github-security-report 0.4.1__tar.gz → 0.5.0__tar.gz

{github_security_report-0.4.1 → github_security_report-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: github-security-report
-Version: 0.4.1
+Version: 0.5.0
 Summary: Security and quality reporting across GitHub organisations
 Project-URL: Homepage, https://github.com/lfreleng-actions/github-security-report-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github-security-report-action
@@ -36,7 +36,7 @@ Requires-Dist: pytest-asyncio==1.4.0; extra == 'dev'
 Requires-Dist: pytest-cov==7.1.0; extra == 'dev'
 Requires-Dist: pytest==9.1.1; extra == 'dev'
 Requires-Dist: respx==0.23.1; extra == 'dev'
-Requires-Dist: ruff==0.15.19; extra == 'dev'
+Requires-Dist: ruff==0.15.20; extra == 'dev'
 Requires-Dist: syrupy==5.3.3; extra == 'dev'
 Requires-Dist: types-jsonschema==4.26.0.20260518; extra == 'dev'
 Requires-Dist: types-pyyaml==6.0.12.20250915; extra == 'dev'
@@ -87,7 +87,7 @@ back to code-scanning findings. See [`docs/BRIEF.md`](docs/BRIEF.md) and
 [`docs/phase0-findings.md`](docs/phase0-findings.md) for the full design and the
 API research it is built on.
 
-Two further sections report **configuration posture** and **freshness** as plain
+Further sections report **configuration posture** and **freshness** as plain
 tables (org mode):
 
 - **Dependabot** — three tables: repositories with vulnerability **alerts not
@@ -101,6 +101,12 @@ tables (org mode):
   release or tag is older than `release_max_age_days` (default 60; `0` flags
   every eligible repository), so a repository released or tagged within that
   window counts as recently maintained and drops out of the table.
+- **Private Vulnerability Reporting** — repositories where GitHub's private
+  vulnerability reporting feature is **not enabled**, so security researchers
+  cannot privately disclose vulnerabilities. Probed per repository (GitHub
+  exposes no org-wide or GraphQL equivalent) and, like every other category,
+  always collected; hide it with the `private_vulnerability_reporting` render
+  toggle.
 
 ## Operating modes
 
@@ -176,7 +182,7 @@ organisations. Grant these scopes:
 
 > For organisations that enforce SSO, the PAT must be **SSO-authorised** for
 > each target organisation, or the org-level endpoints return `403` (reported as
-> unknown). Store the token as a secret (e.g. `SECURITY_REPORT_PAT`) and
+> unknown). Store the token as a secret (e.g. `LFRELENG_ACTIONS_REPORT_PAT`) and
 > reference it by env-var name via `token_env`; never embed it in the config.
 
