github-security-report 0.23.0__tar.gz → 0.23.1__tar.gz

{github_security_report-0.23.0 → github_security_report-0.23.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: github-security-report
-Version: 0.23.0
+Version: 0.23.1
 Summary: Security and quality reporting across GitHub organisations
 Project-URL: Homepage, https://github.com/lfreleng-actions/github-security-report-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github-security-report-action
@@ -15,15 +15,15 @@ Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3 :: Only
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
 Classifier: Topic :: Security
 Classifier: Topic :: Software Development :: Quality Assurance
 Classifier: Typing :: Typed
-Requires-Python: >=3.10
+Requires-Python: >=3.11
 Requires-Dist: httpx[http2]==0.28.1
 Requires-Dist: jinja2==3.1.6
 Requires-Dist: jsonschema==4.26.0
@@ -2128,6 +2128,13 @@ cause:
 
 <!-- markdownlint-enable MD013 -->
 
+"Analyses failing" is reported only while the setup still exists and still
+runs. When the setup is gone or blocked (default setup off or no longer
+listing the language, workflow removed, superseded by default setup) that
+cause stands even if the newest attempt errored: default setup drops a
+language whose last run found no code for it, and that run uploads an error,
+but nothing can upload under the category again, so there is no run to fix.
+
 Deleting removes a configuration's analyses, which clears GitHub's *"Code
 Scanning results may be out of date"* warning but also removes its alert
 history. A deletion is therefore **refused**, in a dry run as in an apply,
@@ -2135,7 +2142,9 @@ when:
 
 - no current configuration scans its language: the stale results are then
   the only record of it, so add scanning for the language first (the refusal
-  names it, and **CodeQL: Language Coverage** lists the gap);
+  names it, and **CodeQL: Language Coverage** lists the gap). A language
+  default setup itself dropped is exempt: nothing lists it as a gap, so
+  nothing would ever call for scanning it again;
 - it would help close an open alert. This is judged across **every deletion
   planned in the repository**, not one at a time: an alert held by two stale
   configurations would close if both went, so both are refused, although

{github_security_report-0.23.0 → github_security_report-0.23.1}/README.md

@@ -2084,6 +2084,13 @@ cause:
 
 <!-- markdownlint-enable MD013 -->
 
+"Analyses failing" is reported only while the setup still exists and still
+runs. When the setup is gone or blocked (default setup off or no longer
+listing the language, workflow removed, superseded by default setup) that
+cause stands even if the newest attempt errored: default setup drops a
+language whose last run found no code for it, and that run uploads an error,
+but nothing can upload under the category again, so there is no run to fix.
+
 Deleting removes a configuration's analyses, which clears GitHub's *"Code
 Scanning results may be out of date"* warning but also removes its alert
 history. A deletion is therefore **refused**, in a dry run as in an apply,
@@ -2091,7 +2098,9 @@ when:
 
 - no current configuration scans its language: the stale results are then
   the only record of it, so add scanning for the language first (the refusal
-  names it, and **CodeQL: Language Coverage** lists the gap);
+  names it, and **CodeQL: Language Coverage** lists the gap). A language
+  default setup itself dropped is exempt: nothing lists it as a gap, so
+  nothing would ever call for scanning it again;
 - it would help close an open alert. This is judged across **every deletion
   planned in the repository**, not one at a time: an alert held by two stale
   configurations would close if both went, so both are refused, although

{github_security_report-0.23.0 → github_security_report-0.23.1}/pyproject.toml

@@ -14,7 +14,7 @@ authors = [
 ]
 license = "Apache-2.0"
 readme = "README.md"
-requires-python = ">=3.10"
+requires-python = ">=3.11"
 classifiers = [
   "Development Status :: 3 - Alpha",
   "Intended Audience :: Developers",
@@ -22,11 +22,11 @@ classifiers = [
   "Programming Language :: Python",
   "Programming Language :: Python :: 3",
   "Programming Language :: Python :: 3 :: Only",
-  "Programming Language :: Python :: 3.10",
   "Programming Language :: Python :: 3.11",
   "Programming Language :: Python :: 3.12",
   "Programming Language :: Python :: 3.13",
   "Programming Language :: Python :: 3.14",
+  "Programming Language :: Python :: 3.15",
   "Topic :: Software Development :: Quality Assurance",
   "Topic :: Security",
   "Typing :: Typed",
@@ -144,7 +144,7 @@ show_missing = true
 skip_empty = true
 
