github-security-report 0.6.0__tar.gz → 0.7.0__tar.gz

{github_security_report-0.6.0 → github_security_report-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: github-security-report
-Version: 0.6.0
+Version: 0.7.0
 Summary: Security and quality reporting across GitHub organisations
 Project-URL: Homepage, https://github.com/lfreleng-actions/github-security-report-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github-security-report-action
@@ -56,8 +56,8 @@ Description-Content-Type: text/markdown
 
 > Security and quality **reporting** (not scanning) across GitHub
 > organisations. Aggregates existing signals — CodeQL, OpenSSF Scorecard,
-> zizmor, Dependabot, and secret scanning — and ranks the worst offenders so
-> remediation effort goes where it is needed.
+> zizmor, aislop (AI slop), Dependabot, and secret scanning — and ranks the
+> worst offenders so remediation effort goes where it is needed.
 
 ## 🗒️ Published reports
 
@@ -82,10 +82,21 @@ stay brevity-first; the explanatory per-category description and documentation
 link are shown only on the richer Markdown and HTML (GitHub Pages) outputs.
 
 The single GitHub code-scanning feed is partitioned by `tool.name` into CodeQL,
-Scorecard, and zizmor; Scorecard prefers the external aggregate score and falls
-back to code-scanning findings. See [`docs/BRIEF.md`](docs/BRIEF.md) and
-[`docs/phase0-findings.md`](docs/phase0-findings.md) for the full design and the
-API research it is built on.
+Scorecard, zizmor, and aislop; Scorecard prefers the external aggregate score
+and falls back to code-scanning findings. See [`docs/BRIEF.md`](docs/BRIEF.md)
+and [`docs/phase0-findings.md`](docs/phase0-findings.md) for the full design and
+the API research it is built on.
+
+The workflow-driven signals (OpenSSF Scorecard, zizmor, aislop) only produce
+data when an organisation has deployed supporting workflows. The tool checks
+for that support cheaply before collecting (**feature gating**): an
+organisation with no evidence of a tool — no ruleset requiring its workflow,
+no alerts, no analyses on a sample of repositories — gets a single
+`⏩ Skipping feature: organisation support missing` line for that section
+instead of a nag list. See the
+[organisation scan setup guide](docs/org-scan-setup.md) for the required
+workflows, and disable the check with `report.gating: false` if you want to
+probe everything regardless.
 
 Further sections report **configuration posture** and **freshness** as plain
 tables (org mode):
@@ -153,7 +164,7 @@ organisation and **Repository access** set to *All repositories*, then grant:
 | Metadata | Mandatory baseline; listing organisation repositories |
 | Contents | `.github/dependabot.yml`, latest release, and tag dates |
 | Dependabot alerts | Open Dependabot vulnerability alerts |
-| Code scanning alerts | CodeQL / Scorecard / zizmor findings |
+| Code scanning alerts | CodeQL / Scorecard / zizmor / aislop findings |
 | Secret scanning alerts | Open secret-scanning alerts |
 | Administration | Dependabot enablement + security-updates status, and effective branch rules |
 
@@ -311,7 +322,7 @@ both true.
 The example above hides Zizmor on every surface, and keeps Releases / Tagging
 out of the terminal and Slack while still publishing it to the Markdown and HTML
 Pages output. The valid category keys are: `codeql`, `scorecard`, `zizmor`,
-`dependabot_alerts`, `secret_scanning`, `dependabot_alerts_enabled`,
+`aislop`, `dependabot_alerts`, `secret_scanning`, `dependabot_alerts_enabled`,
 `dependabot_updates_enabled`, `dependabot_cooldown`, `releases`,
 `mutable_releases`, `private_vulnerability_reporting`. Like the other `report`
 settings, `categories` can be set
@@ -328,22 +339,49 @@ unless every org sharing that channel also disables it (this mirrors the
 most-generous `top_n` rule applied to the same grouping). The terminal, Markdown
 and HTML surfaces are per-org and are not affected by this union.
 
