github-security-report 0.3.0__tar.gz → 0.4.0__tar.gz

{github_security_report-0.3.0 → github_security_report-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: github-security-report
-Version: 0.3.0
+Version: 0.4.0
 Summary: Security and quality reporting across GitHub organisations
 Project-URL: Homepage, https://github.com/lfreleng-actions/github-security-report-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github-security-report-action
@@ -390,7 +390,7 @@ and the Slack **bot token** is consumed by the workflow, not the CLI.
 | `top_n_slack` | No | — | Offenders per signal in the Slack digest (`0` = no limit; overrides `top_n`) |
 | `fail_threshold` | No | `none` | `none`/`low`/`medium`/`high`/`critical`/`any` (repo mode) |
 | `force_notify` | No | `false` | Post to Slack regardless of `report_day` |
-| `tool_version` | No | `0.1.0` | Published PyPI version (ignored on pull requests) |
+| `tool_version` | No | `""` | Published PyPI version to install. Empty (the default) uses the Dependabot-managed pin in `.github/runtime-pin/requirements.txt`; set a specific version to override. Ignored on pull requests or when `use_local_source` is `true` (both run from source) |
 | `use_local_source` | No | `false` | Run from the checked-out source instead of PyPI (for testing unreleased code from any event) |
 
 <!-- markdownlint-enable MD013 -->

{github_security_report-0.3.0 → github_security_report-0.4.0}/README.md

@@ -346,7 +346,7 @@ and the Slack **bot token** is consumed by the workflow, not the CLI.
 | `top_n_slack` | No | — | Offenders per signal in the Slack digest (`0` = no limit; overrides `top_n`) |
 | `fail_threshold` | No | `none` | `none`/`low`/`medium`/`high`/`critical`/`any` (repo mode) |
 | `force_notify` | No | `false` | Post to Slack regardless of `report_day` |
-| `tool_version` | No | `0.1.0` | Published PyPI version (ignored on pull requests) |
+| `tool_version` | No | `""` | Published PyPI version to install. Empty (the default) uses the Dependabot-managed pin in `.github/runtime-pin/requirements.txt`; set a specific version to override. Ignored on pull requests or when `use_local_source` is `true` (both run from source) |
 | `use_local_source` | No | `false` | Run from the checked-out source instead of PyPI (for testing unreleased code from any event) |
 
 <!-- markdownlint-enable MD013 -->

{github_security_report-0.3.0 → github_security_report-0.4.0}/src/github_security_report/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.3.0'
-__version_tuple__ = version_tuple = (0, 3, 0)
+__version__ = version = '0.4.0'
+__version_tuple__ = version_tuple = (0, 4, 0)
 
 __commit_id__ = commit_id = None

{github_security_report-0.3.0 → github_security_report-0.4.0}/src/github_security_report/cli.py

@@ -114,6 +114,7 @@ def _org_to_dict(org: OrgReport) -> dict:
                             "high": rs.counts.high,
                             "medium": rs.counts.medium,
                             "low": rs.counts.low,
+                            "informational": rs.counts.informational,
                             "total": rs.counts.total,
                         },
                         "score": rs.score,

{github_security_report-0.3.0 → github_security_report-0.4.0}/src/github_security_report/render/html.py

@@ -26,6 +26,7 @@ from github_security_report.report import (
     SummaryLine,
     TableSection,
     build_summary,
+    section_shows_informational,
     truncate,
 )
 
@@ -64,9 +65,9 @@ def slugify(org: str) -> str:
     return slug or "org"
 
 
-def _row_cells(sig: RepoSignal) -> list[str]:
+def _row_cells(sig: RepoSignal, *, informational: bool = False) -> list[str]:
     # Reuse the Markdown row shape (public API), dropping the leading repo cell.
-    return markdown.row_cells(sig)[1:]
+    return markdown.row_cells(sig, informational=informational)[1:]
 
 
 def _summary_context(
@@ -146,10 +147,13 @@ def _section_context(
     top_n: int | None = None,
 ) -> dict:
     offenders, hidden = truncate(section.offenders, top_n)
+    informational = section_shows_informational(offenders)
     # A trailing totals row sums the additive severity columns across the shown
     # rows; secret scanning has no such columns, so it gets none.
     total_cells = (
-        markdown.total_row_cells(section.signal, offenders)
+        markdown.total_row_cells(
+            section.signal, offenders, informational=informational
+        )
         if section.signal.uses_severity_columns and offenders
         else None
     )
@@ -162,9 +166,13 @@ def _section_context(
         # Severity sections have numeric count columns after the leading
         # repository column, so they are right-aligned with tabular figures.
         "numeric": True,
-        "columns": markdown.columns(section.signal),
+        "columns": markdown.columns(section.signal, informational=informational),
         "rows": [
-            {"name": s.repo.name, "url": s.repo.html_url, "cells": _row_cells(s)}
+            {
+                "name": s.repo.name,
+                "url": s.repo.html_url,
+                "cells": _row_cells(s, informational=informational),
+            }
             for s in offenders
         ],
         "hidden": hidden,

