github-security-report 0.5.0__tar.gz → 0.7.0__tar.gz

{github_security_report-0.5.0 → github_security_report-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: github-security-report
-Version: 0.5.0
+Version: 0.7.0
 Summary: Security and quality reporting across GitHub organisations
 Project-URL: Homepage, https://github.com/lfreleng-actions/github-security-report-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github-security-report-action
@@ -29,7 +29,7 @@ Requires-Dist: jinja2==3.1.6
 Requires-Dist: jsonschema==4.26.0
 Requires-Dist: pyyaml==6.0.3
 Requires-Dist: rich==15.0.0
-Requires-Dist: typer==0.26.7
+Requires-Dist: typer==0.26.8
 Provides-Extra: dev
 Requires-Dist: mypy==2.1.0; extra == 'dev'
 Requires-Dist: pytest-asyncio==1.4.0; extra == 'dev'
@@ -37,7 +37,7 @@ Requires-Dist: pytest-cov==7.1.0; extra == 'dev'
 Requires-Dist: pytest==9.1.1; extra == 'dev'
 Requires-Dist: respx==0.23.1; extra == 'dev'
 Requires-Dist: ruff==0.15.20; extra == 'dev'
-Requires-Dist: syrupy==5.3.3; extra == 'dev'
+Requires-Dist: syrupy==5.3.4; extra == 'dev'
 Requires-Dist: types-jsonschema==4.26.0.20260518; extra == 'dev'
 Requires-Dist: types-pyyaml==6.0.12.20250915; extra == 'dev'
 Description-Content-Type: text/markdown
@@ -56,8 +56,8 @@ Description-Content-Type: text/markdown
 
 > Security and quality **reporting** (not scanning) across GitHub
 > organisations. Aggregates existing signals — CodeQL, OpenSSF Scorecard,
-> zizmor, Dependabot, and secret scanning — and ranks the worst offenders so
-> remediation effort goes where it is needed.
+> zizmor, aislop (AI slop), Dependabot, and secret scanning — and ranks the
+> worst offenders so remediation effort goes where it is needed.
 
 ## 🗒️ Published reports
 
@@ -82,10 +82,21 @@ stay brevity-first; the explanatory per-category description and documentation
 link are shown only on the richer Markdown and HTML (GitHub Pages) outputs.
 
 The single GitHub code-scanning feed is partitioned by `tool.name` into CodeQL,
-Scorecard, and zizmor; Scorecard prefers the external aggregate score and falls
-back to code-scanning findings. See [`docs/BRIEF.md`](docs/BRIEF.md) and
-[`docs/phase0-findings.md`](docs/phase0-findings.md) for the full design and the
-API research it is built on.
+Scorecard, zizmor, and aislop; Scorecard prefers the external aggregate score
+and falls back to code-scanning findings. See [`docs/BRIEF.md`](docs/BRIEF.md)
+and [`docs/phase0-findings.md`](docs/phase0-findings.md) for the full design and
+the API research it is built on.
+
+The workflow-driven signals (OpenSSF Scorecard, zizmor, aislop) only produce
+data when an organisation has deployed supporting workflows. The tool checks
+for that support cheaply before collecting (**feature gating**): an
+organisation with no evidence of a tool — no ruleset requiring its workflow,
+no alerts, no analyses on a sample of repositories — gets a single
+`⏩ Skipping feature: organisation support missing` line for that section
+instead of a nag list. See the
+[organisation scan setup guide](docs/org-scan-setup.md) for the required
+workflows, and disable the check with `report.gating: false` if you want to
+probe everything regardless.
 
 Further sections report **configuration posture** and **freshness** as plain
 tables (org mode):
@@ -153,7 +164,7 @@ organisation and **Repository access** set to *All repositories*, then grant:
 | Metadata | Mandatory baseline; listing organisation repositories |
 | Contents | `.github/dependabot.yml`, latest release, and tag dates |
 | Dependabot alerts | Open Dependabot vulnerability alerts |
-| Code scanning alerts | CodeQL / Scorecard / zizmor findings |
+| Code scanning alerts | CodeQL / Scorecard / zizmor / aislop findings |
 | Secret scanning alerts | Open secret-scanning alerts |
 | Administration | Dependabot enablement + security-updates status, and effective branch rules |
 