 [tool.mypy]
-python_version = "3.10"
+python_version = "3.11"
 # The whole first-party tree, so a bare 'mypy' checks what the pre-commit hook
 # checks. Tests are deliberately included: they are held to the same standard
 # as the package.
@@ -156,7 +156,7 @@ ignore_missing_imports = true
 exclude = ["src/github_security_report/_version.py"]
 
 [tool.basedpyright]
-pythonVersion = "3.10"
+pythonVersion = "3.11"
 pythonPlatform = "All"
 typeCheckingMode = "standard"
 exclude = ["src/github_security_report/_version.py"]
@@ -190,7 +190,7 @@ reportIndexIssue = false
 reportArgumentType = false
 
 [tool.ruff]
-target-version = "py310"
+target-version = "py311"
 line-length = 88
 exclude = ["src/github_security_report/_version.py"]
 
@@ -199,6 +199,7 @@ select = ["E", "W", "F", "I", "B", "C4", "UP", "SIM"]
 ignore = [
   "E501",  # line length handled by formatter
   "B008",  # function calls in argument defaults (Typer pattern)
+  "UP042",  # StrEnum changes str()/format() of members; keep (str, Enum)
 ]
 
 [tool.ruff.lint.per-file-ignores]

{github_security_report-0.23.0 → github_security_report-0.23.1}/src/github_security_report/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.23.0'
-__version_tuple__ = version_tuple = (0, 23, 0)
+__version__ = version = '0.23.1'
+__version_tuple__ = version_tuple = (0, 23, 1)
 
 __commit_id__ = commit_id = None

{github_security_report-0.23.0 → github_security_report-0.23.1}/src/github_security_report/cli/modes.py

@@ -214,7 +214,7 @@ async def _run_org(cfg: Config, options: OrgRunOptions, *, console: Console) ->
     summaries as the collections ended would have stacked them all above the
     first report.
     """
-    now = dt.datetime.now(dt.timezone.utc)
+    now = dt.datetime.now(dt.UTC)
     collected = await _collect_reports(cfg, console=console, now=now, options=options)
     if collected is None:
         return 2
@@ -285,7 +285,7 @@ async def _run_repo(
     if not token:
         console.print(f"[red]No token in ${token_env}[/red]")
         return 2
-    now = dt.datetime.now(dt.timezone.utc)
+    now = dt.datetime.now(dt.UTC)
     # One repository, so the live line has no counter to drive; the spinner
     # and the request counts still cover the probes and the run listing.
     tracker = make_tracker(console, no_progress=no_progress)

{github_security_report-0.23.0 → github_security_report-0.23.1}/src/github_security_report/cli/remediation.py

@@ -55,7 +55,7 @@ async def _run_remediate(
     auto-discovered config file, printed under each org's divider. Returns 2
     for a bad selection, 1 when any write failed, else 0.
     """
-    now = dt.datetime.now(dt.timezone.utc)
+    now = dt.datetime.now(dt.UTC)
     failures = 0
     # One live line per organisation, kept up through the writes too: the
     # paced CodeQL cleanup is otherwise a silent second per deletion.

{github_security_report-0.23.0 → github_security_report-0.23.1}/src/github_security_report/client/failures.py

@@ -52,7 +52,7 @@ async def _endpoint_diagnostics(url: str) -> str:
         )
         ips = sorted({str(info[4][0]) for info in infos})
         addr = ", ".join(ips) if ips else "no addresses"
-    except asyncio.TimeoutError:
+    except TimeoutError:
         addr = "unresolved (timed out)"
     except OSError as exc:
         detail = exc.strerror or str(exc) or "resolution failed"

{github_security_report-0.23.0 → github_security_report-0.23.1}/src/github_security_report/client/parsers.py

@@ -65,8 +65,8 @@ def _parse_retry_after(value: str | None) -> float | None:
     if when is None:
         return None
     if when.tzinfo is None:
-        when = when.replace(tzinfo=dt.timezone.utc)
-    return max(0.0, (when - dt.datetime.now(dt.timezone.utc)).total_seconds())
+        when = when.replace(tzinfo=dt.UTC)
+    return max(0.0, (when - dt.datetime.now(dt.UTC)).total_seconds())
 
 
 def _next_page_url(resp: httpx.Response) -> str | None:

{github_security_report-0.23.0 → github_security_report-0.23.1}/src/github_security_report/codeql/cleanup.py

@@ -21,7 +21,10 @@ A deletion is *refused* while no current configuration scans its language.
 The stale results are then the only record of that language, and removing
 them would turn "scanned, but out of date" into "never scanned" without
 anything having improved. Add scanning for the language first; the refusal
-names it. Whether a deletion would close an open alert needs a network read,
+names it. The refusal does not apply when default setup itself dropped the
+language: its language list is the only inventory the report has, so nothing
+would ever call for scanning it again, and Language Coverage shows no gap to
+close. Whether a deletion would close an open alert needs a network read,
 so the remediator checks that separately before any write.
 """
 
@@ -148,8 +151,14 @@ def _plan_one(
         return CleanupItem(facts.repo, config, cause, CleanupAction.REENABLE_WORKFLOW)
     if not cause.orphaned:
         return None
+    # Default setup no longer lists a removed language, so no current
+    # configuration can scan it and none is expected to: the coverage
+    # refusal would ask for scanning that the setup has ruled out.
+    uncovered = cause is not StaleCause.LANGUAGE_REMOVED and (
+        config.language is None or config.language not in current
+    )
     refusal = None
-    if config.language is None or config.language not in current:
+    if uncovered:
         refusal = (
             f"no current configuration scans {config.language or 'its language'}; "
             "add scanning for it first"

{github_security_report-0.23.0 → github_security_report-0.23.1}/src/github_security_report/codeql/facts.py

@@ -94,7 +94,8 @@ class StaleCause(str, Enum):
     """
 
     # The setup still runs, but its newest attempt errored: never deleted,
-    # since fixing the run is what brings the scan back.
+    # since fixing the run is what brings the scan back. Yields to a cause
+    # whose setup is gone (see ``setup_gone``): there is no run to fix.
     ANALYSES_FAILING = "Analyses failing; check the latest run"
     DEFAULT_SETUP_DISABLED = "Default setup disabled; orphaned"
     LANGUAGE_REMOVED = "Language removed from default setup"
@@ -127,6 +128,21 @@ class StaleCause(str, Enum):
         """
         return self in _ORPHANED_CAUSES
 
+    @property
+    def setup_gone(self) -> bool:
+        """Whether the setup behind the configuration is gone or blocked.
+
+        Default setup off or no longer listing the language, the workflow
+        file removed, or advanced uploads rejected while default setup is on:
+        no attempt of any kind can follow, so an errored newest attempt is
+        the setup's last act, not a run anybody can fix, and this cause
+        outranks "analyses failing". The one orphaned cause left out is
+        superseded-within-workflow: that is inferred from a sibling's
+        activity, not the setup's own state, and a fresh errored attempt
+        under this category shows the workflow still uploads to it.
+        """
+        return self in _SETUP_GONE_CAUSES
+
     @property
     def reenable_workflow(self) -> bool:
         """Whether re-enabling the workflow is the fix, rather than deleting.
@@ -138,16 +154,16 @@ class StaleCause(str, Enum):
         return self is StaleCause.WORKFLOW_INACTIVE
 
 
-_ORPHANED_CAUSES = frozenset(
+_SETUP_GONE_CAUSES = frozenset(
     {
         StaleCause.DEFAULT_SETUP_DISABLED,
         StaleCause.LANGUAGE_REMOVED,
         StaleCause.WORKFLOW_REMOVED,
-        StaleCause.SUPERSEDED_IN_WORKFLOW,
         StaleCause.SUPERSEDED,
         StaleCause.SUPERSEDED_DISABLED,
     }
 )
+_ORPHANED_CAUSES = _SETUP_GONE_CAUSES | {StaleCause.SUPERSEDED_IN_WORKFLOW}
 
 
 @dataclass(frozen=True)
@@ -206,7 +222,7 @@ class CodeQLConfiguration:
 
 # Aware sentinel so a configuration that never succeeded sorts ahead of every
 # dated one, without comparing a naive and an aware value.
-_NEVER = dt.datetime.min.replace(tzinfo=dt.timezone.utc)
+_NEVER = dt.datetime.min.replace(tzinfo=dt.UTC)
 
 
 @dataclass(frozen=True)

{github_security_report-0.23.0 → github_security_report-0.23.1}/src/github_security_report/codeql/tables.py

@@ -135,16 +135,22 @@ def stale_cause(
 ) -> StaleCause:
     """Why a stale configuration stopped scanning, as far as the API can tell.
 