+### Organisation feature gating
+
+The workflow-driven signals (OpenSSF Scorecard, zizmor, aislop) need
+organisation-deployed workflows before they produce any data (see the
+[organisation scan setup guide](docs/org-scan-setup.md)). By default the tool
+runs a cheap support check per organisation before collecting each of them:
+evidence is an org ruleset requiring the tool's workflow, existing
+code-scanning alerts from the tool, analyses on a sample of repositories, or
+(for Scorecard) an external scorecard.dev score. A signal with no evidence is
+**skipped** — not probed per repository, not classified — and its section
+shows a single `⏩ Skipping feature: organisation support missing` line
+linking the setup guide, on every output surface. Set `report.gating` to
+`false` (globally or per organisation) to always probe everything:
+
+```json
+{
+  "report": { "gating": false },
+  "organizations": [{ "name": "lfreleng-actions" }]
+}
+```
+
+Gating decides **collection**; the per-category render toggles above decide
+**presentation**. A skipped section still renders (as the one-line notice)
+unless its category is also disabled.
+
 ### Pass/fail severity cutoff
 
-The severity-ranked signals (CodeQL, Scorecard, Zizmor, Dependabot alerts) use a
-`fail_severity` cutoff to decide when a repository counts as a failure. A
-repository is flagged as an offender only when it carries a finding **at or
-above** the cutoff; findings below it fold into the clean count. Severities run
-(lowest to highest) `informational`, `low`, `medium`, `high`, `critical` —
-`informational` being the sub-low rung for SARIF `none` findings and
-unclassifiable alerts. Zizmor's SARIF `note` findings normalise to `low`
+The severity-ranked signals (CodeQL, Scorecard, Zizmor, aislop, Dependabot
+alerts) use a `fail_severity` cutoff to decide when a repository counts as a
+failure. A repository is flagged as an offender only when it carries a finding
+**at or above** the cutoff; findings below it fold into the clean count.
+Severities run (lowest to highest) `informational`, `low`, `medium`, `high`,
+`critical` — `informational` being the sub-low rung for SARIF `none` findings
+and unclassifiable alerts. Zizmor's SARIF `note` findings normalise to `low`
 (zizmor emits its Low findings at `note`, and the organisation scan pipeline's
 `--min-severity low` floor keeps informational findings out of the uploaded
 SARIF), matching the ruleset-enforced PR gate that blocks on note-and-above.
+aislop populates the same SARIF level axis and normalises identically.
 