{github_security_report-0.3.0 → github_security_report-0.4.0}/src/github_security_report/render/markdown.py

@@ -25,6 +25,7 @@ from github_security_report.report import (
     TableSection,
     build_summary,
     offender_column_totals,
+    section_shows_informational,
     truncate,
 )
 
@@ -36,35 +37,38 @@ def _link(repo: Repo) -> str:
     return f"[{repo.name}]({repo.html_url})"
 
 
-def _columns(signal: SignalType) -> list[str]:
+def _columns(signal: SignalType, *, informational: bool = False) -> list[str]:
     if signal is SignalType.SECRET_SCANNING:
         return ["Repository", "Open"]
+    info = ["Info"] if informational else []
     if signal is SignalType.SCORECARD:
-        return ["Repository", "Score", "Critical", "High", "Medium", "Low"]
-    return ["Repository", "Critical", "High", "Medium", "Low", "Total"]
+        return ["Repository", "Score", "Critical", "High", "Medium", "Low", *info]
+    return ["Repository", "Critical", "High", "Medium", "Low", *info, "Total"]
 
 
-def _row(sig: RepoSignal) -> list[str]:
+def _row(sig: RepoSignal, *, informational: bool = False) -> list[str]:
     c = sig.counts
     if sig.signal is SignalType.SECRET_SCANNING:
         return [_link(sig.repo), str(c.total)]
+    info = [str(c.informational)] if informational else []
     if sig.signal is SignalType.SCORECARD:
         score = f"{sig.score:.1f}" if sig.score is not None else "—"
-        return [_link(sig.repo), score, str(c.critical), str(c.high), str(c.medium), str(c.low)]
-    return [_link(sig.repo), str(c.critical), str(c.high), str(c.medium), str(c.low), str(c.total)]
+        return [_link(sig.repo), score, str(c.critical), str(c.high), str(c.medium), str(c.low), *info]
+    return [_link(sig.repo), str(c.critical), str(c.high), str(c.medium), str(c.low), *info, str(c.total)]
 
 
 def _table(section: SignalSection, top_n: int | None = None) -> list[str]:
-    cols = _columns(section.signal)
+    offenders, hidden = truncate(section.offenders, top_n)
+    informational = section_shows_informational(offenders)
+    cols = _columns(section.signal, informational=informational)
     aligns = ["---"] + ["---:"] * (len(cols) - 1)
     lines = ["| " + " | ".join(cols) + " |", "| " + " | ".join(aligns) + " |"]
-    offenders, hidden = truncate(section.offenders, top_n)
     for sig in offenders:
-        lines.append("| " + " | ".join(_row(sig)) + " |")
+        lines.append("| " + " | ".join(_row(sig, informational=informational)) + " |")
     # Trailing column-totals row, for signals whose columns are additive
     # severity counts (every offender table except secret scanning).
     if section.signal.uses_severity_columns:
-        cells = total_row_cells(section.signal, offenders)
+        cells = total_row_cells(section.signal, offenders, informational=informational)
         lines.append("| " + " | ".join(cells) + " |")
     if hidden:
         lines.append("")
@@ -74,18 +78,26 @@ def _table(section: SignalSection, top_n: int | None = None) -> list[str]:
 
 # Public, render-surface-agnostic accessors for the per-signal table shape, so
 # other renderers (e.g. HTML) do not reach into this module's private helpers.
-def columns(signal: SignalType) -> list[str]:
-    """Column headings for a signal's offender table (repository first)."""
-    return _columns(signal)
+def columns(signal: SignalType, *, informational: bool = False) -> list[str]:
+    """Column headings for a signal's offender table (repository first).
 