@@ -311,7 +322,7 @@ both true.
 The example above hides Zizmor on every surface, and keeps Releases / Tagging
 out of the terminal and Slack while still publishing it to the Markdown and HTML
 Pages output. The valid category keys are: `codeql`, `scorecard`, `zizmor`,
-`dependabot_alerts`, `secret_scanning`, `dependabot_alerts_enabled`,
+`aislop`, `dependabot_alerts`, `secret_scanning`, `dependabot_alerts_enabled`,
 `dependabot_updates_enabled`, `dependabot_cooldown`, `releases`,
 `mutable_releases`, `private_vulnerability_reporting`. Like the other `report`
 settings, `categories` can be set
@@ -328,19 +339,49 @@ unless every org sharing that channel also disables it (this mirrors the
 most-generous `top_n` rule applied to the same grouping). The terminal, Markdown
 and HTML surfaces are per-org and are not affected by this union.
 
+### Organisation feature gating
+
+The workflow-driven signals (OpenSSF Scorecard, zizmor, aislop) need
+organisation-deployed workflows before they produce any data (see the
+[organisation scan setup guide](docs/org-scan-setup.md)). By default the tool
+runs a cheap support check per organisation before collecting each of them:
+evidence is an org ruleset requiring the tool's workflow, existing
+code-scanning alerts from the tool, analyses on a sample of repositories, or
+(for Scorecard) an external scorecard.dev score. A signal with no evidence is
+**skipped** — not probed per repository, not classified — and its section
+shows a single `⏩ Skipping feature: organisation support missing` line
+linking the setup guide, on every output surface. Set `report.gating` to
+`false` (globally or per organisation) to always probe everything:
+
+```json
+{
+  "report": { "gating": false },
+  "organizations": [{ "name": "lfreleng-actions" }]
+}
+```
+
+Gating decides **collection**; the per-category render toggles above decide
+**presentation**. A skipped section still renders (as the one-line notice)
+unless its category is also disabled.
+
 ### Pass/fail severity cutoff
 
-The severity-ranked signals (CodeQL, Scorecard, Zizmor, Dependabot alerts) use a
-`fail_severity` cutoff to decide when a repository counts as a failure. A
-repository is flagged as an offender only when it carries a finding **at or
-above** the cutoff; findings below it fold into the clean count. Severities run
-(lowest to highest) `informational`, `low`, `medium`, `high`, `critical` —
-`informational` being the new sub-low rung that SARIF `note`/`none` findings
-(the bulk of a tool like Zizmor) normalise to.
+The severity-ranked signals (CodeQL, Scorecard, Zizmor, aislop, Dependabot
+alerts) use a `fail_severity` cutoff to decide when a repository counts as a
+failure. A repository is flagged as an offender only when it carries a finding
+**at or above** the cutoff; findings below it fold into the clean count.
+Severities run (lowest to highest) `informational`, `low`, `medium`, `high`,
+`critical` — `informational` being the sub-low rung for SARIF `none` findings
+and unclassifiable alerts. Zizmor's SARIF `note` findings normalise to `low`
+(zizmor emits its Low findings at `note`, and the organisation scan pipeline's
+`--min-severity low` floor keeps informational findings out of the uploaded
+SARIF), matching the ruleset-enforced PR gate that blocks on note-and-above.
+aislop populates the same SARIF level axis and normalises identically.
 
 The global default cutoff is `medium`, so `low` and `informational` findings
-pass. Zizmor defaults to `low` (only `informational` passes). Override the
-cutoff per category under `report.categories.<key>.fail_severity`:
+pass. Zizmor and aislop default to `low` (only `informational` passes).
+Override the cutoff per category under
+`report.categories.<key>.fail_severity`:
 
 ```json
 {
@@ -426,8 +467,57 @@ uvx github-security-report report
 uvx github-security-report report --org lfreleng-actions
 ```
 