 The global default cutoff is `medium`, so `low` and `informational` findings
-pass. Zizmor defaults to `low` (only `informational` passes). Override the
-cutoff per category under `report.categories.<key>.fail_severity`:
+pass. Zizmor and aislop default to `low` (only `informational` passes).
+Override the cutoff per category under
+`report.categories.<key>.fail_severity`:
 
 ```json
 {

{github_security_report-0.6.0 → github_security_report-0.7.0}/README.md

@@ -12,8 +12,8 @@
 
 > Security and quality **reporting** (not scanning) across GitHub
 > organisations. Aggregates existing signals — CodeQL, OpenSSF Scorecard,
-> zizmor, Dependabot, and secret scanning — and ranks the worst offenders so
-> remediation effort goes where it is needed.
+> zizmor, aislop (AI slop), Dependabot, and secret scanning — and ranks the
+> worst offenders so remediation effort goes where it is needed.
 
 ## 🗒️ Published reports
 
@@ -38,10 +38,21 @@ stay brevity-first; the explanatory per-category description and documentation
 link are shown only on the richer Markdown and HTML (GitHub Pages) outputs.
 
 The single GitHub code-scanning feed is partitioned by `tool.name` into CodeQL,
-Scorecard, and zizmor; Scorecard prefers the external aggregate score and falls
-back to code-scanning findings. See [`docs/BRIEF.md`](docs/BRIEF.md) and
-[`docs/phase0-findings.md`](docs/phase0-findings.md) for the full design and the
-API research it is built on.
+Scorecard, zizmor, and aislop; Scorecard prefers the external aggregate score
+and falls back to code-scanning findings. See [`docs/BRIEF.md`](docs/BRIEF.md)
+and [`docs/phase0-findings.md`](docs/phase0-findings.md) for the full design and
+the API research it is built on.
+
+The workflow-driven signals (OpenSSF Scorecard, zizmor, aislop) only produce
+data when an organisation has deployed supporting workflows. The tool checks
+for that support cheaply before collecting (**feature gating**): an
+organisation with no evidence of a tool — no ruleset requiring its workflow,
+no alerts, no analyses on a sample of repositories — gets a single
+`⏩ Skipping feature: organisation support missing` line for that section
+instead of a nag list. See the
+[organisation scan setup guide](docs/org-scan-setup.md) for the required
+workflows, and disable the check with `report.gating: false` if you want to
+probe everything regardless.
 
 Further sections report **configuration posture** and **freshness** as plain
 tables (org mode):
@@ -109,7 +120,7 @@ organisation and **Repository access** set to *All repositories*, then grant:
 | Metadata | Mandatory baseline; listing organisation repositories |
 | Contents | `.github/dependabot.yml`, latest release, and tag dates |
 | Dependabot alerts | Open Dependabot vulnerability alerts |
-| Code scanning alerts | CodeQL / Scorecard / zizmor findings |
+| Code scanning alerts | CodeQL / Scorecard / zizmor / aislop findings |
 | Secret scanning alerts | Open secret-scanning alerts |
 | Administration | Dependabot enablement + security-updates status, and effective branch rules |
 
@@ -267,7 +278,7 @@ both true.
 The example above hides Zizmor on every surface, and keeps Releases / Tagging
 out of the terminal and Slack while still publishing it to the Markdown and HTML
 Pages output. The valid category keys are: `codeql`, `scorecard`, `zizmor`,
-`dependabot_alerts`, `secret_scanning`, `dependabot_alerts_enabled`,
+`aislop`, `dependabot_alerts`, `secret_scanning`, `dependabot_alerts_enabled`,
 `dependabot_updates_enabled`, `dependabot_cooldown`, `releases`,
 `mutable_releases`, `private_vulnerability_reporting`. Like the other `report`
 settings, `categories` can be set
@@ -284,22 +295,49 @@ unless every org sharing that channel also disables it (this mirrors the
 most-generous `top_n` rule applied to the same grouping). The terminal, Markdown
 and HTML surfaces are per-org and are not affected by this union.
 
+### Organisation feature gating
+
+The workflow-driven signals (OpenSSF Scorecard, zizmor, aislop) need
+organisation-deployed workflows before they produce any data (see the
+[organisation scan setup guide](docs/org-scan-setup.md)). By default the tool
+runs a cheap support check per organisation before collecting each of them:
+evidence is an org ruleset requiring the tool's workflow, existing
+code-scanning alerts from the tool, analyses on a sample of repositories, or
+(for Scorecard) an external scorecard.dev score. A signal with no evidence is
+**skipped** — not probed per repository, not classified — and its section
+shows a single `⏩ Skipping feature: organisation support missing` line
+linking the setup guide, on every output surface. Set `report.gating` to
+`false` (globally or per organisation) to always probe everything:
+
+```json
+{
+  "report": { "gating": false },
+  "organizations": [{ "name": "lfreleng-actions" }]
+}
+```
+
+Gating decides **collection**; the per-category render toggles above decide
+**presentation**. A skipped section still renders (as the one-line notice)
+unless its category is also disabled.
+
 ### Pass/fail severity cutoff
 
-The severity-ranked signals (CodeQL, Scorecard, Zizmor, Dependabot alerts) use a
-`fail_severity` cutoff to decide when a repository counts as a failure. A
-repository is flagged as an offender only when it carries a finding **at or
-above** the cutoff; findings below it fold into the clean count. Severities run
-(lowest to highest) `informational`, `low`, `medium`, `high`, `critical` —
-`informational` being the sub-low rung for SARIF `none` findings and
-unclassifiable alerts. Zizmor's SARIF `note` findings normalise to `low`
+The severity-ranked signals (CodeQL, Scorecard, Zizmor, aislop, Dependabot
+alerts) use a `fail_severity` cutoff to decide when a repository counts as a
+failure. A repository is flagged as an offender only when it carries a finding
+**at or above** the cutoff; findings below it fold into the clean count.
+Severities run (lowest to highest) `informational`, `low`, `medium`, `high`,
+`critical` — `informational` being the sub-low rung for SARIF `none` findings
+and unclassifiable alerts. Zizmor's SARIF `note` findings normalise to `low`
 (zizmor emits its Low findings at `note`, and the organisation scan pipeline's
 `--min-severity low` floor keeps informational findings out of the uploaded
 SARIF), matching the ruleset-enforced PR gate that blocks on note-and-above.
+aislop populates the same SARIF level axis and normalises identically.
 
 The global default cutoff is `medium`, so `low` and `informational` findings
-pass. Zizmor defaults to `low` (only `informational` passes). Override the
-cutoff per category under `report.categories.<key>.fail_severity`:
+pass. Zizmor and aislop default to `low` (only `informational` passes).
+Override the cutoff per category under
+`report.categories.<key>.fail_severity`:
 
