github-security-report 0.22.0__tar.gz → 0.23.1__tar.gz

github_security_report-0.22.0/README.md → github_security_report-0.23.1/PKG-INFO

@@ -1,3 +1,47 @@
+Metadata-Version: 2.5
+Name: github-security-report
+Version: 0.23.1
+Summary: Security and quality reporting across GitHub organisations
+Project-URL: Homepage, https://github.com/lfreleng-actions/github-security-report-action
+Project-URL: Repository, https://github.com/lfreleng-actions/github-security-report-action
+Project-URL: Issues, https://github.com/lfreleng-actions/github-security-report-action/issues
+Author-email: The Linux Foundation <mwatkins@linuxfoundation.org>
+License-Expression: Apache-2.0
+License-File: LICENSE
+Keywords: codeql,dependabot,github,github-actions,linux-foundation,reporting,scorecard,secret-scanning,security,zizmor
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Requires-Dist: httpx[http2]==0.28.1
+Requires-Dist: jinja2==3.1.6
+Requires-Dist: jsonschema==4.26.0
+Requires-Dist: pyyaml==6.0.3
+Requires-Dist: rich==15.0.0
+Requires-Dist: typer==0.27.3
+Provides-Extra: dev
+Requires-Dist: mypy==2.4.0; extra == 'dev'
+Requires-Dist: pytest-asyncio==1.4.1; extra == 'dev'
+Requires-Dist: pytest-cov==7.1.0; extra == 'dev'
+Requires-Dist: pytest==9.1.1; extra == 'dev'
+Requires-Dist: respx==0.23.1; extra == 'dev'
+Requires-Dist: ruff==0.17.3; extra == 'dev'
+Requires-Dist: syrupy==6.1.1; extra == 'dev'
+Requires-Dist: types-jsonschema==4.26.0.20261006; extra == 'dev'
+Requires-Dist: types-pyyaml==6.0.12.20250915; extra == 'dev'
+Description-Content-Type: text/markdown
+
 <!--
 # SPDX-License-Identifier: Apache-2.0
 # SPDX-FileCopyrightText: 2026 The Linux Foundation
@@ -156,7 +200,8 @@ tables (org mode):
   enabled count out of the applicable count per language, such as
   `python 30/32 · go 5/5 · javascript-typescript 10/12`. See
   [ADR-0006](docs/adr/0006-github-code-quality.md); hide it with the
-  `code_quality` render toggle.
+  `code_quality` render toggle, or leave fixture repositories out of it alone
+  with its `exclude` patterns (see [Per-category exclusions](#per-category-exclusions)).
 - **Workflow Failures** — repositories whose GitHub Actions workflows failed
   in the window, ranked by failed runs. The motivating case is the bulk
   Dependabot merge whose integration tests need credentials, so they run
@@ -488,10 +533,11 @@ governs that line on every surface:
 
 Hiding the line changes nothing else: every count is unaffected, and the report
 header's repository count already leaves excluded repositories out. So a clean
-category reads `All Clean` once no Excluded line qualifies it. Today every
-category reports the organisation's own list, so `conditional-hide` currently
-hides the same lines `always-hide` does. It differs once a category excludes
-repositories of its own. The `report.json` artifact always lists the exclusions.
+category reads `All Clean` once no Excluded line qualifies it. Every category
+reports the organisation's own list unless it excludes repositories of its own
+(see [Per-category exclusions](#per-category-exclusions)), so with
+`conditional-hide` the line survives only beneath such a category. The
+`report.json` artifact always lists the exclusions.
 
 Archived and test repositories are excluded from analysis by default. Opt them
 back in with `report.include_archived` / `report.include_test` in the config, or
@@ -642,6 +688,40 @@ table with qualitative columns has no enabled list to name. These categories
 render as a name list rather than a one-column table on every surface. The
 `report.json` artifact is unaffected.
 
+### Per-category exclusions
+
+A category can leave repositories out that every other category still reports,
+with `report.categories.<key>.exclude`: a list of regular expressions searched
+against the repository name, case-insensitively, so `^test-` drops every
+repository whose name starts with `test-` and `^fixture$` drops exactly
+`fixture`. The motivating case is Code Quality, which is billed per committer:
+an organisation that reports its test repositories (`include_test`) still has
+no reason to pay for scanning them, and wants the section to list only the
+repositories worth switching on:
+
+```json
+{
+  "report": {
+    "include_test": true,
+    "categories": {
+      "code_quality": { "exclude": ["^test-"] }
+    }
+  },
+  "organizations": [{ "name": "lfreleng-actions" }]
+}
+```
+
+An excluded repository is neither a row nor a count in that category, and
+`remediate --category code_quality` never writes to it. It is not dropped
+silently: the category's **Excluded** footer line names it alongside the
+organisation's own `exclude` list, and `report.json` carries the category's full
+list under `category_excluded`. Under `excluded_display: conditional-hide` that
+footer line is exactly the one that stays. An organisation's own `exclude` list
+replaces the inherited one rather than adding to it, as every other
+`categories` key does; a pattern that does not compile is a configuration
+error. `exclude` applies to `code_quality` only; setting it on any other
+category is a configuration error, since no other table yet applies it.
+
 ### Per-category row ordering
 
 Each table ships a sensible default ordering — largest backlog first, stalest
@@ -2048,6 +2128,13 @@ cause:
 
 <!-- markdownlint-enable MD013 -->
 
+"Analyses failing" is reported only while the setup still exists and still
+runs. When the setup is gone or blocked (default setup off or no longer
+listing the language, workflow removed, superseded by default setup) that
+cause stands even if the newest attempt errored: default setup drops a
+language whose last run found no code for it, and that run uploads an error,
+but nothing can upload under the category again, so there is no run to fix.
+
 Deleting removes a configuration's analyses, which clears GitHub's *"Code
 Scanning results may be out of date"* warning but also removes its alert
 history. A deletion is therefore **refused**, in a dry run as in an apply,
@@ -2055,7 +2142,9 @@ when:
 
 - no current configuration scans its language: the stale results are then
   the only record of it, so add scanning for the language first (the refusal
-  names it, and **CodeQL: Language Coverage** lists the gap);
+  names it, and **CodeQL: Language Coverage** lists the gap). A language
+  default setup itself dropped is exempt: nothing lists it as a gap, so
+  nothing would ever call for scanning it again;
 - it would help close an open alert. This is judged across **every deletion
   planned in the repository**, not one at a time: an alert held by two stale
   configurations would close if both went, so both are refused, although

github_security_report-0.22.0/PKG-INFO → github_security_report-0.23.1/README.md

@@ -1,47 +1,3 @@
-Metadata-Version: 2.5
-Name: github-security-report
-Version: 0.22.0
-Summary: Security and quality reporting across GitHub organisations
-Project-URL: Homepage, https://github.com/lfreleng-actions/github-security-report-action
-Project-URL: Repository, https://github.com/lfreleng-actions/github-security-report-action
-Project-URL: Issues, https://github.com/lfreleng-actions/github-security-report-action/issues
-Author-email: The Linux Foundation <mwatkins@linuxfoundation.org>
-License-Expression: Apache-2.0
-License-File: LICENSE
-Keywords: codeql,dependabot,github,github-actions,linux-foundation,reporting,scorecard,secret-scanning,security,zizmor
-Classifier: Development Status :: 3 - Alpha
-Classifier: Intended Audience :: Developers
-Classifier: Operating System :: OS Independent
-Classifier: Programming Language :: Python
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3 :: Only
-Classifier: Programming Language :: Python :: 3.10
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Programming Language :: Python :: 3.13
-Classifier: Programming Language :: Python :: 3.14
-Classifier: Topic :: Security
-Classifier: Topic :: Software Development :: Quality Assurance
-Classifier: Typing :: Typed
-Requires-Python: >=3.10
-Requires-Dist: httpx[http2]==0.28.1
-Requires-Dist: jinja2==3.1.6
-Requires-Dist: jsonschema==4.26.0
-Requires-Dist: pyyaml==6.0.3
-Requires-Dist: rich==15.0.0
-Requires-Dist: typer==0.27.3
-Provides-Extra: dev
-Requires-Dist: mypy==2.4.0; extra == 'dev'
-Requires-Dist: pytest-asyncio==1.4.1; extra == 'dev'
-Requires-Dist: pytest-cov==7.1.0; extra == 'dev'
-Requires-Dist: pytest==9.1.1; extra == 'dev'
-Requires-Dist: respx==0.23.1; extra == 'dev'
-Requires-Dist: ruff==0.17.3; extra == 'dev'
-Requires-Dist: syrupy==6.1.1; extra == 'dev'
-Requires-Dist: types-jsonschema==4.26.0.20261006; extra == 'dev'
-Requires-Dist: types-pyyaml==6.0.12.20250915; extra == 'dev'
-Description-Content-Type: text/markdown
-
 <!--
 # SPDX-License-Identifier: Apache-2.0
 # SPDX-FileCopyrightText: 2026 The Linux Foundation
@@ -200,7 +156,8 @@ tables (org mode):
   enabled count out of the applicable count per language, such as
   `python 30/32 · go 5/5 · javascript-typescript 10/12`. See
   [ADR-0006](docs/adr/0006-github-code-quality.md); hide it with the
-  `code_quality` render toggle.
+  `code_quality` render toggle, or leave fixture repositories out of it alone
+  with its `exclude` patterns (see [Per-category exclusions](#per-category-exclusions)).
 - **Workflow Failures** — repositories whose GitHub Actions workflows failed
   in the window, ranked by failed runs. The motivating case is the bulk
   Dependabot merge whose integration tests need credentials, so they run
@@ -532,10 +489,11 @@ governs that line on every surface:
 
 Hiding the line changes nothing else: every count is unaffected, and the report
 header's repository count already leaves excluded repositories out. So a clean
-category reads `All Clean` once no Excluded line qualifies it. Today every
-category reports the organisation's own list, so `conditional-hide` currently
-hides the same lines `always-hide` does. It differs once a category excludes
-repositories of its own. The `report.json` artifact always lists the exclusions.
+category reads `All Clean` once no Excluded line qualifies it. Every category
+reports the organisation's own list unless it excludes repositories of its own
+(see [Per-category exclusions](#per-category-exclusions)), so with
+`conditional-hide` the line survives only beneath such a category. The
+`report.json` artifact always lists the exclusions.
 
 Archived and test repositories are excluded from analysis by default. Opt them
 back in with `report.include_archived` / `report.include_test` in the config, or
@@ -686,6 +644,40 @@ table with qualitative columns has no enabled list to name. These categories
 render as a name list rather than a one-column table on every surface. The
 `report.json` artifact is unaffected.
 
+### Per-category exclusions
+
+A category can leave repositories out that every other category still reports,
+with `report.categories.<key>.exclude`: a list of regular expressions searched
+against the repository name, case-insensitively, so `^test-` drops every
+repository whose name starts with `test-` and `^fixture$` drops exactly
+`fixture`. The motivating case is Code Quality, which is billed per committer:
+an organisation that reports its test repositories (`include_test`) still has
+no reason to pay for scanning them, and wants the section to list only the
+repositories worth switching on:
+
+```json
+{
+  "report": {
+    "include_test": true,
+    "categories": {
+      "code_quality": { "exclude": ["^test-"] }
+    }
+  },
+  "organizations": [{ "name": "lfreleng-actions" }]
+}
+```
+
+An excluded repository is neither a row nor a count in that category, and
+`remediate --category code_quality` never writes to it. It is not dropped
+silently: the category's **Excluded** footer line names it alongside the
+organisation's own `exclude` list, and `report.json` carries the category's full
+list under `category_excluded`. Under `excluded_display: conditional-hide` that
+footer line is exactly the one that stays. An organisation's own `exclude` list
+replaces the inherited one rather than adding to it, as every other
+`categories` key does; a pattern that does not compile is a configuration
+error. `exclude` applies to `code_quality` only; setting it on any other
+category is a configuration error, since no other table yet applies it.
+
 ### Per-category row ordering
 
 Each table ships a sensible default ordering — largest backlog first, stalest
@@ -2092,6 +2084,13 @@ cause:
 
 <!-- markdownlint-enable MD013 -->
 
+"Analyses failing" is reported only while the setup still exists and still
+runs. When the setup is gone or blocked (default setup off or no longer
+listing the language, workflow removed, superseded by default setup) that
+cause stands even if the newest attempt errored: default setup drops a
+language whose last run found no code for it, and that run uploads an error,
+but nothing can upload under the category again, so there is no run to fix.
+
 Deleting removes a configuration's analyses, which clears GitHub's *"Code
 Scanning results may be out of date"* warning but also removes its alert
 history. A deletion is therefore **refused**, in a dry run as in an apply,
@@ -2099,7 +2098,9 @@ when:
 
 - no current configuration scans its language: the stale results are then
   the only record of it, so add scanning for the language first (the refusal
-  names it, and **CodeQL: Language Coverage** lists the gap);
+  names it, and **CodeQL: Language Coverage** lists the gap). A language
+  default setup itself dropped is exempt: nothing lists it as a gap, so
+  nothing would ever call for scanning it again;
 - it would help close an open alert. This is judged across **every deletion
   planned in the repository**, not one at a time: an alert held by two stale
   configurations would close if both went, so both are refused, although

{github_security_report-0.22.0 → github_security_report-0.23.1}/pyproject.toml

@@ -14,7 +14,7 @@ authors = [
 ]
 license = "Apache-2.0"
 readme = "README.md"
-requires-python = ">=3.10"
+requires-python = ">=3.11"
 classifiers = [
   "Development Status :: 3 - Alpha",
   "Intended Audience :: Developers",
@@ -22,11 +22,11 @@ classifiers = [
   "Programming Language :: Python",
   "Programming Language :: Python :: 3",
   "Programming Language :: Python :: 3 :: Only",
-  "Programming Language :: Python :: 3.10",
   "Programming Language :: Python :: 3.11",
   "Programming Language :: Python :: 3.12",
   "Programming Language :: Python :: 3.13",
   "Programming Language :: Python :: 3.14",
+  "Programming Language :: Python :: 3.15",
   "Topic :: Software Development :: Quality Assurance",
   "Topic :: Security",
   "Typing :: Typed",
@@ -144,7 +144,7 @@ show_missing = true
 skip_empty = true
 
 [tool.mypy]
-python_version = "3.10"
+python_version = "3.11"
 # The whole first-party tree, so a bare 'mypy' checks what the pre-commit hook
 # checks. Tests are deliberately included: they are held to the same standard
 # as the package.
@@ -156,7 +156,7 @@ ignore_missing_imports = true
 exclude = ["src/github_security_report/_version.py"]
 
 [tool.basedpyright]
-pythonVersion = "3.10"
+pythonVersion = "3.11"
 pythonPlatform = "All"
 typeCheckingMode = "standard"
 exclude = ["src/github_security_report/_version.py"]
@@ -190,7 +190,7 @@ reportIndexIssue = false
 reportArgumentType = false
 
 [tool.ruff]
-target-version = "py310"
+target-version = "py311"
 line-length = 88
 exclude = ["src/github_security_report/_version.py"]
 
@@ -199,6 +199,7 @@ select = ["E", "W", "F", "I", "B", "C4", "UP", "SIM"]
 ignore = [
   "E501",  # line length handled by formatter
   "B008",  # function calls in argument defaults (Typer pattern)
+  "UP042",  # StrEnum changes str()/format() of members; keep (str, Enum)
 ]
 
 [tool.ruff.lint.per-file-ignores]

{github_security_report-0.22.0 → github_security_report-0.23.1}/src/github_security_report/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.22.0'
-__version_tuple__ = version_tuple = (0, 22, 0)
+__version__ = version = '0.23.1'
+__version_tuple__ = version_tuple = (0, 23, 1)
 
 __commit_id__ = commit_id = None

{github_security_report-0.22.0 → github_security_report-0.23.1}/src/github_security_report/categories/__init__.py

@@ -24,6 +24,7 @@ from github_security_report.categories.signals import SIGNAL_CATEGORIES
 from github_security_report.categories.tables import TABLE_CATEGORIES
 
 __all__ = [
+    "EXCLUDABLE_CATEGORIES",
     "NESTED_CATEGORIES",
     "REPO_LIST_CATEGORIES",
     "CategoryKey",
@@ -76,6 +77,15 @@ REPO_LIST_CATEGORIES: frozenset[CategoryKey] = frozenset(
 )
 
 
+# Categories that take an ``exclude`` list of their own, dropping repositories
+# from that one category while every other still reports them. A repository
+# excluded this way is counted on the category's Excluded footer line, so the
+# omission stays visible, and remediation never writes it. Only the categories
+# whose builders apply the list are named: the schema refuses it anywhere else,
+# where it would validate and then do nothing.
+EXCLUDABLE_CATEGORIES: frozenset[CategoryKey] = frozenset({CategoryKey.CODE_QUALITY})
+
+
 def orderable_categories() -> tuple[CategoryMeta, ...]:
     """Categories an ordering list may name, in registry order.
 

{github_security_report-0.22.0 → github_security_report-0.23.1}/src/github_security_report/cli/modes.py

@@ -214,7 +214,7 @@ async def _run_org(cfg: Config, options: OrgRunOptions, *, console: Console) ->
     summaries as the collections ended would have stacked them all above the
     first report.
     """
-    now = dt.datetime.now(dt.timezone.utc)
+    now = dt.datetime.now(dt.UTC)
     collected = await _collect_reports(cfg, console=console, now=now, options=options)
     if collected is None:
         return 2
@@ -285,7 +285,7 @@ async def _run_repo(
     if not token:
         console.print(f"[red]No token in ${token_env}[/red]")
         return 2
-    now = dt.datetime.now(dt.timezone.utc)
+    now = dt.datetime.now(dt.UTC)
     # One repository, so the live line has no counter to drive; the spinner
     # and the request counts still cover the probes and the run listing.
     tracker = make_tracker(console, no_progress=no_progress)

{github_security_report-0.22.0 → github_security_report-0.23.1}/src/github_security_report/cli/remediation.py

@@ -55,7 +55,7 @@ async def _run_remediate(
     auto-discovered config file, printed under each org's divider. Returns 2
     for a bad selection, 1 when any write failed, else 0.
     """
-    now = dt.datetime.now(dt.timezone.utc)
+    now = dt.datetime.now(dt.UTC)
     failures = 0
     # One live line per organisation, kept up through the writes too: the
     # paced CodeQL cleanup is otherwise a silent second per deletion.

{github_security_report-0.22.0 → github_security_report-0.23.1}/src/github_security_report/cli/serialise.py

@@ -83,6 +83,15 @@ def _org_to_dict(org: OrgReport, hidden: Collection[CategoryKey] = ()) -> dict:
         "partial": org.partial,
         # Repositories explicitly excluded from analysis (per-org exclude list).
         "excluded": [r.full_name for r in org.excluded_repos],
+        # Categories excluding repositories of their own (a category's
+        # `exclude` patterns), each with its full list: the organisation's
+        # exclusions above plus the category's. Absent categories report the
+        # organisation's list alone.
+        "category_excluded": {
+            key.value: [r.full_name for r in repos]
+            for key, repos in org.category_excluded.items()
+            if key not in suppressed
+        },
         # Every category below, in the order the rendered surfaces drew it.
         # The keyed structure that follows is stable regardless, but a consumer
         # building its own view can reproduce the published layout instead of

{github_security_report-0.22.0 → github_security_report-0.23.1}/src/github_security_report/client/failures.py

@@ -52,7 +52,7 @@ async def _endpoint_diagnostics(url: str) -> str:
         )
         ips = sorted({str(info[4][0]) for info in infos})
         addr = ", ".join(ips) if ips else "no addresses"
-    except asyncio.TimeoutError:
+    except TimeoutError:
         addr = "unresolved (timed out)"
     except OSError as exc:
         detail = exc.strerror or str(exc) or "resolution failed"

{github_security_report-0.22.0 → github_security_report-0.23.1}/src/github_security_report/client/parsers.py

@@ -65,8 +65,8 @@ def _parse_retry_after(value: str | None) -> float | None:
     if when is None:
         return None
     if when.tzinfo is None:
-        when = when.replace(tzinfo=dt.timezone.utc)
-    return max(0.0, (when - dt.datetime.now(dt.timezone.utc)).total_seconds())
+        when = when.replace(tzinfo=dt.UTC)
+    return max(0.0, (when - dt.datetime.now(dt.UTC)).total_seconds())
 
 
 def _next_page_url(resp: httpx.Response) -> str | None:

{github_security_report-0.22.0 → github_security_report-0.23.1}/src/github_security_report/codeql/cleanup.py

@@ -21,7 +21,10 @@ A deletion is *refused* while no current configuration scans its language.
 The stale results are then the only record of that language, and removing
 them would turn "scanned, but out of date" into "never scanned" without
 anything having improved. Add scanning for the language first; the refusal
-names it. Whether a deletion would close an open alert needs a network read,
+names it. The refusal does not apply when default setup itself dropped the
+language: its language list is the only inventory the report has, so nothing
+would ever call for scanning it again, and Language Coverage shows no gap to
+close. Whether a deletion would close an open alert needs a network read,
 so the remediator checks that separately before any write.
 """
 
@@ -148,8 +151,14 @@ def _plan_one(
         return CleanupItem(facts.repo, config, cause, CleanupAction.REENABLE_WORKFLOW)
     if not cause.orphaned:
         return None
+    # Default setup no longer lists a removed language, so no current
+    # configuration can scan it and none is expected to: the coverage
+    # refusal would ask for scanning that the setup has ruled out.
+    uncovered = cause is not StaleCause.LANGUAGE_REMOVED and (
+        config.language is None or config.language not in current
+    )
     refusal = None
-    if config.language is None or config.language not in current:
+    if uncovered:
         refusal = (
             f"no current configuration scans {config.language or 'its language'}; "
             "add scanning for it first"

{github_security_report-0.22.0 → github_security_report-0.23.1}/src/github_security_report/codeql/facts.py

@@ -94,7 +94,8 @@ class StaleCause(str, Enum):
     """
 
     # The setup still runs, but its newest attempt errored: never deleted,
-    # since fixing the run is what brings the scan back.
+    # since fixing the run is what brings the scan back. Yields to a cause
+    # whose setup is gone (see ``setup_gone``): there is no run to fix.
     ANALYSES_FAILING = "Analyses failing; check the latest run"
     DEFAULT_SETUP_DISABLED = "Default setup disabled; orphaned"
     LANGUAGE_REMOVED = "Language removed from default setup"
@@ -127,6 +128,21 @@ class StaleCause(str, Enum):
         """
         return self in _ORPHANED_CAUSES
 
+    @property
+    def setup_gone(self) -> bool:
+        """Whether the setup behind the configuration is gone or blocked.
+
+        Default setup off or no longer listing the language, the workflow
+        file removed, or advanced uploads rejected while default setup is on:
+        no attempt of any kind can follow, so an errored newest attempt is
+        the setup's last act, not a run anybody can fix, and this cause
+        outranks "analyses failing". The one orphaned cause left out is
+        superseded-within-workflow: that is inferred from a sibling's
+        activity, not the setup's own state, and a fresh errored attempt
+        under this category shows the workflow still uploads to it.
+        """
+        return self in _SETUP_GONE_CAUSES
+
     @property
     def reenable_workflow(self) -> bool:
         """Whether re-enabling the workflow is the fix, rather than deleting.
@@ -138,16 +154,16 @@ class StaleCause(str, Enum):
         return self is StaleCause.WORKFLOW_INACTIVE
 
 
-_ORPHANED_CAUSES = frozenset(
+_SETUP_GONE_CAUSES = frozenset(
     {
         StaleCause.DEFAULT_SETUP_DISABLED,
         StaleCause.LANGUAGE_REMOVED,
         StaleCause.WORKFLOW_REMOVED,
-        StaleCause.SUPERSEDED_IN_WORKFLOW,
         StaleCause.SUPERSEDED,
         StaleCause.SUPERSEDED_DISABLED,
     }
 )
+_ORPHANED_CAUSES = _SETUP_GONE_CAUSES | {StaleCause.SUPERSEDED_IN_WORKFLOW}
 
 
 @dataclass(frozen=True)
@@ -206,7 +222,7 @@ class CodeQLConfiguration:
 
 # Aware sentinel so a configuration that never succeeded sorts ahead of every
 # dated one, without comparing a naive and an aware value.
-_NEVER = dt.datetime.min.replace(tzinfo=dt.timezone.utc)
+_NEVER = dt.datetime.min.replace(tzinfo=dt.UTC)
 
 
 @dataclass(frozen=True)

{github_security_report-0.22.0 → github_security_report-0.23.1}/src/github_security_report/codeql/tables.py

@@ -135,16 +135,22 @@ def stale_cause(
 ) -> StaleCause:
     """Why a stale configuration stopped scanning, as far as the API can tell.
 
-    An errored newest attempt comes first: the setup still exists and still
-    runs, so whatever its state, the reader's next step is its failing logs.
-    ``stale_days`` is the threshold the configuration was found stale by,
-    which also decides whether another configuration is current.
+    An errored newest attempt is the cause while the setup still exists and
+    still runs: whatever its state, the reader's next step is its failing
+    logs. It is not the cause once the setup is gone or blocked. Default
+    setup drops a language whose last run found no code for it, and that
+    run uploads an error; reading the error as the cause would leave a
+    configuration that can never upload again waiting for a fix that cannot
+    come. ``stale_days`` is the threshold the configuration was found stale
+    by, which also decides whether another configuration is current.
     """
-    if config.failing:
-        return StaleCause.ANALYSES_FAILING
     if config.setup is SetupType.DEFAULT:
-        return _default_setup_cause(config, facts)
-    return _advanced_setup_cause(config, facts, stale_days)
+        cause = _default_setup_cause(config, facts)
+    else:
+        cause = _advanced_setup_cause(config, facts, stale_days)
+    if config.failing and not cause.setup_gone:
+        return StaleCause.ANALYSES_FAILING
+    return cause
 
 
 def build_stale_configurations_table(

{github_security_report-0.22.0 → github_security_report-0.23.1}/src/github_security_report/collect/extras.py

@@ -20,6 +20,7 @@ import asyncio
 import logging
 
 from github_security_report import codeql, layout, malware, posture
+from github_security_report.categories import CategoryKey
 from github_security_report.code_quality import CodeQualitySetup, applicable_languages
 from github_security_report.collect.codeql import collect_codeql_facts
 from github_security_report.collect.context import (
@@ -45,7 +46,7 @@ from github_security_report.pulls import (
     build_assigned_pull_requests_table,
     build_pull_requests_table,
 )
-from github_security_report.report import OrgReport
+from github_security_report.report import OrgReport, TableSection
 
 log = logging.getLogger(__name__)
 
@@ -122,6 +123,31 @@ async def _posture_for_repo(repo: Repo, ctx: OrgCollectContext) -> RepoPosture:
     )
 
 
+def _build_code_quality(
+    report: OrgReport, postures: list[RepoPosture], report_cfg: ReportConfig
+) -> tuple[TableSection, dict[str, tuple[str, ...]]]:
+    """The Code Quality table and its remediation plan, less the excluded.
+
+    A repository the category's own ``exclude`` patterns match is dropped
+    before the table is built, so it is neither a row nor a count nor a
+    remediation target, and is recorded as excluded for this category alone:
+    its footer then lists it alongside the organisation's own exclusions,
+    while every other category still reports the repository.
+    """
+    kept: list[RepoPosture] = []
+    dropped: list[Repo] = []
+    for p in postures:
+        if report_cfg.category_excludes(CategoryKey.CODE_QUALITY, p.repo.name):
+            dropped.append(p.repo)
+        else:
+            kept.append(p)
+    if dropped:
+        report.category_excluded[CategoryKey.CODE_QUALITY] = sorted(
+            (*report.excluded_repos, *dropped), key=lambda r: r.name
+        )
+    return posture.build_code_quality_table(kept), posture.code_quality_writes(kept)
+
+
 async def _attach_author_tables(
     report: OrgReport,
     in_scope: list[Repo],
@@ -251,8 +277,9 @@ async def attach_extra_tables(
         sweep_readable=ctx.sweep_status.get("dependabot") == 200,
         generated_at=report.generated_at,
     )
-    report.code_quality = posture.build_code_quality_table(postures)
-    report.code_quality_writes = posture.code_quality_writes(postures)
+    report.code_quality, report.code_quality_writes = _build_code_quality(
+        report, postures, report_cfg
+    )
     report.codeql_tables = codeql.build_codeql_tables(
         codeql_facts, stale_days=report_cfg.codeql_stale_days
     )

{github_security_report-0.22.0 → github_security_report-0.23.1}/src/github_security_report/collect/run_sync.py

@@ -89,7 +89,7 @@ class RepoRunSync:
 
 def _date(when: dt.datetime) -> str:
     """The calendar date GitHub's ``created`` filter takes."""
-    return when.astimezone(dt.timezone.utc).date().isoformat()
+    return when.astimezone(dt.UTC).date().isoformat()
 
 
 def _merge(