+    ``informational`` adds the sub-low Informational column, used only for
+    tables that actually carry such findings (see
+    :func:`report.section_shows_informational`).
+    """
+    return _columns(signal, informational=informational)
 
-def row_cells(sig: RepoSignal) -> list[str]:
+
+def row_cells(sig: RepoSignal, *, informational: bool = False) -> list[str]:
     """Cells for one offender row (the repository link is the first cell)."""
-    return _row(sig)
+    return _row(sig, informational=informational)
 
 
 def total_row_cells(
-    signal: SignalType, offenders: Sequence[RepoSignal]
+    signal: SignalType,
+    offenders: Sequence[RepoSignal],
+    *,
+    informational: bool = False,
 ) -> list[str]:
     """Cells for a trailing "Total" row summing the severity columns.
 
@@ -101,9 +113,10 @@ def total_row_cells(
         str(totals.medium),
         str(totals.low),
     ]
+    info = [str(totals.informational)] if informational else []
     if signal is SignalType.SCORECARD:
-        return ["Total", "", *base]
-    return ["Total", *base, str(totals.total)]
+        return ["Total", "", *base, *info]
+    return ["Total", *base, *info, str(totals.total)]
 
 
 def _summary_lines(

{github_security_report-0.3.0 → github_security_report-0.4.0}/src/github_security_report/render/slack.py

@@ -24,6 +24,7 @@ from github_security_report.report import (
     TableSection,
     build_summary,
     offender_column_totals,
+    section_shows_informational,
     truncate,
 )
 
@@ -35,26 +36,28 @@ _SLACK_MAX_BLOCKS = 50
 _NAME_LIST_LABEL = {"disabled": "Disabled", "excluded": "Excluded"}
 
 
-def _plain_columns(signal: SignalType) -> list[str]:
+def _plain_columns(signal: SignalType, *, informational: bool = False) -> list[str]:
     if signal is SignalType.SECRET_SCANNING:
         return ["Repository", "Open"]
+    info = ["I"] if informational else []
     if signal is SignalType.SCORECARD:
-        return ["Repository", "Score", "C", "H", "M", "L"]
-    return ["Repository", "C", "H", "M", "L"]
+        return ["Repository", "Score", "C", "H", "M", "L", *info]
+    return ["Repository", "C", "H", "M", "L", *info]
 
 
-def _plain_row(sig: RepoSignal) -> list[str]:
+def _plain_row(sig: RepoSignal, *, informational: bool = False) -> list[str]:
     c = sig.counts
     if sig.signal is SignalType.SECRET_SCANNING:
         return [sig.repo.name, str(c.total)]
+    info = [str(c.informational)] if informational else []
     if sig.signal is SignalType.SCORECARD:
         score = f"{sig.score:.1f}" if sig.score is not None else "-"
-        return [sig.repo.name, score, str(c.critical), str(c.high), str(c.medium), str(c.low)]
-    return [sig.repo.name, str(c.critical), str(c.high), str(c.medium), str(c.low)]
+        return [sig.repo.name, score, str(c.critical), str(c.high), str(c.medium), str(c.low), *info]
+    return [sig.repo.name, str(c.critical), str(c.high), str(c.medium), str(c.low), *info]
 
 
 def _plain_total_row(
-    signal: SignalType, offenders: list[RepoSignal]
+    signal: SignalType, offenders: list[RepoSignal], *, informational: bool = False
 ) -> list[str]:
     """Trailing "Total" row summing the severity columns for Slack tables.
 
@@ -69,19 +72,23 @@ def _plain_total_row(
         str(totals.medium),
         str(totals.low),
     ]
+    info = [str(totals.informational)] if informational else []
     if signal is SignalType.SCORECARD:
-        return ["Total", "", *base]
-    return ["Total", *base]
+        return ["Total", "", *base, *info]
+    return ["Total", *base, *info]
 
 
 def _fixed_table(section: SignalSection, top_n: int) -> str:
-    cols = _plain_columns(section.signal)
     shown, hidden = truncate(section.offenders, top_n)
-    rows = [_plain_row(s) for s in shown]
+    informational = section_shows_informational(shown)
+    cols = _plain_columns(section.signal, informational=informational)
+    rows = [_plain_row(s, informational=informational) for s in shown]
     # A trailing totals row sums the additive severity columns; secret scanning
     # has no such columns, so skip it. Summed over the shown (truncated) rows.
     if section.signal.uses_severity_columns and shown:
-        rows.append(_plain_total_row(section.signal, shown))
+        rows.append(
+            _plain_total_row(section.signal, shown, informational=informational)
+        )
     widths = [len(c) for c in cols]
     for row in rows:
         for i, cell in enumerate(row):