 ```json
 {

{github_security_report-0.6.0 → github_security_report-0.7.0}/src/github_security_report/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.6.0'
-__version_tuple__ = version_tuple = (0, 6, 0)
+__version__ = version = '0.7.0'
+__version_tuple__ = version_tuple = (0, 7, 0)
 
 __commit_id__ = commit_id = None

{github_security_report-0.6.0 → github_security_report-0.7.0}/src/github_security_report/categories.py

@@ -31,6 +31,7 @@ class CategoryKey(str, Enum):
     CODEQL = "codeql"
     SCORECARD = "scorecard"
     ZIZMOR = "zizmor"
+    AISLOP = "aislop"
     DEPENDABOT_ALERTS = "dependabot_alerts"
     SECRET_SCANNING = "secret_scanning"
     DEPENDABOT_ALERTS_ENABLED = "dependabot_alerts_enabled"
@@ -110,6 +111,21 @@ _CATEGORIES: dict[CategoryKey, CategoryMeta] = {
         # matching the ruleset-enforced PR gate that blocks on note-and-above.
         fail_severity=Severity.LOW,
     ),
+    CategoryKey.AISLOP: CategoryMeta(
+        key=CategoryKey.AISLOP,
+        title="AI Slop Analysis",
+        pass_label="Clean",
+        fail_label=None,
+        url="https://github.com/scanaislop/aislop",
+        description=(
+            "aislop AI-slop / code-quality findings, ranked worst-first by "
+            "severity."
+        ),
+        # aislop, like zizmor, populates only the SARIF level axis
+        # (error/warning/note); "note" normalises to LOW (see severity.py), so
+        # any aislop finding fails -- matching the ruleset-enforced PR gate.
+        fail_severity=Severity.LOW,
+    ),
     CategoryKey.DEPENDABOT_ALERTS: CategoryMeta(
         key=CategoryKey.DEPENDABOT_ALERTS,
         title="Dependabot: Security Alerts",

{github_security_report-0.6.0 → github_security_report-0.7.0}/src/github_security_report/classify.py

@@ -6,8 +6,8 @@ Pure, transport-free logic encoding every Phase 0 finding
 (``docs/phase0-findings.md``):
 