 ## Usage
@@ -190,7 +196,9 @@ organisations. Grant these scopes:
   with:
     scope: "org"
     config: "${{ secrets.GSR_CONFIG || vars.GSR_CONFIG }}"
-    token: "${{ secrets.SECURITY_REPORT_PAT }}"
+    token: "${{ secrets.LFRELENG_ACTIONS_REPORT_PAT }}"
+    # Must match the per-org "token_env" in your config (below).
+    token_env: "LFRELENG_ACTIONS_REPORT_PAT"
     output_dir: "site"
     pages_url: "https://lfreleng-actions.github.io/github-security-report-action/"
 ```
@@ -235,7 +243,7 @@ environment-variable name, never embedded.
   "organizations": [
     {
       "name": "lfreleng-actions",
-      "token_env": "GITHUB_TOKEN",
+      "token_env": "LFRELENG_ACTIONS_REPORT_PAT",
       "exclude": ["actions-template"],
       "releases_exclude": ["internal-only-repo"]
     }
@@ -305,7 +313,8 @@ out of the terminal and Slack while still publishing it to the Markdown and HTML
 Pages output. The valid category keys are: `codeql`, `scorecard`, `zizmor`,
 `dependabot_alerts`, `secret_scanning`, `dependabot_alerts_enabled`,
 `dependabot_updates_enabled`, `dependabot_cooldown`, `releases`,
-`mutable_releases`. Like the other `report` settings, `categories` can be set
+`mutable_releases`, `private_vulnerability_reporting`. Like the other `report`
+settings, `categories` can be set
 globally and overridden per organisation (overrides merge key-by-key, so
 flipping one output leaves the rest untouched). The machine-readable
 `report.json` artifact always contains the complete dataset, regardless of these
@@ -365,7 +374,7 @@ $XDG_CONFIG_HOME/github-security-report/config.json
 An explicit `--config`, `--config-data`, or `--org` always takes precedence, and
 the action itself never reads this path (it is supplied configuration directly).
 Secrets stay out of the file: reference the token by environment-variable name
-via `token_env` (e.g. `SECURITY_REPORT_PAT`, exported in your shell or sourced
+via `token_env` (e.g. `LFRELENG_ACTIONS_REPORT_PAT`, exported in your shell or sourced
 from a secrets file) — the channel ID is the only Slack value the file holds,
 and the Slack **bot token** is consumed by the workflow, not the CLI.
 
@@ -380,7 +389,7 @@ and the Slack **bot token** is consumed by the workflow, not the CLI.
 | `org` | No | — | Single organisation (shorthand for org mode) |
 | `repo` | No | detected | `owner/name` for repo mode |
 | `token` | No | `${{ github.token }}` | PAT (org mode) or `GITHUB_TOKEN` (repo mode) |
-| `token_env` | No | `GITHUB_TOKEN` | Env var name the tool reads the token from |
+| `token_env` | No | `GITHUB_TOKEN` | Env var name the token is exported under. In org mode it **must match** the per-org `token_env` in your config (e.g. `LFRELENG_ACTIONS_REPORT_PAT`), otherwise the tool looks up an unset variable and reports no token. |
 | `output_dir` | No | — | Directory for Pages output (org mode) |
 | `pages_url` | No | — | Published Pages URL (used in the Slack link) |
 | `slack_channel` | No | — | Slack channel ID; overrides the config `slack.channel` (e.g. the `SLACK_CHANNEL_ID` variable) |

{github_security_report-0.4.1 → github_security_report-0.5.0}/README.md

@@ -43,7 +43,7 @@ back to code-scanning findings. See [`docs/BRIEF.md`](docs/BRIEF.md) and
 [`docs/phase0-findings.md`](docs/phase0-findings.md) for the full design and the
 API research it is built on.
 
-Two further sections report **configuration posture** and **freshness** as plain
+Further sections report **configuration posture** and **freshness** as plain
 tables (org mode):
 
 - **Dependabot** — three tables: repositories with vulnerability **alerts not
@@ -57,6 +57,12 @@ tables (org mode):
   release or tag is older than `release_max_age_days` (default 60; `0` flags
   every eligible repository), so a repository released or tagged within that
   window counts as recently maintained and drops out of the table.
+- **Private Vulnerability Reporting** — repositories where GitHub's private
+  vulnerability reporting feature is **not enabled**, so security researchers
+  cannot privately disclose vulnerabilities. Probed per repository (GitHub
+  exposes no org-wide or GraphQL equivalent) and, like every other category,
+  always collected; hide it with the `private_vulnerability_reporting` render
+  toggle.
 
 ## Operating modes
 
@@ -132,7 +138,7 @@ organisations. Grant these scopes:
 
 > For organisations that enforce SSO, the PAT must be **SSO-authorised** for
 > each target organisation, or the org-level endpoints return `403` (reported as
-> unknown). Store the token as a secret (e.g. `SECURITY_REPORT_PAT`) and
+> unknown). Store the token as a secret (e.g. `LFRELENG_ACTIONS_REPORT_PAT`) and
 > reference it by env-var name via `token_env`; never embed it in the config.
 
 ## Usage
@@ -146,7 +152,9 @@ organisations. Grant these scopes:
   with:
     scope: "org"
     config: "${{ secrets.GSR_CONFIG || vars.GSR_CONFIG }}"
-    token: "${{ secrets.SECURITY_REPORT_PAT }}"
+    token: "${{ secrets.LFRELENG_ACTIONS_REPORT_PAT }}"
+    # Must match the per-org "token_env" in your config (below).
+    token_env: "LFRELENG_ACTIONS_REPORT_PAT"
     output_dir: "site"
     pages_url: "https://lfreleng-actions.github.io/github-security-report-action/"
 ```
@@ -191,7 +199,7 @@ environment-variable name, never embedded.
   "organizations": [
     {
       "name": "lfreleng-actions",
-      "token_env": "GITHUB_TOKEN",
+      "token_env": "LFRELENG_ACTIONS_REPORT_PAT",
       "exclude": ["actions-template"],
       "releases_exclude": ["internal-only-repo"]
     }
@@ -261,7 +269,8 @@ out of the terminal and Slack while still publishing it to the Markdown and HTML
 Pages output. The valid category keys are: `codeql`, `scorecard`, `zizmor`,
 `dependabot_alerts`, `secret_scanning`, `dependabot_alerts_enabled`,
 `dependabot_updates_enabled`, `dependabot_cooldown`, `releases`,
-`mutable_releases`. Like the other `report` settings, `categories` can be set
+`mutable_releases`, `private_vulnerability_reporting`. Like the other `report`
+settings, `categories` can be set
 globally and overridden per organisation (overrides merge key-by-key, so
 flipping one output leaves the rest untouched). The machine-readable
 `report.json` artifact always contains the complete dataset, regardless of these
@@ -321,7 +330,7 @@ $XDG_CONFIG_HOME/github-security-report/config.json
 An explicit `--config`, `--config-data`, or `--org` always takes precedence, and
 the action itself never reads this path (it is supplied configuration directly).
 Secrets stay out of the file: reference the token by environment-variable name
-via `token_env` (e.g. `SECURITY_REPORT_PAT`, exported in your shell or sourced
+via `token_env` (e.g. `LFRELENG_ACTIONS_REPORT_PAT`, exported in your shell or sourced
 from a secrets file) — the channel ID is the only Slack value the file holds,
 and the Slack **bot token** is consumed by the workflow, not the CLI.
 
@@ -336,7 +345,7 @@ and the Slack **bot token** is consumed by the workflow, not the CLI.
 | `org` | No | — | Single organisation (shorthand for org mode) |
 | `repo` | No | detected | `owner/name` for repo mode |
 | `token` | No | `${{ github.token }}` | PAT (org mode) or `GITHUB_TOKEN` (repo mode) |
-| `token_env` | No | `GITHUB_TOKEN` | Env var name the tool reads the token from |
+| `token_env` | No | `GITHUB_TOKEN` | Env var name the token is exported under. In org mode it **must match** the per-org `token_env` in your config (e.g. `LFRELENG_ACTIONS_REPORT_PAT`), otherwise the tool looks up an unset variable and reports no token. |
 | `output_dir` | No | — | Directory for Pages output (org mode) |
 | `pages_url` | No | — | Published Pages URL (used in the Slack link) |
 | `slack_channel` | No | — | Slack channel ID; overrides the config `slack.channel` (e.g. the `SLACK_CHANNEL_ID` variable) |

{github_security_report-0.4.1 → github_security_report-0.5.0}/pyproject.toml

@@ -65,7 +65,7 @@ dev = [
   "respx==0.23.1",
   "syrupy==5.3.3",
   "mypy==2.1.0",
-  "ruff==0.15.19",
+  "ruff==0.15.20",
   "types-jsonschema==4.26.0.20260518",
   "types-PyYAML==6.0.12.20250915",
 ]
@@ -97,7 +97,7 @@ dev = [
   "respx==0.23.1",
   "syrupy==5.3.3",
   "mypy==2.1.0",
-  "ruff==0.15.19",
+  "ruff==0.15.20",
   "types-jsonschema==4.26.0.20260518",
   "types-PyYAML==6.0.12.20250915",
 ]

{github_security_report-0.4.1 → github_security_report-0.5.0}/src/github_security_report/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.4.1'
-__version_tuple__ = version_tuple = (0, 4, 1)
+__version__ = version = '0.5.0'
+__version_tuple__ = version_tuple = (0, 5, 0)
 
 __commit_id__ = commit_id = None

{github_security_report-0.4.1 → github_security_report-0.5.0}/src/github_security_report/categories.py

@@ -38,6 +38,7 @@ class CategoryKey(str, Enum):
     DEPENDABOT_COOLDOWN = "dependabot_cooldown"
     RELEASES = "releases"
     MUTABLE_RELEASES = "mutable_releases"
+    PRIVATE_VULNERABILITY_REPORTING = "private_vulnerability_reporting"
 
 
 @dataclass(frozen=True)
@@ -210,6 +211,22 @@ _CATEGORIES: dict[CategoryKey, CategoryMeta] = {
             "cannot change after the fact."
         ),
     ),
+    CategoryKey.PRIVATE_VULNERABILITY_REPORTING: CategoryMeta(
+        key=CategoryKey.PRIVATE_VULNERABILITY_REPORTING,
+        title="Private Vulnerability Reporting",
+        pass_label="Enabled",
+        fail_label="Not enabled",
+        url=(
+            "https://docs.github.com/en/code-security/security-advisories/"
+            "working-with-repository-security-advisories/"
+            "configuring-private-vulnerability-reporting-for-a-repository"
+        ),
+        description=(
+            "Repositories with private vulnerability reporting disabled. Enable "
+            "it so security researchers can privately report vulnerabilities "
+            "instead of disclosing them publicly."
+        ),
+    ),
 }
 
 

{github_security_report-0.4.1 → github_security_report-0.5.0}/src/github_security_report/cli.py

@@ -48,7 +48,10 @@ def _version_callback(value: bool) -> None:
     if value:
         # Match the dependamerge style: a label emoji plus a Rich-highlighted
         # version number (Rich colourises the numeric version automatically).
-        Console().print(f"🏷️  github-security-report version {__version__}")
+        # A single space follows the emoji: terminals that honour the VS16
+        # emoji-presentation width (e.g. Ghostty) render it two cells wide, so
+        # the extra pad the old double space added now reads as a gap.
+        Console().print(f"🏷️ github-security-report version {__version__}")
         raise typer.Exit()
 
 
@@ -133,6 +136,11 @@ def _org_to_dict(org: OrgReport) -> dict:
         "mutable_releases": (
             _table_to_dict(org.mutable_releases) if org.mutable_releases else None
         ),
+        "private_vulnerability_reporting": (
+            _table_to_dict(org.private_vulnerability_reporting)
+            if org.private_vulnerability_reporting
+            else None
+        ),
     }
 
 

{github_security_report-0.4.1 → github_security_report-0.5.0}/src/github_security_report/client.py

@@ -756,6 +756,32 @@ class GitHubClient:
         await resp.aclose()  # release the connection once the body is read
         return bool(data.get("enabled"))
 
+    async def private_vulnerability_reporting(
+        self, org: str, repo: str
+    ) -> bool | None:
+        """Whether private vulnerability reporting is enabled (None = unknown).
+
+        ``GET .../private-vulnerability-reporting`` returns ``{enabled}`` (200);
+        any other status (e.g. 422) is treated as indeterminate. A classic PAT
+        needs the ``repo`` scope (``public_repo`` suffices for public repos);
+        fine-grained tokens and Apps need only ``Metadata: read``. Org mode
+        already grants ``repo``, so it works with the same token used for the
+        other read probes -- but GitHub exposes no org-wide or GraphQL
+        equivalent, so it is one REST call per repository, gathered alongside
+        the automated-security-fixes probe.
+        """
+        resp = await self._request(
+            "GET",
+            f"{self._api_url}/repos/{org}/{repo}/private-vulnerability-reporting",
+        )
+        status = resp.status_code
+        if status != 200:
+            await resp.aclose()  # unread body would leak a pooled connection
+            return None
+        data = resp.json()
+        await resp.aclose()  # release the connection once the body is read
+        return bool(data.get("enabled"))
+
     async def repo_graph_batch(
         self, org: str, names: list[str]
     ) -> dict[str, RepoGraphData]:

{github_security_report-0.4.1 → github_security_report-0.5.0}/src/github_security_report/collect.py

@@ -72,6 +72,12 @@ class ClientProtocol(Protocol):
         """Whether Dependabot automated security fixes are enabled."""
         raise NotImplementedError
 
+    async def private_vulnerability_reporting(
+        self, org: str, repo: str
+    ) -> bool | None:
+        """Whether private vulnerability reporting is enabled for a repository."""
+        raise NotImplementedError
+
     async def repo_graph_batch(
         self, org: str, names: list[str]
     ) -> dict[str, RepoGraphData]:
@@ -199,11 +205,18 @@ async def _posture_for_repo(
     """Build one repo's Dependabot posture and release/tag freshness.
 
     ``dependabot_alerts`` and the release/tag/``dependabot.yml`` data come from
-    the batched GraphQL prefetch (:func:`_collect_graph`); only the
-    security-updates flag remains a per-repo REST call, since GitHub exposes no
-    GraphQL equivalent.
+    the batched GraphQL prefetch (:func:`_collect_graph`); the security-updates
+    and private-vulnerability-reporting flags remain per-repo REST calls, since
+    GitHub exposes no GraphQL equivalent. They are independent, so they are
+    gathered together and the two reads overlap (bounded by the client
+    semaphore); private vulnerability reporting is always probed, like every
+    other signal, with the per-category toggle governing only whether the
+    resulting table renders.
     """
-    security_updates = await client.automated_security_fixes(org, repo.name)
+    security_updates, pvr = await asyncio.gather(
+        client.automated_security_fixes(org, repo.name),
+        client.private_vulnerability_reporting(org, repo.name),
+    )
     config_text = graph.dependabot_config
     has_config = config_text is not None
     cooldown_missing = (
@@ -215,6 +228,7 @@ async def _posture_for_repo(
         repo=repo,
         dependabot_alerts=dependabot_alerts,
         security_updates=security_updates,
+        private_vulnerability_reporting=pvr,
         cooldown_missing=cooldown_missing,
         has_dependabot_config=has_config,
         latest_release_at=graph.latest_release_at,
@@ -356,7 +370,8 @@ async def collect_org(
     # Extra reporting categories (outside the four-state model): Dependabot
     # configuration posture and release/tag freshness. The Dependabot alerts
     # enablement flag and the release/tag data are reused from the batched
-    # GraphQL prefetch; only the security-updates flag is still a per-repo call.
+    # GraphQL prefetch; the security-updates and private-vulnerability-reporting
+    # flags are still per-repo calls.
     when = report.generated_at
     dependabot_on = {f.repo.name: f.dependabot_enabled for f in facts}
     postures: list[RepoPosture] = []
@@ -384,6 +399,7 @@ async def collect_org(
         exclude=org_cfg.releases_exclude,
     )
     report.mutable_releases = posture.build_mutable_releases_table(postures)
+    report.private_vulnerability_reporting = posture.build_pvr_table(postures)
     # The Dependabot alerts enablement sub-table carries the repositories with
     # Dependabot alerts disabled, so drop them from the Dependabot signal
     # section's nag list to avoid listing the same repositories twice under the

{github_security_report-0.4.1 → github_security_report-0.5.0}/src/github_security_report/posture.py

@@ -48,6 +48,8 @@ class RepoPosture:
     # Dependabot repo-level feature flags (None = indeterminate).
     dependabot_alerts: bool | None = None
     security_updates: bool | None = None
+    # GitHub "private vulnerability reporting" enablement (None = indeterminate).
+    private_vulnerability_reporting: bool | None = None
     # Ecosystems declared in .github/dependabot.yml that set no cooldown.
     cooldown_missing: tuple[str, ...] = ()
     # True when .github/dependabot.yml exists and declares version updates.
@@ -240,6 +242,25 @@ def build_dependabot_tables(postures: list[RepoPosture]) -> list[TableSection]:
     ]
 
 
+def build_pvr_table(postures: list[RepoPosture]) -> TableSection:
+    """Repositories where private vulnerability reporting is not enabled.
+
+    Like the Dependabot enablement tables this is a single-boolean feature
+    check, so it reuses :func:`_build_feature_table`: offenders are repositories
+    where the feature is confirmed off; an indeterminate (``None``) reading
+    counts towards neither side of the standardised summary footer. The table is
+    always built (the flag is probed for every repository); the per-category
+    render toggle governs whether it is shown.
+    """
+    return _build_feature_table(
+        postures,
+        category_key=CategoryKey.PRIVATE_VULNERABILITY_REPORTING,
+        columns=("Repository",),
+        enabled_of=lambda p: p.private_vulnerability_reporting,
+    )
+
+
+
 def build_releases_table(
     postures: list[RepoPosture],
     *,
@@ -390,4 +411,5 @@ __all__ = [
     "build_alerts_table",
     "build_security_updates_table",
     "build_cooldown_table",
+    "build_pvr_table",
 ]

{github_security_report-0.4.1 → github_security_report-0.5.0}/src/github_security_report/render/html.py

@@ -239,6 +239,16 @@ def render_org_html(
                 and visible(org.mutable_releases.category.key)
                 else None
             ),
+            private_vulnerability_reporting=(
+                _table_context(
+                    org.private_vulnerability_reporting,
+                    excluded=excluded,
+                    top_n=top_n,
+                )
+                if org.private_vulnerability_reporting
+                and visible(org.private_vulnerability_reporting.category.key)
+                else None
+            ),
             datatables_version=DATATABLES_VERSION,
             datatables_css_sri=DATATABLES_CSS_SRI,
             datatables_js_sri=DATATABLES_JS_SRI,

{github_security_report-0.4.1 → github_security_report-0.5.0}/src/github_security_report/render/markdown.py

@@ -281,6 +281,17 @@ def render_org(
                 org.mutable_releases, level=2, excluded=excluded, top_n=top_n
             )
         )
+    if org.private_vulnerability_reporting is not None and visible(
+        org.private_vulnerability_reporting.category.key
+    ):
+        parts.append(
+            render_table_section(
+                org.private_vulnerability_reporting,
+                level=2,
+                excluded=excluded,
+                top_n=top_n,
+            )
+        )
     return "\n".join(parts).rstrip() + "\n"
 
 

{github_security_report-0.4.1 → github_security_report-0.5.0}/src/github_security_report/render/slack.py

@@ -239,6 +239,14 @@ def render_org_blocks(
         block = _table_block(org.mutable_releases, top_n, excluded=excluded)
         if block is not None:
             blocks.append(block)
+    if org.private_vulnerability_reporting is not None and visible(
+        org.private_vulnerability_reporting.category.key
+    ):
+        block = _table_block(
+            org.private_vulnerability_reporting, top_n, excluded=excluded
+        )
+        if block is not None:
+            blocks.append(block)
     if pages_url:
         blocks.append(
             {

{github_security_report-0.4.1 → github_security_report-0.5.0}/src/github_security_report/render/terminal.py

@@ -11,6 +11,7 @@ sections 10-11.
 from __future__ import annotations
 
 from collections.abc import Callable, Sequence
+from dataclasses import replace
 
 from rich.console import Console
 from rich.table import Table
@@ -87,20 +88,28 @@ def _truncated_names(names: Sequence[str], top_n: int | None) -> str:
 
 
 def _render_summary(
-    console: Console, lines: Sequence[SummaryLine], *, top_n: int | None
+    console: Console,
+    lines: Sequence[SummaryLine],
+    *,
+    top_n: int | None,
+    name_labels: dict[str, str] | None = None,
 ) -> None:
     """Print the standardised footer: count lines, then any name lists.
 
     Counts come first (failures and not-enabled at the top, the healthy pass
-    line lower down), then the repository-name breakdowns for the disabled and
-    excluded kinds -- numbers and names are never mixed on one line, and the
-    name lists honour the same offender limit as the tables.
+    line lower down), then the repository-name breakdowns for the kinds in
+    ``name_labels`` -- numbers and names are never mixed on one line, and the
+    name lists honour the same offender limit as the tables. ``name_labels``
+    defaults to the disabled/excluded kinds; a boolean feature table passes an
+    extended map so its offenders list inline under the fail line too.
     """
+    if name_labels is None:
+        name_labels = _NAME_LIST_LABEL
     for line in lines:
         style = _SUMMARY_STYLE[line.kind]
         console.print(f"  [{style}]{SUMMARY_EMOJI[line.kind]} {line.text}[/{style}]")
     for line in lines:
-        label = _NAME_LIST_LABEL.get(line.kind)
+        label = name_labels.get(line.kind)
         if label and line.names:
             style = _SUMMARY_STYLE[line.kind]
             console.print(
@@ -155,13 +164,20 @@ def render_table_section(
 ) -> None:
     """Render a generic posture/freshness table to the terminal.
 
-    The explanatory description is deliberately omitted here: the terminal is a
-    brevity-first surface, so the guidance text is reserved for the Markdown and
-    HTML (GitHub Pages) outputs.
+    A section with a single column carries only repository names -- a boolean
+    feature check (enabled/not enabled) with no qualitative data -- so it is
+    rendered like a signal section: no table, just the standardised footer with
+    the offenders listed inline under the fail line (e.g. ``Not enabled:``).
+    Tables are reserved for sections whose extra columns carry qualitative data
+    that cannot be expressed as a count (release/tag ages, ecosystems, release
+    tags). The explanatory description is deliberately omitted either way: the
+    terminal is a brevity-first surface, so the guidance text is reserved for
+    the Markdown and HTML (GitHub Pages) outputs.
     """
+    inline = len(section.columns) == 1
     rows, hidden = truncate(section.rows, top_n)
     console.print(f"[bold]{section.title}[/bold]")
-    if rows:
+    if not inline and rows:
         table = Table(title_justify="left", title_style="bold")
         for i, col in enumerate(section.columns):
             table.add_column(col, overflow="fold", justify="left" if i == 0 else "right")
@@ -170,9 +186,23 @@ def render_table_section(
         console.print(table)
         if hidden:
             console.print(f"  [dim]\u2026 and {hidden} more[/dim]")
-    lines = build_summary(section.summary_counts(excluded))
+    counts = section.summary_counts(excluded)
+    name_labels = _NAME_LIST_LABEL
+    if inline:
+        # Surface the offenders inline under the fail line, labelled with the
+        # category's fail wording (e.g. "Not enabled"), instead of a one-column
+        # table. The name list honours top_n like every other breakdown.
+        fail_label = section.category.fail_label or "Failing"
+        counts = [
+            replace(c, names=tuple(r.repo.name for r in section.rows))
+            if c.kind == "fail"
+            else c
+            for c in counts
+        ]
+        name_labels = {**_NAME_LIST_LABEL, "fail": fail_label}
+    lines = build_summary(counts)
     if lines:
-        _render_summary(console, lines, top_n=top_n)
+        _render_summary(console, lines, top_n=top_n, name_labels=name_labels)
     elif not rows:
         console.print("  [dim]No data[/dim]")
     console.print()
@@ -214,6 +244,15 @@ def render_org(
         render_table_section(
             org.mutable_releases, console, excluded=org.excluded_repos, top_n=top_n
         )
+    if org.private_vulnerability_reporting is not None and visible(
+        org.private_vulnerability_reporting.category.key
+    ):
+        render_table_section(
+            org.private_vulnerability_reporting,
+            console,
+            excluded=org.excluded_repos,
+            top_n=top_n,
+        )
 
 
 def render_orgs(

{github_security_report-0.4.1 → github_security_report-0.5.0}/src/github_security_report/report.py

@@ -252,6 +252,9 @@ class OrgReport:
     # The Mutable Releases table: repositories whose "Latest" or last-published
     # release is not immutable. None in repo mode / when not collected.
     mutable_releases: TableSection | None = None
+    # The Private Vulnerability Reporting table: repositories where the feature
+    # is not enabled. None in repo mode / when not collected.
+    private_vulnerability_reporting: TableSection | None = None
 
 
 @dataclass

{github_security_report-0.4.1 → github_security_report-0.5.0}/src/github_security_report/templates/report.html.j2

@@ -125,6 +125,13 @@
     </section>
     {% endif %}
 
+    {% if private_vulnerability_reporting %}
+    <section>
+      <h2>{{ private_vulnerability_reporting.title }}</h2>
+      {{ render_table(private_vulnerability_reporting) }}
+    </section>
+    {% endif %}
+
     <footer>
       Generated by
       <a href="https://github.com/lfreleng-actions/github-security-report-action">github-security-report</a>