+## Remediation
+
+The `remediate` subcommand is the in-tool counterpart to the report: it runs the
+same collection, then switches on each selected security feature wherever a
+repository has it **confirmed off**. Only the offenders the report already
+surfaces are acted on — repositories whose state could not be read are counted
+as *unknown* and are never written to, so remediation never blind-writes.
+
+It is **dry run by default** (these are privileged writes); pass `--apply` to
+make changes. A single **write-capable** org-admin token (from `--token-env`,
+default `GITHUB_TOKEN`) drives both the read and the writes across every
+configured organisation, so it bypasses the per-org read-only `token_env` in the
+config.
+
+```bash
+# An org-admin token is required: a classic PAT with the `repo` scope
+# (administers repository security settings) plus `read:org` to enumerate repos.
+source ~/.secrets.github.classic.god   # exports $GITHUB_TOKEN
+
+# Dry run (default): preview every change, touch nothing.
+uvx github-security-report remediate --org lfreleng-actions
+
+# Apply: enable every remediable feature that is off, across all configured orgs.
+uvx github-security-report remediate \
+  --config ~/.config/github-security-report/config.json --apply
+
+# Limit to specific categories (repeatable).
+uvx github-security-report remediate --org lfreleng-actions \
+  --category codeql --category private_vulnerability_reporting --apply
+```
+
+The remediable categories are the simple on/off features with a documented
+enablement endpoint:
+
+| `--category` | Enables |
+|---|---|
+| `codeql` | CodeQL default setup (provisioned asynchronously) |
+| `secret_scanning` | Secret scanning |
+| `dependabot_alerts_enabled` | Dependabot vulnerability alerts |
+| `dependabot_updates_enabled` | Dependabot security updates (plus alerts) |
+| `private_vulnerability_reporting` | Private vulnerability reporting |
+
+Qualitative findings (Scorecard, zizmor, open Dependabot alerts, cooldown,
+release freshness/mutability) are reported but not auto-remediated. Remediation
+is organisation-scoped (`--scope org`, the default and only supported scope).
+
 ## Bulk Remediation Scripts
 
+The standalone scripts below predate the `remediate` subcommand and remain for
+ad-hoc, single-feature runs. For most workflows, prefer `remediate` above.
+
 The report ends with **nag lists** — repositories where a supported feature is
 switched off. Where GitHub exposes the relevant toggle through its REST API,
 the [`scripts/`](scripts/) directory ships standalone helpers that clear a whole
@@ -449,7 +539,8 @@ the current state of each repository, enables the feature where it is off, and
 verifies the result.
 
 ```bash
-# An org-admin token is required (classic PAT with repo admin / admin:org).
+# An org-admin token is required: a classic PAT with the `repo` scope
+# (administers repository security settings) plus `read:org` to enumerate repos.
 source ~/.secrets.github.classic.god   # exports $GITHUB_TOKEN
 
 # Dry run (default): preview every change, touch nothing.

{github_security_report-0.5.0 → github_security_report-0.7.0}/README.md

@@ -12,8 +12,8 @@
 
 > Security and quality **reporting** (not scanning) across GitHub
 > organisations. Aggregates existing signals — CodeQL, OpenSSF Scorecard,
-> zizmor, Dependabot, and secret scanning — and ranks the worst offenders so
-> remediation effort goes where it is needed.
+> zizmor, aislop (AI slop), Dependabot, and secret scanning — and ranks the
+> worst offenders so remediation effort goes where it is needed.
 
 ## 🗒️ Published reports
 
@@ -38,10 +38,21 @@ stay brevity-first; the explanatory per-category description and documentation
 link are shown only on the richer Markdown and HTML (GitHub Pages) outputs.
 
 The single GitHub code-scanning feed is partitioned by `tool.name` into CodeQL,
-Scorecard, and zizmor; Scorecard prefers the external aggregate score and falls
-back to code-scanning findings. See [`docs/BRIEF.md`](docs/BRIEF.md) and
-[`docs/phase0-findings.md`](docs/phase0-findings.md) for the full design and the
-API research it is built on.
+Scorecard, zizmor, and aislop; Scorecard prefers the external aggregate score
+and falls back to code-scanning findings. See [`docs/BRIEF.md`](docs/BRIEF.md)
+and [`docs/phase0-findings.md`](docs/phase0-findings.md) for the full design and
+the API research it is built on.
+
+The workflow-driven signals (OpenSSF Scorecard, zizmor, aislop) only produce
+data when an organisation has deployed supporting workflows. The tool checks
+for that support cheaply before collecting (**feature gating**): an
+organisation with no evidence of a tool — no ruleset requiring its workflow,
+no alerts, no analyses on a sample of repositories — gets a single
+`⏩ Skipping feature: organisation support missing` line for that section
+instead of a nag list. See the
+[organisation scan setup guide](docs/org-scan-setup.md) for the required
+workflows, and disable the check with `report.gating: false` if you want to
+probe everything regardless.
 
 Further sections report **configuration posture** and **freshness** as plain
 tables (org mode):
@@ -109,7 +120,7 @@ organisation and **Repository access** set to *All repositories*, then grant:
 | Metadata | Mandatory baseline; listing organisation repositories |
 | Contents | `.github/dependabot.yml`, latest release, and tag dates |
 | Dependabot alerts | Open Dependabot vulnerability alerts |
-| Code scanning alerts | CodeQL / Scorecard / zizmor findings |
+| Code scanning alerts | CodeQL / Scorecard / zizmor / aislop findings |
 | Secret scanning alerts | Open secret-scanning alerts |
 | Administration | Dependabot enablement + security-updates status, and effective branch rules |
 
@@ -267,7 +278,7 @@ both true.
 The example above hides Zizmor on every surface, and keeps Releases / Tagging
 out of the terminal and Slack while still publishing it to the Markdown and HTML
 Pages output. The valid category keys are: `codeql`, `scorecard`, `zizmor`,
-`dependabot_alerts`, `secret_scanning`, `dependabot_alerts_enabled`,
+`aislop`, `dependabot_alerts`, `secret_scanning`, `dependabot_alerts_enabled`,
 `dependabot_updates_enabled`, `dependabot_cooldown`, `releases`,
 `mutable_releases`, `private_vulnerability_reporting`. Like the other `report`
 settings, `categories` can be set
@@ -284,19 +295,49 @@ unless every org sharing that channel also disables it (this mirrors the
 most-generous `top_n` rule applied to the same grouping). The terminal, Markdown
 and HTML surfaces are per-org and are not affected by this union.
 
+### Organisation feature gating
+
+The workflow-driven signals (OpenSSF Scorecard, zizmor, aislop) need
+organisation-deployed workflows before they produce any data (see the
+[organisation scan setup guide](docs/org-scan-setup.md)). By default the tool
+runs a cheap support check per organisation before collecting each of them:
+evidence is an org ruleset requiring the tool's workflow, existing
+code-scanning alerts from the tool, analyses on a sample of repositories, or
+(for Scorecard) an external scorecard.dev score. A signal with no evidence is
+**skipped** — not probed per repository, not classified — and its section
+shows a single `⏩ Skipping feature: organisation support missing` line
+linking the setup guide, on every output surface. Set `report.gating` to
+`false` (globally or per organisation) to always probe everything:
+
+```json
+{
+  "report": { "gating": false },
+  "organizations": [{ "name": "lfreleng-actions" }]
+}
+```
+
+Gating decides **collection**; the per-category render toggles above decide
+**presentation**. A skipped section still renders (as the one-line notice)
+unless its category is also disabled.
+
 ### Pass/fail severity cutoff
 
-The severity-ranked signals (CodeQL, Scorecard, Zizmor, Dependabot alerts) use a
-`fail_severity` cutoff to decide when a repository counts as a failure. A
-repository is flagged as an offender only when it carries a finding **at or
-above** the cutoff; findings below it fold into the clean count. Severities run
-(lowest to highest) `informational`, `low`, `medium`, `high`, `critical` —
-`informational` being the new sub-low rung that SARIF `note`/`none` findings
-(the bulk of a tool like Zizmor) normalise to.
+The severity-ranked signals (CodeQL, Scorecard, Zizmor, aislop, Dependabot
+alerts) use a `fail_severity` cutoff to decide when a repository counts as a
+failure. A repository is flagged as an offender only when it carries a finding
+**at or above** the cutoff; findings below it fold into the clean count.
+Severities run (lowest to highest) `informational`, `low`, `medium`, `high`,
+`critical` — `informational` being the sub-low rung for SARIF `none` findings
+and unclassifiable alerts. Zizmor's SARIF `note` findings normalise to `low`
+(zizmor emits its Low findings at `note`, and the organisation scan pipeline's
+`--min-severity low` floor keeps informational findings out of the uploaded
+SARIF), matching the ruleset-enforced PR gate that blocks on note-and-above.
+aislop populates the same SARIF level axis and normalises identically.
 
 The global default cutoff is `medium`, so `low` and `informational` findings
-pass. Zizmor defaults to `low` (only `informational` passes). Override the
-cutoff per category under `report.categories.<key>.fail_severity`:
+pass. Zizmor and aislop default to `low` (only `informational` passes).
+Override the cutoff per category under
+`report.categories.<key>.fail_severity`:
 
 ```json
 {
@@ -382,8 +423,57 @@ uvx github-security-report report
 uvx github-security-report report --org lfreleng-actions
 ```
 
+## Remediation
+
+The `remediate` subcommand is the in-tool counterpart to the report: it runs the
+same collection, then switches on each selected security feature wherever a
+repository has it **confirmed off**. Only the offenders the report already
+surfaces are acted on — repositories whose state could not be read are counted
+as *unknown* and are never written to, so remediation never blind-writes.
+
+It is **dry run by default** (these are privileged writes); pass `--apply` to
+make changes. A single **write-capable** org-admin token (from `--token-env`,
+default `GITHUB_TOKEN`) drives both the read and the writes across every
+configured organisation, so it bypasses the per-org read-only `token_env` in the
+config.
+
+```bash
+# An org-admin token is required: a classic PAT with the `repo` scope
+# (administers repository security settings) plus `read:org` to enumerate repos.
+source ~/.secrets.github.classic.god   # exports $GITHUB_TOKEN
+
+# Dry run (default): preview every change, touch nothing.
+uvx github-security-report remediate --org lfreleng-actions
+
+# Apply: enable every remediable feature that is off, across all configured orgs.
+uvx github-security-report remediate \
+  --config ~/.config/github-security-report/config.json --apply
+
+# Limit to specific categories (repeatable).
+uvx github-security-report remediate --org lfreleng-actions \
+  --category codeql --category private_vulnerability_reporting --apply
+```
+
+The remediable categories are the simple on/off features with a documented
+enablement endpoint:
+
+| `--category` | Enables |
+|---|---|
+| `codeql` | CodeQL default setup (provisioned asynchronously) |
+| `secret_scanning` | Secret scanning |
+| `dependabot_alerts_enabled` | Dependabot vulnerability alerts |
+| `dependabot_updates_enabled` | Dependabot security updates (plus alerts) |
+| `private_vulnerability_reporting` | Private vulnerability reporting |
+
+Qualitative findings (Scorecard, zizmor, open Dependabot alerts, cooldown,
+release freshness/mutability) are reported but not auto-remediated. Remediation
+is organisation-scoped (`--scope org`, the default and only supported scope).
+
 ## Bulk Remediation Scripts
 
+The standalone scripts below predate the `remediate` subcommand and remain for
+ad-hoc, single-feature runs. For most workflows, prefer `remediate` above.
+
 The report ends with **nag lists** — repositories where a supported feature is
 switched off. Where GitHub exposes the relevant toggle through its REST API,
 the [`scripts/`](scripts/) directory ships standalone helpers that clear a whole
@@ -405,7 +495,8 @@ the current state of each repository, enables the feature where it is off, and
 verifies the result.
 
 ```bash
-# An org-admin token is required (classic PAT with repo admin / admin:org).
+# An org-admin token is required: a classic PAT with the `repo` scope
+# (administers repository security settings) plus `read:org` to enumerate repos.
 source ~/.secrets.github.classic.god   # exports $GITHUB_TOKEN
 
 # Dry run (default): preview every change, touch nothing.

{github_security_report-0.5.0 → github_security_report-0.7.0}/pyproject.toml

@@ -45,7 +45,7 @@ keywords = [
 ]
 dependencies = [
   "httpx[http2]==0.28.1",
-  "typer==0.26.7",
+  "typer==0.26.8",
   "rich==15.0.0",
   "jinja2==3.1.6",
   "jsonschema==4.26.0",
@@ -63,7 +63,7 @@ dev = [
   "pytest-asyncio==1.4.0",
   "pytest-cov==7.1.0",
   "respx==0.23.1",
-  "syrupy==5.3.3",
+  "syrupy==5.3.4",
   "mypy==2.1.0",
   "ruff==0.15.20",
   "types-jsonschema==4.26.0.20260518",
@@ -95,7 +95,7 @@ dev = [
   "pytest-asyncio==1.4.0",
   "pytest-cov==7.1.0",
   "respx==0.23.1",
-  "syrupy==5.3.3",
+  "syrupy==5.3.4",
   "mypy==2.1.0",
   "ruff==0.15.20",
   "types-jsonschema==4.26.0.20260518",

{github_security_report-0.5.0 → github_security_report-0.7.0}/src/github_security_report/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.5.0'
-__version_tuple__ = version_tuple = (0, 5, 0)
+__version__ = version = '0.7.0'
+__version_tuple__ = version_tuple = (0, 7, 0)
 
 __commit_id__ = commit_id = None

{github_security_report-0.5.0 → github_security_report-0.7.0}/src/github_security_report/categories.py

@@ -31,6 +31,7 @@ class CategoryKey(str, Enum):
     CODEQL = "codeql"
     SCORECARD = "scorecard"
     ZIZMOR = "zizmor"
+    AISLOP = "aislop"
     DEPENDABOT_ALERTS = "dependabot_alerts"
     SECRET_SCANNING = "secret_scanning"
     DEPENDABOT_ALERTS_ENABLED = "dependabot_alerts_enabled"
@@ -105,8 +106,24 @@ _CATEGORIES: dict[CategoryKey, CategoryMeta] = {
             "Zizmor static analysis of GitHub Actions workflows, ranked "
             "worst-first by severity."
         ),
-        # Zizmor's advisory "note" findings normalise to informational; only
-        # those pass. A low-or-higher zizmor finding is treated as a failure.
+        # zizmor emits its Low findings at SARIF level "note", which
+        # normalises to LOW (see severity.py), so any zizmor finding fails --
+        # matching the ruleset-enforced PR gate that blocks on note-and-above.
+        fail_severity=Severity.LOW,
+    ),
+    CategoryKey.AISLOP: CategoryMeta(
+        key=CategoryKey.AISLOP,
+        title="AI Slop Analysis",
+        pass_label="Clean",
+        fail_label=None,
+        url="https://github.com/scanaislop/aislop",
+        description=(
+            "aislop AI-slop / code-quality findings, ranked worst-first by "
+            "severity."
+        ),
+        # aislop, like zizmor, populates only the SARIF level axis
+        # (error/warning/note); "note" normalises to LOW (see severity.py), so
+        # any aislop finding fails -- matching the ruleset-enforced PR gate.
         fail_severity=Severity.LOW,
     ),
     CategoryKey.DEPENDABOT_ALERTS: CategoryMeta(

{github_security_report-0.5.0 → github_security_report-0.7.0}/src/github_security_report/classify.py

@@ -6,8 +6,8 @@ Pure, transport-free logic encoding every Phase 0 finding
 (``docs/phase0-findings.md``):
 
 - the single code-scanning feed is partitioned by ``tool.name`` into CodeQL,
-  Scorecard and zizmor -- counts are filtered per tool;
-- CodeQL/Scorecard/zizmor enablement is the presence of that tool in
+  Scorecard, zizmor and aislop -- counts are filtered per tool;
+- CodeQL/Scorecard/zizmor/aislop enablement is the presence of that tool in
   ``code-scanning/analyses`` (not ``default-setup``); a 404 on code scanning
   means it is disabled entirely;
 - secret scanning 404 = disabled, 200 [] = enabled-clean;
@@ -18,11 +18,12 @@ Pure, transport-free logic encoding every Phase 0 finding
 
 from __future__ import annotations
 
-from collections.abc import Mapping
+from collections.abc import Callable, Mapping, Set
 from dataclasses import dataclass, field
 
 from github_security_report import severity
 from github_security_report.models import (
+    CODE_SCANNING_TOOLS,
     Repo,
     RepoSignal,
     RepoState,
@@ -50,7 +51,7 @@ class RepoFacts:
     """Raw per-repository facts gathered by the client, pre-classification."""
 
     repo: Repo
-    # Code scanning (covers CodeQL, Scorecard, zizmor).
+    # Code scanning (covers CodeQL, Scorecard, zizmor, aislop).
     code_scanning_status: int = 200  # 200 ok, 404 disabled, 403 forbidden
     code_scanning_tools: set[str] = field(default_factory=set)  # analyses tool names
     code_scanning_alerts: list[dict] = field(default_factory=list)  # all tools
@@ -149,7 +150,10 @@ def classify_codeql(
     facts: RepoFacts, fail_severities: FailSeverities | None = None
 ) -> RepoSignal:
     return _code_scanning_tool_signal(
-        facts, SignalType.CODEQL, "CodeQL", fail_severities
+        facts,
+        SignalType.CODEQL,
+        CODE_SCANNING_TOOLS[SignalType.CODEQL],
+        fail_severities,
     )
 
 
@@ -157,7 +161,21 @@ def classify_zizmor(
     facts: RepoFacts, fail_severities: FailSeverities | None = None
 ) -> RepoSignal:
     return _code_scanning_tool_signal(
-        facts, SignalType.ZIZMOR, "zizmor", fail_severities
+        facts,
+        SignalType.ZIZMOR,
+        CODE_SCANNING_TOOLS[SignalType.ZIZMOR],
+        fail_severities,
+    )
+
+
+def classify_aislop(
+    facts: RepoFacts, fail_severities: FailSeverities | None = None
+) -> RepoSignal:
+    return _code_scanning_tool_signal(
+        facts,
+        SignalType.AISLOP,
+        CODE_SCANNING_TOOLS[SignalType.AISLOP],
+        fail_severities,
     )
 
 
@@ -166,8 +184,13 @@ def classify_scorecard(
 ) -> RepoSignal:
     """Scorecard: prefer the external aggregate score, else code-scanning findings."""
     repo = facts.repo
-    counts = count_code_scanning(facts.code_scanning_alerts, "Scorecard")
-    has_cs = "Scorecard" in facts.code_scanning_tools and facts.code_scanning_status == 200
+    counts = count_code_scanning(
+        facts.code_scanning_alerts, CODE_SCANNING_TOOLS[SignalType.SCORECARD]
+    )
+    has_cs = (
+        CODE_SCANNING_TOOLS[SignalType.SCORECARD] in facts.code_scanning_tools
+        and facts.code_scanning_status == 200
+    )
     cutoff = _cutoff(SignalType.SCORECARD, fail_severities)
 
     if facts.scorecard_status == 200 and facts.scorecard_score is not None:
@@ -241,22 +264,36 @@ def classify_dependabot(
     return RepoSignal(repo, SignalType.DEPENDABOT, state, counts=counts)
 
 
-_CLASSIFIERS = (
-    classify_codeql,
-    classify_scorecard,
-    classify_zizmor,
-    classify_dependabot,
-    classify_secret_scanning,
-)
+# One classifier per signal, keyed so orchestration can skip gated-out signals.
+_Classifier = Callable[["RepoFacts", "FailSeverities | None"], RepoSignal]
+
+_CLASSIFIERS: dict[SignalType, _Classifier] = {
+    SignalType.CODEQL: classify_codeql,
+    SignalType.SCORECARD: classify_scorecard,
+    SignalType.ZIZMOR: classify_zizmor,
+    SignalType.AISLOP: classify_aislop,
+    SignalType.DEPENDABOT: classify_dependabot,
+    SignalType.SECRET_SCANNING: classify_secret_scanning,
+}
 
 
 def classify_repo(
-    facts: RepoFacts, fail_severities: FailSeverities | None = None
+    facts: RepoFacts,
+    fail_severities: FailSeverities | None = None,
+    *,
+    skip: Set[SignalType] = frozenset(),
 ) -> list[RepoSignal]:
-    """Classify a repository across all five signals.
+    """Classify a repository across all signals (minus any in ``skip``).
 
     ``fail_severities`` optionally overrides the per-signal fail-severity cutoff
     (otherwise each signal uses its category default); it governs which findings
-    are severe enough to mark a repository as an offender.
+    are severe enough to mark a repository as an offender. ``skip`` names
+    signals to leave unclassified entirely -- used when organisation feature
+    gating (:mod:`gating`) found no support for a workflow-driven tool, so the
+    repository is neither nagged nor counted for that signal.
     """
-    return [classifier(facts, fail_severities) for classifier in _CLASSIFIERS]
+    return [
+        classifier(facts, fail_severities)
+        for signal, classifier in _CLASSIFIERS.items()
+        if signal not in skip
+    ]