 - the single code-scanning feed is partitioned by ``tool.name`` into CodeQL,
-  Scorecard and zizmor -- counts are filtered per tool;
-- CodeQL/Scorecard/zizmor enablement is the presence of that tool in
+  Scorecard, zizmor and aislop -- counts are filtered per tool;
+- CodeQL/Scorecard/zizmor/aislop enablement is the presence of that tool in
   ``code-scanning/analyses`` (not ``default-setup``); a 404 on code scanning
   means it is disabled entirely;
 - secret scanning 404 = disabled, 200 [] = enabled-clean;
@@ -18,11 +18,12 @@ Pure, transport-free logic encoding every Phase 0 finding
 
 from __future__ import annotations
 
-from collections.abc import Mapping
+from collections.abc import Callable, Mapping, Set
 from dataclasses import dataclass, field
 
 from github_security_report import severity
 from github_security_report.models import (
+    CODE_SCANNING_TOOLS,
     Repo,
     RepoSignal,
     RepoState,
@@ -50,7 +51,7 @@ class RepoFacts:
     """Raw per-repository facts gathered by the client, pre-classification."""
 
     repo: Repo
-    # Code scanning (covers CodeQL, Scorecard, zizmor).
+    # Code scanning (covers CodeQL, Scorecard, zizmor, aislop).
     code_scanning_status: int = 200  # 200 ok, 404 disabled, 403 forbidden
     code_scanning_tools: set[str] = field(default_factory=set)  # analyses tool names
     code_scanning_alerts: list[dict] = field(default_factory=list)  # all tools
@@ -149,7 +150,10 @@ def classify_codeql(
     facts: RepoFacts, fail_severities: FailSeverities | None = None
 ) -> RepoSignal:
     return _code_scanning_tool_signal(
-        facts, SignalType.CODEQL, "CodeQL", fail_severities
+        facts,
+        SignalType.CODEQL,
+        CODE_SCANNING_TOOLS[SignalType.CODEQL],
+        fail_severities,
     )
 
 
@@ -157,7 +161,21 @@ def classify_zizmor(
     facts: RepoFacts, fail_severities: FailSeverities | None = None
 ) -> RepoSignal:
     return _code_scanning_tool_signal(
-        facts, SignalType.ZIZMOR, "zizmor", fail_severities
+        facts,
+        SignalType.ZIZMOR,
+        CODE_SCANNING_TOOLS[SignalType.ZIZMOR],
+        fail_severities,
+    )
+
+
+def classify_aislop(
+    facts: RepoFacts, fail_severities: FailSeverities | None = None
+) -> RepoSignal:
+    return _code_scanning_tool_signal(
+        facts,
+        SignalType.AISLOP,
+        CODE_SCANNING_TOOLS[SignalType.AISLOP],
+        fail_severities,
     )
 
 
@@ -166,8 +184,13 @@ def classify_scorecard(
 ) -> RepoSignal:
     """Scorecard: prefer the external aggregate score, else code-scanning findings."""
     repo = facts.repo
-    counts = count_code_scanning(facts.code_scanning_alerts, "Scorecard")
-    has_cs = "Scorecard" in facts.code_scanning_tools and facts.code_scanning_status == 200
+    counts = count_code_scanning(
+        facts.code_scanning_alerts, CODE_SCANNING_TOOLS[SignalType.SCORECARD]
+    )
+    has_cs = (
+        CODE_SCANNING_TOOLS[SignalType.SCORECARD] in facts.code_scanning_tools
+        and facts.code_scanning_status == 200
+    )
     cutoff = _cutoff(SignalType.SCORECARD, fail_severities)
 
     if facts.scorecard_status == 200 and facts.scorecard_score is not None:
@@ -241,22 +264,36 @@ def classify_dependabot(
     return RepoSignal(repo, SignalType.DEPENDABOT, state, counts=counts)
 
 
-_CLASSIFIERS = (
-    classify_codeql,
-    classify_scorecard,
-    classify_zizmor,
-    classify_dependabot,
-    classify_secret_scanning,
-)
+# One classifier per signal, keyed so orchestration can skip gated-out signals.
+_Classifier = Callable[["RepoFacts", "FailSeverities | None"], RepoSignal]
+
+_CLASSIFIERS: dict[SignalType, _Classifier] = {
+    SignalType.CODEQL: classify_codeql,
+    SignalType.SCORECARD: classify_scorecard,
+    SignalType.ZIZMOR: classify_zizmor,
+    SignalType.AISLOP: classify_aislop,
+    SignalType.DEPENDABOT: classify_dependabot,
+    SignalType.SECRET_SCANNING: classify_secret_scanning,
+}
 
 
 def classify_repo(
-    facts: RepoFacts, fail_severities: FailSeverities | None = None
+    facts: RepoFacts,
+    fail_severities: FailSeverities | None = None,
+    *,
+    skip: Set[SignalType] = frozenset(),
 ) -> list[RepoSignal]:
-    """Classify a repository across all five signals.
+    """Classify a repository across all signals (minus any in ``skip``).
 
     ``fail_severities`` optionally overrides the per-signal fail-severity cutoff
     (otherwise each signal uses its category default); it governs which findings
-    are severe enough to mark a repository as an offender.
+    are severe enough to mark a repository as an offender. ``skip`` names
+    signals to leave unclassified entirely -- used when organisation feature
+    gating (:mod:`gating`) found no support for a workflow-driven tool, so the
+    repository is neither nagged nor counted for that signal.
     """
-    return [classifier(facts, fail_severities) for classifier in _CLASSIFIERS]
+    return [
+        classifier(facts, fail_severities)
+        for signal, classifier in _CLASSIFIERS.items()
+        if signal not in skip
+    ]

{github_security_report-0.6.0 → github_security_report-0.7.0}/src/github_security_report/cli.py

@@ -128,6 +128,9 @@ def _org_to_dict(org: OrgReport) -> dict:
                 "clean_count": s.clean_count,
                 "nag": [r.full_name for r in s.nag_repos],
                 "unknown_count": s.unknown_count,
+                # True when organisation feature gating skipped this signal
+                # (no supporting workflows found), so nothing was collected.
+                "skipped": s.skipped,
             }
             for s in org.sections
         ],

{github_security_report-0.6.0 → github_security_report-0.7.0}/src/github_security_report/client.py

@@ -21,7 +21,12 @@ from typing import cast
 
 import httpx
 
-from github_security_report.models import ReleaseRef, Repo, RepoGraphData
+from github_security_report.models import (
+    CODE_SCANNING_TOOLS,
+    ReleaseRef,
+    Repo,
+    RepoGraphData,
+)
 
 log = logging.getLogger(__name__)
 
@@ -122,8 +127,9 @@ query($owner: String!, $name: String!) {
 # The code-scanning-derived signal tools whose enablement we probe per repo.
 # Each is checked via the analyses ``tool_name`` filter (a definitive presence
 # test) rather than scanning the analysis history, which a busy repo could push
-# a low-frequency tool out of.
-_CODE_SCANNING_SIGNAL_TOOLS = ("CodeQL", "Scorecard", "zizmor")
+# a low-frequency tool out of. Derived from the shared signal->tool mapping so
+# adding a SARIF-uploading tool needs no client change.
+_CODE_SCANNING_SIGNAL_TOOLS = tuple(CODE_SCANNING_TOOLS.values())
 
 # Batched per-repo prefetch. One aliased query fetches, for many repositories
 # at once: Dependabot-alerts enablement, the most-recent tag's commit date
@@ -558,48 +564,76 @@ class GitHubClient:
     # ------------------------------------------------------------------ #
     # Per-repo enabled-probes
     # ------------------------------------------------------------------ #
-    async def code_scanning_tools(self, org: str, repo: str) -> tuple[int, set[str]]:
-        """Return (status, enabled signal tool names) from code-scanning analyses.
+    async def _analyses_tool_probe(
+        self, org: str, repo: str, tool: str
+    ) -> tuple[int, bool]:
+        """Probe a repo's code-scanning analyses for one tool (status, present).
 