{github_security_report-0.3.0 → github_security_report-0.4.0}/src/github_security_report/render/terminal.py

@@ -25,11 +25,16 @@ from github_security_report.report import (
     SummaryLine,
     TableSection,
     build_summary,
+    section_shows_informational,
     truncate,
 )
 
 _SEVERITY_STYLE = {"critical": "bold red", "high": "red", "medium": "yellow", "low": "dim"}
 
+# The sub-low Informational column (shown only when a table carries note-level
+# findings) is the least urgent, so it is dimmed like the Low column.
+_INFORMATIONAL_STYLE = "dim"
+
 # Rich style per summary-footer kind, shared by signal and table sections.
 _SUMMARY_STYLE = {
     "fail": "red",
@@ -43,7 +48,9 @@ _SUMMARY_STYLE = {
 _NAME_LIST_LABEL = {"disabled": "Disabled", "excluded": "Excluded"}
 
 
-def _add_columns(table: Table, signal: SignalType) -> None:
+def _add_columns(
+    table: Table, signal: SignalType, *, informational: bool = False
+) -> None:
     table.add_column("Repository", overflow="fold")
     if signal is SignalType.SECRET_SCANNING:
         table.add_column("Open", justify="right")
@@ -52,19 +59,22 @@ def _add_columns(table: Table, signal: SignalType) -> None:
         table.add_column("Score", justify="right")
     for name, style in _SEVERITY_STYLE.items():
         table.add_column(name.capitalize(), justify="right", style=style)
+    if informational:
+        table.add_column("Info", justify="right", style=_INFORMATIONAL_STYLE)
     if signal is not SignalType.SCORECARD:
         table.add_column("Total", justify="right")
 
 
-def _row(sig: RepoSignal) -> list[str]:
+def _row(sig: RepoSignal, *, informational: bool = False) -> list[str]:
     c = sig.counts
     if sig.signal is SignalType.SECRET_SCANNING:
         return [sig.repo.name, str(c.total)]
     base = [str(c.critical), str(c.high), str(c.medium), str(c.low)]
+    info = [str(c.informational)] if informational else []
     if sig.signal is SignalType.SCORECARD:
         score = f"{sig.score:.1f}" if sig.score is not None else "—"
-        return [sig.repo.name, score, *base]
-    return [sig.repo.name, *base, str(c.total)]
+        return [sig.repo.name, score, *base, *info]
+    return [sig.repo.name, *base, *info, str(c.total)]
 
 
 def _truncated_names(names: Sequence[str], top_n: int | None) -> str:
@@ -108,16 +118,19 @@ def render_section(
 ) -> None:
     offenders, hidden_offenders = truncate(section.offenders, top_n)
     if offenders:
+        informational = section_shows_informational(offenders)
         table = Table(title=section.signal.heading, title_justify="left", title_style="bold")
-        _add_columns(table, section.signal)
+        _add_columns(table, section.signal, informational=informational)
         for sig in offenders:
-            table.add_row(*_row(sig))
+            table.add_row(*_row(sig, informational=informational))
         # A trailing totals row sums the additive severity columns across the
         # rows shown above. Secret scanning has no such columns, so skip it.
         if section.signal.uses_severity_columns:
             table.add_section()
             table.add_row(
-                *markdown.total_row_cells(section.signal, offenders),
+                *markdown.total_row_cells(
+                    section.signal, offenders, informational=informational
+                ),
                 style="bold",
             )
         console.print(table)

{github_security_report-0.3.0 → github_security_report-0.4.0}/src/github_security_report/report.py

@@ -301,6 +301,18 @@ def offender_column_totals(offenders: Sequence[RepoSignal]) -> SeverityCounts:
     return totals
 
 
+def section_shows_informational(offenders: Sequence[RepoSignal]) -> bool:
+    """Whether any offender carries informational (sub-low) findings.
+
+    Drives the conditional Informational severity column: it is rendered only
+    for tables that actually have sub-low findings -- e.g. zizmor's note-level
+    results -- so severity tables without such data (CodeQL, Dependabot alerts)
+    are not padded with an all-zero column. Callers pass the displayed
+    (already-truncated) offenders, so the column matches the visible rows.
+    """
+    return any(sig.counts.informational for sig in offenders)
+
+
 def build_org_report(
     org: str,
     repo_signals: list[RepoSignal],