-    An errored newest attempt comes first: the setup still exists and still
-    runs, so whatever its state, the reader's next step is its failing logs.
-    ``stale_days`` is the threshold the configuration was found stale by,
-    which also decides whether another configuration is current.
+    An errored newest attempt is the cause while the setup still exists and
+    still runs: whatever its state, the reader's next step is its failing
+    logs. It is not the cause once the setup is gone or blocked. Default
+    setup drops a language whose last run found no code for it, and that
+    run uploads an error; reading the error as the cause would leave a
+    configuration that can never upload again waiting for a fix that cannot
+    come. ``stale_days`` is the threshold the configuration was found stale
+    by, which also decides whether another configuration is current.
     """
-    if config.failing:
-        return StaleCause.ANALYSES_FAILING
     if config.setup is SetupType.DEFAULT:
-        return _default_setup_cause(config, facts)
-    return _advanced_setup_cause(config, facts, stale_days)
+        cause = _default_setup_cause(config, facts)
+    else:
+        cause = _advanced_setup_cause(config, facts, stale_days)
+    if config.failing and not cause.setup_gone:
+        return StaleCause.ANALYSES_FAILING
+    return cause
 
 
 def build_stale_configurations_table(

{github_security_report-0.23.0 → github_security_report-0.23.1}/src/github_security_report/collect/run_sync.py

@@ -89,7 +89,7 @@ class RepoRunSync:
 
 def _date(when: dt.datetime) -> str:
     """The calendar date GitHub's ``created`` filter takes."""
-    return when.astimezone(dt.timezone.utc).date().isoformat()
+    return when.astimezone(dt.UTC).date().isoformat()
 
 
 def _merge(

{github_security_report-0.23.0 → github_security_report-0.23.1}/src/github_security_report/malware.py

@@ -72,7 +72,7 @@ def _age_days(value: object, now: dt.datetime) -> int | None:
     except ValueError:
         return None
     if when.tzinfo is None:
-        when = when.replace(tzinfo=dt.timezone.utc)
+        when = when.replace(tzinfo=dt.UTC)
     return max((now - when).days, 0)
 
 

{github_security_report-0.23.0 → github_security_report-0.23.1}/src/github_security_report/posture/releases.py

@@ -18,7 +18,7 @@ from github_security_report.report import TableRow, TableSection
 
 # Aware sentinel so releases lacking a publish timestamp sort oldest (last) when
 # ordering most-recent-first, without ever comparing a naive and aware value.
-_MIN_AWARE = dt.datetime.min.replace(tzinfo=dt.timezone.utc)
+_MIN_AWARE = dt.datetime.min.replace(tzinfo=dt.UTC)
 
 
 def _age_days(when: dt.datetime | None, now: dt.datetime) -> int | None:

{github_security_report-0.23.0 → github_security_report-0.23.1}/src/github_security_report/report/aggregate.py

@@ -225,7 +225,7 @@ def build_org_report(
     because organisation feature gating found no supporting workflows; such a
     section renders as a single skip line on every surface.
     """
-    when = generated_at or dt.datetime.now(dt.timezone.utc)
+    when = generated_at or dt.datetime.now(dt.UTC)
     by_signal: dict[SignalType, list[RepoSignal]] = {s: [] for s in SIGNAL_ORDER}
     for sig in repo_signals:
         by_signal.setdefault(sig.signal, []).append(sig)

{github_security_report-0.23.0 → github_security_report-0.23.1}/src/github_security_report/workflow_runs/store_codec.py

@@ -33,7 +33,7 @@ def _encode_datetime(value: dt.datetime) -> str:
     """
     if value.tzinfo is None or value.utcoffset() is None:
         raise ValueError(f"datetime {value!r} must be timezone-aware")
-    return value.astimezone(dt.timezone.utc).isoformat(timespec="microseconds")
+    return value.astimezone(dt.UTC).isoformat(timespec="microseconds")
 
 
 def _decode_datetime(text: str | None) -> dt.datetime | None: