markdown, HTML and Slack carry no cell colour, so the setting leaves them
+unchanged. It is independent of `persistent_threshold`, which judges
+single workflows.
+
 `cache` and `cache_dir` govern the **run store**, a SQLite file per
 organisation at
 

{github_security_report-0.21.1 → github_security_report-0.22.0}/src/github_security_report/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.21.1'
-__version_tuple__ = version_tuple = (0, 21, 1)
+__version__ = version = '0.22.0'
+__version_tuple__ = version_tuple = (0, 22, 0)
 
 __commit_id__ = commit_id = None

{github_security_report-0.21.1 → github_security_report-0.22.0}/src/github_security_report/collect/workflow_runs.py

@@ -316,5 +316,6 @@ async def attach_workflow_failures(
             ),
             unknown=result.unknown,
             oldest=result.oldest,
+            fail_rate_error_threshold=cfg.fail_rate_error_threshold,
         )
     )

{github_security_report-0.21.1 → github_security_report-0.22.0}/src/github_security_report/config/blocks.py

@@ -178,6 +178,7 @@ def _workflow_runs_from(data: dict, base: WorkflowRunsConfig) -> WorkflowRunsCon
             "collapse_matrix",
             "persistent_threshold",
             "min_runs",
+            "fail_rate_error_threshold",
             "cache",
             "cache_dir",
         }

{github_security_report-0.21.1 → github_security_report-0.22.0}/src/github_security_report/config/models.py

@@ -188,6 +188,9 @@ class WorkflowRunsConfig:
     # intermittent. Fewer than ``min_runs`` concluded runs is too few to say.
     persistent_threshold: float = 0.9
     min_runs: int = 3
+    # A repository failing more than this share of its runs has its Fail %
+    # shown as an error; any lower non-zero rate is a warning.
+    fail_rate_error_threshold: float = 0.05
     cache: bool = True
     cache_dir: str | None = None
 

{github_security_report-0.21.1 → github_security_report-0.22.0}/src/github_security_report/config/schema.py

@@ -274,6 +274,11 @@ CONFIG_SCHEMA: dict = {
                             "maximum": 1,
                         },
                         "min_runs": {"type": "integer", "minimum": 1},
+                        "fail_rate_error_threshold": {
+                            "type": "number",
+                            "minimum": 0,
+                            "maximum": 1,
+                        },
                         "cache": {"type": "boolean"},
                         "cache_dir": {"type": "string", "minLength": 1},
                     },

{github_security_report-0.21.1 → github_security_report-0.22.0}/src/github_security_report/malware.py

@@ -29,8 +29,8 @@ _NUMERIC_COLUMNS = frozenset({4, 5})
 # A headline and its detail, split by a newline: each surface sets the detail
 # on a line of its own under the headline (see the summary renderers).
 COVERAGE_NOTE = (
-    "Malware alert enablement/status NOT currently available through APIs\n"
-    "Repositories without findings may have the feature off so coverage unknown"
+    "Enablement status of malware detection NOT currently available via APIs\n"
+    "Coverage unknown; repositories without findings may have the feature off"
 )
 
 

{github_security_report-0.21.1 → github_security_report-0.22.0}/src/github_security_report/workflow_runs/tables.py

@@ -84,8 +84,13 @@ def _percent(rate: float) -> str:
     return f"{round(rate * 100)}%"
 
 
+# The repository failure rate above which Fail % reads as an error.
+DEFAULT_FAIL_RATE_ERROR_THRESHOLD = 0.05
+
+
 def _rate_level(rate: float, threshold: float) -> str | None:
-    if rate >= threshold:
+    """Error strictly above ``threshold``, warning for any lower failure."""
+    if rate > threshold:
         return CELL_BAD
     return CELL_WARN if rate > 0 else None
 
@@ -256,6 +261,7 @@ def build_workflow_failure_tables(
     options: WindowOptions,
     unknown: frozenset[str] = frozenset(),
     oldest: Mapping[str, dt.datetime | None] | None = None,
+    fail_rate_error_threshold: float = DEFAULT_FAIL_RATE_ERROR_THRESHOLD,
 ) -> tuple[tuple[TableSection, ...], tuple[TableSection, ...]]:
     """Both tables for every window, shortest window first.
 
@@ -264,6 +270,9 @@ def build_workflow_failure_tables(
     as unreadable rather than as failure-free on every window; ``oldest``
     says how far back each repository's stored history reaches, so a window
     reaching further is noted as truncated in the footer.
+    ``fail_rate_error_threshold`` is the repository failure rate above which
+    the Fail % cell reads as an error rather than a warning; the persistent
+    threshold in ``options`` judges only the detail table's Pattern.
     """
     by_name = {repo.name: repo for repo in in_scope}
     held = list(records)
@@ -305,7 +314,7 @@ def build_workflow_failure_tables(
                 category=category_meta(CategoryKey.WORKFLOW_FAILURES),
                 columns=REPO_COLUMNS,
                 rows=[
-                    _repo_row(by_name[s.repo], s, options.persistent_threshold)
+                    _repo_row(by_name[s.repo], s, fail_rate_error_threshold)
                     for s in failing
                 ],
                 sum_columns=frozenset({1, 2, 4, 5, 6}),