-        Each tool in ``_CODE_SCANNING_SIGNAL_TOOLS`` is probed with the analyses
-        ``tool_name`` filter, a definitive presence test that does not depend on
-        how many analyses a busy repo has accumulated (the previous page-by-page
-        scan could miss a low-frequency tool past its page cap and wrongly nag
-        it). The first probe's status is authoritative for the endpoint (404 =
-        code scanning disabled, 403 = forbidden, 5xx/0 = indeterminate); a later
-        per-tool probe that fails is skipped (its tool goes undetected for this
-        run) rather than discarding the whole result.
+        A ``per_page=1`` + ``tool_name`` filtered read of the analyses endpoint:
+        a definitive, single-request presence test for a SARIF-uploading tool.
         """
         url = f"{self._api_url}/repos/{org}/{repo}/code-scanning/analyses"
+        resp = await self._request(
+            "GET", url, params={"per_page": 1, "tool_name": tool}
+        )
+        status = resp.status_code
+        if status != 200:
+            await resp.aclose()  # unread body would leak a pooled connection
+            return status, False
+        has_analyses = bool(resp.json())
+        await resp.aclose()  # release the connection once the body is read
+        return 200, has_analyses
 
-        async def probe(tool: str) -> tuple[int, bool]:
-            resp = await self._request(
-                "GET", url, params={"per_page": 1, "tool_name": tool}
-            )
-            status = resp.status_code
-            if status != 200:
-                await resp.aclose()  # unread body would leak a pooled connection
-                return status, False
-            has_analyses = bool(resp.json())
-            await resp.aclose()  # release the connection once the body is read
-            return 200, has_analyses
+    async def code_scanning_tool_present(
+        self, org: str, repo: str, tool: str
+    ) -> bool:
+        """Whether ``tool`` has uploaded code-scanning analyses to this repo.
 
-        first_tool, *rest = _CODE_SCANNING_SIGNAL_TOOLS
-        status, has = await probe(first_tool)
+        The lightweight organisation-gating probe: any non-200 (disabled,
+        forbidden, indeterminate) simply reports the tool as not present here,
+        so a gating sweep degrades to "no evidence" rather than erroring.
+        """
+        status, present = await self._analyses_tool_probe(org, repo, tool)
+        return status == 200 and present
+
+    async def code_scanning_tools(
+        self, org: str, repo: str, tools: tuple[str, ...] | None = None
+    ) -> tuple[int, set[str]]:
+        """Return (status, enabled signal tool names) from code-scanning analyses.
+
+        Each tool in ``tools`` (default: every signal tool) is probed with the
+        analyses ``tool_name`` filter, a definitive presence test that does not
+        depend on how many analyses a busy repo has accumulated (the previous
+        page-by-page scan could miss a low-frequency tool past its page cap and
+        wrongly nag it). The first probe's status is authoritative for the
+        endpoint (404 = code scanning disabled, 403 = forbidden, 5xx/0 =
+        indeterminate); a later per-tool probe that fails is skipped (its tool
+        goes undetected for this run) rather than discarding the whole result.
+        Callers pass a subset when organisation gating has already ruled some
+        tools out, saving one request per repo per skipped tool.
+        """
+        probe_tools = tools if tools is not None else _CODE_SCANNING_SIGNAL_TOOLS
+        if not probe_tools:
+            return 200, set()
+
+        first_tool, *rest = probe_tools
+        status, has = await self._analyses_tool_probe(org, repo, first_tool)
         if status != 200:
             # The first probe's status is authoritative for the endpoint
             # (404 = disabled, 403 = forbidden, 5xx/0 = indeterminate).
             return status, set()
-        tools: set[str] = {first_tool} if has else set()
+        tools_found: set[str] = {first_tool} if has else set()
         # The endpoint is reachable; probe the remaining tools concurrently. A
         # later probe that fails just leaves its tool undetected for this run.
-        results = await asyncio.gather(*(probe(tool) for tool in rest))
-        tools.update(
+        results = await asyncio.gather(
+            *(self._analyses_tool_probe(org, repo, tool) for tool in rest)
+        )
+        tools_found.update(
             tool
             for tool, (st, hit) in zip(rest, results, strict=True)
             if st == 200 and hit
         )
-        return 200, tools
+        return 200, tools_found
 
     async def secret_scanning_status(self, org: str, repo: str) -> int:
         """HTTP status of the secret-scanning alerts endpoint (404 = disabled)."""