github-security-report 0.6.0__tar.gz → 0.7.1__tar.gz

{github_security_report-0.6.0 → github_security_report-0.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: github-security-report
-Version: 0.6.0
+Version: 0.7.1
 Summary: Security and quality reporting across GitHub organisations
 Project-URL: Homepage, https://github.com/lfreleng-actions/github-security-report-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github-security-report-action
@@ -37,7 +37,7 @@ Requires-Dist: pytest-cov==7.1.0; extra == 'dev'
 Requires-Dist: pytest==9.1.1; extra == 'dev'
 Requires-Dist: respx==0.23.1; extra == 'dev'
 Requires-Dist: ruff==0.15.20; extra == 'dev'
-Requires-Dist: syrupy==5.3.4; extra == 'dev'
+Requires-Dist: syrupy==5.5.1; extra == 'dev'
 Requires-Dist: types-jsonschema==4.26.0.20260518; extra == 'dev'
 Requires-Dist: types-pyyaml==6.0.12.20250915; extra == 'dev'
 Description-Content-Type: text/markdown
@@ -56,8 +56,8 @@ Description-Content-Type: text/markdown
 
 > Security and quality **reporting** (not scanning) across GitHub
 > organisations. Aggregates existing signals — CodeQL, OpenSSF Scorecard,
-> zizmor, Dependabot, and secret scanning — and ranks the worst offenders so
-> remediation effort goes where it is needed.
+> zizmor, aislop (AI slop), Dependabot, and secret scanning — and ranks the
+> worst offenders so remediation effort goes where it is needed.
 
 ## 🗒️ Published reports
 
@@ -82,10 +82,21 @@ stay brevity-first; the explanatory per-category description and documentation
 link are shown only on the richer Markdown and HTML (GitHub Pages) outputs.
 
 The single GitHub code-scanning feed is partitioned by `tool.name` into CodeQL,
-Scorecard, and zizmor; Scorecard prefers the external aggregate score and falls
-back to code-scanning findings. See [`docs/BRIEF.md`](docs/BRIEF.md) and
-[`docs/phase0-findings.md`](docs/phase0-findings.md) for the full design and the
-API research it is built on.
+Scorecard, zizmor, and aislop; Scorecard prefers the external aggregate score
+and falls back to code-scanning findings. See [`docs/BRIEF.md`](docs/BRIEF.md)
+and [`docs/phase0-findings.md`](docs/phase0-findings.md) for the full design and
+the API research it is built on.
+
+The workflow-driven signals (OpenSSF Scorecard, zizmor, aislop) only produce
+data when an organisation has deployed supporting workflows. The tool checks
+for that support cheaply before collecting (**feature gating**): an
+organisation with no evidence of a tool — no ruleset requiring its workflow,
+no alerts, no analyses on a sample of repositories — gets a single
+`⏩ Skipping feature: organisation support missing` line for that section
+instead of a nag list. See the
+[organisation scan setup guide](docs/org-scan-setup.md) for the required
+workflows, and disable the check with `report.gating: false` if you want to
+probe everything regardless.
 
 Further sections report **configuration posture** and **freshness** as plain
 tables (org mode):
@@ -153,7 +164,7 @@ organisation and **Repository access** set to *All repositories*, then grant:
 | Metadata | Mandatory baseline; listing organisation repositories |
 | Contents | `.github/dependabot.yml`, latest release, and tag dates |
 | Dependabot alerts | Open Dependabot vulnerability alerts |
-| Code scanning alerts | CodeQL / Scorecard / zizmor findings |
+| Code scanning alerts | CodeQL / Scorecard / zizmor / aislop findings |
 | Secret scanning alerts | Open secret-scanning alerts |
 | Administration | Dependabot enablement + security-updates status, and effective branch rules |
 
@@ -311,7 +322,7 @@ both true.
 The example above hides Zizmor on every surface, and keeps Releases / Tagging
 out of the terminal and Slack while still publishing it to the Markdown and HTML
 Pages output. The valid category keys are: `codeql`, `scorecard`, `zizmor`,
-`dependabot_alerts`, `secret_scanning`, `dependabot_alerts_enabled`,
+`aislop`, `dependabot_alerts`, `secret_scanning`, `dependabot_alerts_enabled`,
 `dependabot_updates_enabled`, `dependabot_cooldown`, `releases`,
 `mutable_releases`, `private_vulnerability_reporting`. Like the other `report`
 settings, `categories` can be set
@@ -328,22 +339,49 @@ unless every org sharing that channel also disables it (this mirrors the
 most-generous `top_n` rule applied to the same grouping). The terminal, Markdown
 and HTML surfaces are per-org and are not affected by this union.
 
+### Organisation feature gating
+
+The workflow-driven signals (OpenSSF Scorecard, zizmor, aislop) need
+organisation-deployed workflows before they produce any data (see the
+[organisation scan setup guide](docs/org-scan-setup.md)). By default the tool
+runs a cheap support check per organisation before collecting each of them:
+evidence is an org ruleset requiring the tool's workflow, existing
+code-scanning alerts from the tool, analyses on a sample of repositories, or
+(for Scorecard) an external scorecard.dev score. A signal with no evidence is
+**skipped** — not probed per repository, not classified — and its section
+shows a single `⏩ Skipping feature: organisation support missing` line
+linking the setup guide, on every output surface. Set `report.gating` to
+`false` (globally or per organisation) to always probe everything:
+
+```json
+{
+  "report": { "gating": false },
+  "organizations": [{ "name": "lfreleng-actions" }]
+}
+```
+
+Gating decides **collection**; the per-category render toggles above decide
+**presentation**. A skipped section still renders (as the one-line notice)
+unless its category is also disabled.
+
 ### Pass/fail severity cutoff
 
-The severity-ranked signals (CodeQL, Scorecard, Zizmor, Dependabot alerts) use a
-`fail_severity` cutoff to decide when a repository counts as a failure. A
-repository is flagged as an offender only when it carries a finding **at or
-above** the cutoff; findings below it fold into the clean count. Severities run
-(lowest to highest) `informational`, `low`, `medium`, `high`, `critical` —
-`informational` being the sub-low rung for SARIF `none` findings and
-unclassifiable alerts. Zizmor's SARIF `note` findings normalise to `low`
+The severity-ranked signals (CodeQL, Scorecard, Zizmor, aislop, Dependabot
+alerts) use a `fail_severity` cutoff to decide when a repository counts as a
+failure. A repository is flagged as an offender only when it carries a finding
+**at or above** the cutoff; findings below it fold into the clean count.
+Severities run (lowest to highest) `informational`, `low`, `medium`, `high`,
+`critical` — `informational` being the sub-low rung for SARIF `none` findings
+and unclassifiable alerts. Zizmor's SARIF `note` findings normalise to `low`
 (zizmor emits its Low findings at `note`, and the organisation scan pipeline's
 `--min-severity low` floor keeps informational findings out of the uploaded
 SARIF), matching the ruleset-enforced PR gate that blocks on note-and-above.
+aislop populates the same SARIF level axis and normalises identically.
 
 The global default cutoff is `medium`, so `low` and `informational` findings
-pass. Zizmor defaults to `low` (only `informational` passes). Override the
-cutoff per category under `report.categories.<key>.fail_severity`:
+pass. Zizmor and aislop default to `low` (only `informational` passes).
+Override the cutoff per category under
+`report.categories.<key>.fail_severity`:
 
 ```json
 {
@@ -422,13 +460,22 @@ The tool is published to PyPI and runs with `uvx`. Inside a Git checkout with a
 `upstream` remote, then `origin`) and prints a Rich table report:
 
 ```bash
-export GITHUB_TOKEN=ghp_your_token
+export GITHUB_TOKEN="your-token"
 uvx github-security-report report
 
 # Or org mode locally with a PAT:
 uvx github-security-report report --org lfreleng-actions
 ```
 
+### GitHub Enterprise Server
+
+The API endpoints honour the standard environment variables that GitHub
+Actions exports, so the tool works against GitHub Enterprise Server
+without code changes: set `GITHUB_API_URL` and `GITHUB_GRAPHQL_URL` to
+your enterprise endpoints (Actions sets these automatically on GHES
+runners). `SCORECARD_API_URL` overrides the external OpenSSF Scorecard
+API in the same way.
+
 ## Remediation
 
 The `remediate` subcommand is the in-tool counterpart to the report: it runs the

{github_security_report-0.6.0 → github_security_report-0.7.1}/README.md

@@ -12,8 +12,8 @@
 
 > Security and quality **reporting** (not scanning) across GitHub
 > organisations. Aggregates existing signals — CodeQL, OpenSSF Scorecard,
-> zizmor, Dependabot, and secret scanning — and ranks the worst offenders so
-> remediation effort goes where it is needed.
+> zizmor, aislop (AI slop), Dependabot, and secret scanning — and ranks the
+> worst offenders so remediation effort goes where it is needed.
 
 ## 🗒️ Published reports
 
@@ -38,10 +38,21 @@ stay brevity-first; the explanatory per-category description and documentation
 link are shown only on the richer Markdown and HTML (GitHub Pages) outputs.
 
 The single GitHub code-scanning feed is partitioned by `tool.name` into CodeQL,
-Scorecard, and zizmor; Scorecard prefers the external aggregate score and falls
-back to code-scanning findings. See [`docs/BRIEF.md`](docs/BRIEF.md) and
-[`docs/phase0-findings.md`](docs/phase0-findings.md) for the full design and the
-API research it is built on.
+Scorecard, zizmor, and aislop; Scorecard prefers the external aggregate score
+and falls back to code-scanning findings. See [`docs/BRIEF.md`](docs/BRIEF.md)
+and [`docs/phase0-findings.md`](docs/phase0-findings.md) for the full design and
+the API research it is built on.
+
+The workflow-driven signals (OpenSSF Scorecard, zizmor, aislop) only produce
+data when an organisation has deployed supporting workflows. The tool checks
+for that support cheaply before collecting (**feature gating**): an
+organisation with no evidence of a tool — no ruleset requiring its workflow,
+no alerts, no analyses on a sample of repositories — gets a single
+`⏩ Skipping feature: organisation support missing` line for that section
+instead of a nag list. See the
+[organisation scan setup guide](docs/org-scan-setup.md) for the required
+workflows, and disable the check with `report.gating: false` if you want to
+probe everything regardless.
 
 Further sections report **configuration posture** and **freshness** as plain
 tables (org mode):
@@ -109,7 +120,7 @@ organisation and **Repository access** set to *All repositories*, then grant:
 | Metadata | Mandatory baseline; listing organisation repositories |
 | Contents | `.github/dependabot.yml`, latest release, and tag dates |
 | Dependabot alerts | Open Dependabot vulnerability alerts |
-| Code scanning alerts | CodeQL / Scorecard / zizmor findings |
+| Code scanning alerts | CodeQL / Scorecard / zizmor / aislop findings |
 | Secret scanning alerts | Open secret-scanning alerts |
 | Administration | Dependabot enablement + security-updates status, and effective branch rules |
 
@@ -267,7 +278,7 @@ both true.
 The example above hides Zizmor on every surface, and keeps Releases / Tagging
 out of the terminal and Slack while still publishing it to the Markdown and HTML
 Pages output. The valid category keys are: `codeql`, `scorecard`, `zizmor`,
-`dependabot_alerts`, `secret_scanning`, `dependabot_alerts_enabled`,
+`aislop`, `dependabot_alerts`, `secret_scanning`, `dependabot_alerts_enabled`,
 `dependabot_updates_enabled`, `dependabot_cooldown`, `releases`,
 `mutable_releases`, `private_vulnerability_reporting`. Like the other `report`
 settings, `categories` can be set
@@ -284,22 +295,49 @@ unless every org sharing that channel also disables it (this mirrors the
 most-generous `top_n` rule applied to the same grouping). The terminal, Markdown
 and HTML surfaces are per-org and are not affected by this union.
 
+### Organisation feature gating
+
+The workflow-driven signals (OpenSSF Scorecard, zizmor, aislop) need
+organisation-deployed workflows before they produce any data (see the
+[organisation scan setup guide](docs/org-scan-setup.md)). By default the tool
+runs a cheap support check per organisation before collecting each of them:
+evidence is an org ruleset requiring the tool's workflow, existing
+code-scanning alerts from the tool, analyses on a sample of repositories, or
+(for Scorecard) an external scorecard.dev score. A signal with no evidence is
+**skipped** — not probed per repository, not classified — and its section
+shows a single `⏩ Skipping feature: organisation support missing` line
+linking the setup guide, on every output surface. Set `report.gating` to
+`false` (globally or per organisation) to always probe everything:
+
+```json
+{
+  "report": { "gating": false },
+  "organizations": [{ "name": "lfreleng-actions" }]
+}
+```
+
+Gating decides **collection**; the per-category render toggles above decide
+**presentation**. A skipped section still renders (as the one-line notice)
+unless its category is also disabled.
+
 ### Pass/fail severity cutoff
 
-The severity-ranked signals (CodeQL, Scorecard, Zizmor, Dependabot alerts) use a
-`fail_severity` cutoff to decide when a repository counts as a failure. A
-repository is flagged as an offender only when it carries a finding **at or
-above** the cutoff; findings below it fold into the clean count. Severities run
-(lowest to highest) `informational`, `low`, `medium`, `high`, `critical` —
-`informational` being the sub-low rung for SARIF `none` findings and
-unclassifiable alerts. Zizmor's SARIF `note` findings normalise to `low`
+The severity-ranked signals (CodeQL, Scorecard, Zizmor, aislop, Dependabot
+alerts) use a `fail_severity` cutoff to decide when a repository counts as a
+failure. A repository is flagged as an offender only when it carries a finding
+**at or above** the cutoff; findings below it fold into the clean count.
+Severities run (lowest to highest) `informational`, `low`, `medium`, `high`,
+`critical` — `informational` being the sub-low rung for SARIF `none` findings
+and unclassifiable alerts. Zizmor's SARIF `note` findings normalise to `low`
 (zizmor emits its Low findings at `note`, and the organisation scan pipeline's
 `--min-severity low` floor keeps informational findings out of the uploaded
 SARIF), matching the ruleset-enforced PR gate that blocks on note-and-above.
+aislop populates the same SARIF level axis and normalises identically.
 
 The global default cutoff is `medium`, so `low` and `informational` findings
-pass. Zizmor defaults to `low` (only `informational` passes). Override the
-cutoff per category under `report.categories.<key>.fail_severity`:
+pass. Zizmor and aislop default to `low` (only `informational` passes).
+Override the cutoff per category under
+`report.categories.<key>.fail_severity`:
 
 ```json
 {
@@ -378,13 +416,22 @@ The tool is published to PyPI and runs with `uvx`. Inside a Git checkout with a
 `upstream` remote, then `origin`) and prints a Rich table report:
 
 ```bash
-export GITHUB_TOKEN=ghp_your_token
+export GITHUB_TOKEN="your-token"
 uvx github-security-report report
 
 # Or org mode locally with a PAT:
 uvx github-security-report report --org lfreleng-actions
 ```
 
+### GitHub Enterprise Server
+
+The API endpoints honour the standard environment variables that GitHub
+Actions exports, so the tool works against GitHub Enterprise Server
+without code changes: set `GITHUB_API_URL` and `GITHUB_GRAPHQL_URL` to
+your enterprise endpoints (Actions sets these automatically on GHES
+runners). `SCORECARD_API_URL` overrides the external OpenSSF Scorecard
+API in the same way.
+
 ## Remediation
 
 The `remediate` subcommand is the in-tool counterpart to the report: it runs the

{github_security_report-0.6.0 → github_security_report-0.7.1}/pyproject.toml

@@ -63,7 +63,7 @@ dev = [
   "pytest-asyncio==1.4.0",
   "pytest-cov==7.1.0",
   "respx==0.23.1",
-  "syrupy==5.3.4",
+  "syrupy==5.5.1",
   "mypy==2.1.0",
   "ruff==0.15.20",
   "types-jsonschema==4.26.0.20260518",
@@ -95,7 +95,7 @@ dev = [
   "pytest-asyncio==1.4.0",
   "pytest-cov==7.1.0",
   "respx==0.23.1",
-  "syrupy==5.3.4",
+  "syrupy==5.5.1",
   "mypy==2.1.0",
   "ruff==0.15.20",
   "types-jsonschema==4.26.0.20260518",

{github_security_report-0.6.0 → github_security_report-0.7.1}/src/github_security_report/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.6.0'
-__version_tuple__ = version_tuple = (0, 6, 0)
+__version__ = version = '0.7.1'
+__version_tuple__ = version_tuple = (0, 7, 1)
 
 __commit_id__ = commit_id = None

{github_security_report-0.6.0 → github_security_report-0.7.1}/src/github_security_report/categories.py

@@ -31,6 +31,7 @@ class CategoryKey(str, Enum):
     CODEQL = "codeql"
     SCORECARD = "scorecard"
     ZIZMOR = "zizmor"
+    AISLOP = "aislop"
     DEPENDABOT_ALERTS = "dependabot_alerts"
     SECRET_SCANNING = "secret_scanning"
     DEPENDABOT_ALERTS_ENABLED = "dependabot_alerts_enabled"
@@ -110,6 +111,20 @@ _CATEGORIES: dict[CategoryKey, CategoryMeta] = {
         # matching the ruleset-enforced PR gate that blocks on note-and-above.
         fail_severity=Severity.LOW,
     ),
+    CategoryKey.AISLOP: CategoryMeta(
+        key=CategoryKey.AISLOP,
+        title="AI Slop Analysis",
+        pass_label="Clean",
+        fail_label=None,
+        url="https://github.com/scanaislop/aislop",
+        description=(
+            "aislop AI-slop / code-quality findings, ranked worst-first by severity."
+        ),
+        # aislop, like zizmor, populates only the SARIF level axis
+        # (error/warning/note); "note" normalises to LOW (see severity.py), so
+        # any aislop finding fails -- matching the ruleset-enforced PR gate.
+        fail_severity=Severity.LOW,
+    ),
     CategoryKey.DEPENDABOT_ALERTS: CategoryMeta(
         key=CategoryKey.DEPENDABOT_ALERTS,
         title="Dependabot: Security Alerts",

{github_security_report-0.6.0 → github_security_report-0.7.1}/src/github_security_report/classify.py

@@ -6,8 +6,8 @@ Pure, transport-free logic encoding every Phase 0 finding
 (``docs/phase0-findings.md``):
 
 - the single code-scanning feed is partitioned by ``tool.name`` into CodeQL,
-  Scorecard and zizmor -- counts are filtered per tool;
-- CodeQL/Scorecard/zizmor enablement is the presence of that tool in
+  Scorecard, zizmor and aislop -- counts are filtered per tool;
+- CodeQL/Scorecard/zizmor/aislop enablement is the presence of that tool in
   ``code-scanning/analyses`` (not ``default-setup``); a 404 on code scanning
   means it is disabled entirely;
 - secret scanning 404 = disabled, 200 [] = enabled-clean;
@@ -18,11 +18,12 @@ Pure, transport-free logic encoding every Phase 0 finding
 
 from __future__ import annotations
 
-from collections.abc import Mapping
+from collections.abc import Callable, Mapping, Set
 from dataclasses import dataclass, field
 
 from github_security_report import severity
 from github_security_report.models import (
+    CODE_SCANNING_TOOLS,
     Repo,
     RepoSignal,
     RepoState,
@@ -36,9 +37,7 @@ from github_security_report.severity import Severity
 FailSeverities = Mapping[SignalType, Severity]
 
 
-def _cutoff(
-    signal: SignalType, fail_severities: FailSeverities | None
-) -> Severity:
+def _cutoff(signal: SignalType, fail_severities: FailSeverities | None) -> Severity:
     """The fail-severity cutoff for ``signal`` (config override or default)."""
     if fail_severities is not None and signal in fail_severities:
         return fail_severities[signal]
@@ -50,7 +49,7 @@ class RepoFacts:
     """Raw per-repository facts gathered by the client, pre-classification."""
 
     repo: Repo
-    # Code scanning (covers CodeQL, Scorecard, zizmor).
+    # Code scanning (covers CodeQL, Scorecard, zizmor, aislop).
     code_scanning_status: int = 200  # 200 ok, 404 disabled, 403 forbidden
     code_scanning_tools: set[str] = field(default_factory=set)  # analyses tool names
     code_scanning_alerts: list[dict] = field(default_factory=list)  # all tools
@@ -130,13 +129,19 @@ def _code_scanning_tool_signal(
         facts.code_scanning_status == 200 and tool_name in facts.code_scanning_tools
     )
     if not enabled:
-        detail = "code scanning disabled" if facts.code_scanning_status == 404 else f"{tool_name} not enabled"
+        detail = (
+            "code scanning disabled"
+            if facts.code_scanning_status == 404
+            else f"{tool_name} not enabled"
+        )
         return RepoSignal(repo, signal, RepoState.NAG, detail=detail)
     counts = count_code_scanning(facts.code_scanning_alerts, tool_name)
     # Enabled with no findings is only "clean" when the alert read succeeded;
     # an unreadable sweep (e.g. org-bulk 403/5xx) must not masquerade as clean.
     if counts.total == 0 and facts.code_scanning_alerts_status != 200:
-        return RepoSignal(repo, signal, RepoState.UNKNOWN, detail="alert data unavailable")
+        return RepoSignal(
+            repo, signal, RepoState.UNKNOWN, detail="alert data unavailable"
+        )
     # Only findings at or above the category's fail-severity cutoff make the
     # repo an offender; sub-threshold findings (e.g. informational) fold into
     # the clean count.
@@ -149,7 +154,10 @@ def classify_codeql(
     facts: RepoFacts, fail_severities: FailSeverities | None = None
 ) -> RepoSignal:
     return _code_scanning_tool_signal(
-        facts, SignalType.CODEQL, "CodeQL", fail_severities
+        facts,
+        SignalType.CODEQL,
+        CODE_SCANNING_TOOLS[SignalType.CODEQL],
+        fail_severities,
     )
 
 
@@ -157,7 +165,21 @@ def classify_zizmor(
     facts: RepoFacts, fail_severities: FailSeverities | None = None
 ) -> RepoSignal:
     return _code_scanning_tool_signal(
-        facts, SignalType.ZIZMOR, "zizmor", fail_severities
+        facts,
+        SignalType.ZIZMOR,
+        CODE_SCANNING_TOOLS[SignalType.ZIZMOR],
+        fail_severities,
+    )
+
+
+def classify_aislop(
+    facts: RepoFacts, fail_severities: FailSeverities | None = None
+) -> RepoSignal:
+    return _code_scanning_tool_signal(
+        facts,
+        SignalType.AISLOP,
+        CODE_SCANNING_TOOLS[SignalType.AISLOP],
+        fail_severities,
     )
 
 
@@ -166,8 +188,13 @@ def classify_scorecard(
 ) -> RepoSignal:
     """Scorecard: prefer the external aggregate score, else code-scanning findings."""
     repo = facts.repo
-    counts = count_code_scanning(facts.code_scanning_alerts, "Scorecard")
-    has_cs = "Scorecard" in facts.code_scanning_tools and facts.code_scanning_status == 200
+    counts = count_code_scanning(
+        facts.code_scanning_alerts, CODE_SCANNING_TOOLS[SignalType.SCORECARD]
+    )
+    has_cs = (
+        CODE_SCANNING_TOOLS[SignalType.SCORECARD] in facts.code_scanning_tools
+        and facts.code_scanning_status == 200
+    )
     cutoff = _cutoff(SignalType.SCORECARD, fail_severities)
 
     if facts.scorecard_status == 200 and facts.scorecard_score is not None:
@@ -178,21 +205,34 @@ def classify_scorecard(
         # the code-scanning cutoff logic used elsewhere in this file.
         clean = facts.scorecard_score >= 10.0 and not counts.at_or_above(cutoff)
         state = RepoState.CLEAN if clean else RepoState.OFFENDER
-        return RepoSignal(repo, SignalType.SCORECARD, state, counts=counts, score=facts.scorecard_score)
+        return RepoSignal(
+            repo,
+            SignalType.SCORECARD,
+            state,
+            counts=counts,
+            score=facts.scorecard_score,
+        )
     if has_cs:
         if counts.total == 0 and facts.code_scanning_alerts_status != 200:
-            return RepoSignal(repo, SignalType.SCORECARD, RepoState.UNKNOWN, detail="alert data unavailable")
-        state = (
-            RepoState.OFFENDER if counts.at_or_above(cutoff) else RepoState.CLEAN
-        )
+            return RepoSignal(
+                repo,
+                SignalType.SCORECARD,
+                RepoState.UNKNOWN,
+                detail="alert data unavailable",
+            )
+        state = RepoState.OFFENDER if counts.at_or_above(cutoff) else RepoState.CLEAN
         return RepoSignal(repo, SignalType.SCORECARD, state, counts=counts)
     # An indeterminate external request (a 403 forbidden/blocked, a 5xx
     # including the synthetic 503 a transport failure produces, or a forbidden
     # code-scanning probe) is unknown, not a definitive nag. Only a clean 404
     # with no code-scanning Scorecard data means "no results".
     if facts.code_scanning_status == 403 or facts.scorecard_status not in (200, 404):
-        return RepoSignal(repo, SignalType.SCORECARD, RepoState.UNKNOWN, detail="indeterminate")
-    return RepoSignal(repo, SignalType.SCORECARD, RepoState.NAG, detail="no Scorecard results")
+        return RepoSignal(
+            repo, SignalType.SCORECARD, RepoState.UNKNOWN, detail="indeterminate"
+        )
+    return RepoSignal(
+        repo, SignalType.SCORECARD, RepoState.NAG, detail="no Scorecard results"
+    )
 
 
 def classify_secret_scanning(
@@ -203,9 +243,19 @@ def classify_secret_scanning(
     # other classifiers (they are dispatched positionally) and is unused here.
     repo = facts.repo
     if facts.secret_scanning_status == 403:
-        return RepoSignal(repo, SignalType.SECRET_SCANNING, RepoState.UNKNOWN, detail="insufficient permission")
+        return RepoSignal(
+            repo,
+            SignalType.SECRET_SCANNING,
+            RepoState.UNKNOWN,
+            detail="insufficient permission",
+        )
     if facts.secret_scanning_status == 404:
-        return RepoSignal(repo, SignalType.SECRET_SCANNING, RepoState.NAG, detail="secret scanning disabled")
+        return RepoSignal(
+            repo,
+            SignalType.SECRET_SCANNING,
+            RepoState.NAG,
+            detail="secret scanning disabled",
+        )
     # Flat open count; stored as HIGH so ranking (more == worse) works and the
     # repo-mode gate treats leaked secrets as serious, without conflating them
     # with CRITICAL code findings (which would make --fail-threshold critical
@@ -215,12 +265,19 @@ def classify_secret_scanning(
     # Positive evidence of leaked secrets is actionable even when the read was
     # incomplete (a later page failed) or the enablement probe was indeterminate.
     if facts.secret_scanning_open:
-        return RepoSignal(repo, SignalType.SECRET_SCANNING, RepoState.OFFENDER, counts=counts)
+        return RepoSignal(
+            repo, SignalType.SECRET_SCANNING, RepoState.OFFENDER, counts=counts
+        )
     # A zero count is only "clean" when both the enablement probe and the
     # open-count read succeeded; an indeterminate status (5xx) or an unreadable
     # sweep cannot confirm the repo is clean.
     if facts.secret_scanning_status != 200 or facts.secret_scanning_open_status != 200:
-        return RepoSignal(repo, SignalType.SECRET_SCANNING, RepoState.UNKNOWN, detail="alert data unavailable")
+        return RepoSignal(
+            repo,
+            SignalType.SECRET_SCANNING,
+            RepoState.UNKNOWN,
+            detail="alert data unavailable",
+        )
     return RepoSignal(repo, SignalType.SECRET_SCANNING, RepoState.CLEAN, counts=counts)
 
 
@@ -229,34 +286,60 @@ def classify_dependabot(
 ) -> RepoSignal:
     repo = facts.repo
     if facts.dependabot_enabled is None:
-        return RepoSignal(repo, SignalType.DEPENDABOT, RepoState.UNKNOWN, detail="indeterminate")
+        return RepoSignal(
+            repo, SignalType.DEPENDABOT, RepoState.UNKNOWN, detail="indeterminate"
+        )
     if facts.dependabot_enabled is False:
-        return RepoSignal(repo, SignalType.DEPENDABOT, RepoState.NAG, detail="Dependabot alerts disabled")
+        return RepoSignal(
+            repo,
+            SignalType.DEPENDABOT,
+            RepoState.NAG,
+            detail="Dependabot alerts disabled",
+        )
     counts = count_dependabot(facts.dependabot_alerts)
     # Enabled with no alerts is only "clean" when the alert read succeeded.
     if counts.total == 0 and facts.dependabot_alerts_status != 200:
-        return RepoSignal(repo, SignalType.DEPENDABOT, RepoState.UNKNOWN, detail="alert data unavailable")
+        return RepoSignal(
+            repo,
+            SignalType.DEPENDABOT,
+            RepoState.UNKNOWN,
+            detail="alert data unavailable",
+        )
     failing = counts.at_or_above(_cutoff(SignalType.DEPENDABOT, fail_severities))
     state = RepoState.OFFENDER if failing else RepoState.CLEAN
     return RepoSignal(repo, SignalType.DEPENDABOT, state, counts=counts)
 
 
-_CLASSIFIERS = (
-    classify_codeql,
-    classify_scorecard,
-    classify_zizmor,
-    classify_dependabot,
-    classify_secret_scanning,
-)
+# One classifier per signal, keyed so orchestration can skip gated-out signals.
+_Classifier = Callable[["RepoFacts", "FailSeverities | None"], RepoSignal]
+
+_CLASSIFIERS: dict[SignalType, _Classifier] = {
+    SignalType.CODEQL: classify_codeql,
+    SignalType.SCORECARD: classify_scorecard,
+    SignalType.ZIZMOR: classify_zizmor,
+    SignalType.AISLOP: classify_aislop,
+    SignalType.DEPENDABOT: classify_dependabot,
+    SignalType.SECRET_SCANNING: classify_secret_scanning,
+}
 
 
 def classify_repo(
-    facts: RepoFacts, fail_severities: FailSeverities | None = None
+    facts: RepoFacts,
+    fail_severities: FailSeverities | None = None,
+    *,
+    skip: Set[SignalType] = frozenset(),
 ) -> list[RepoSignal]:
-    """Classify a repository across all five signals.
+    """Classify a repository across all signals (minus any in ``skip``).
 
     ``fail_severities`` optionally overrides the per-signal fail-severity cutoff
     (otherwise each signal uses its category default); it governs which findings
-    are severe enough to mark a repository as an offender.
+    are severe enough to mark a repository as an offender. ``skip`` names
+    signals to leave unclassified entirely -- used when organisation feature
+    gating (:mod:`gating`) found no support for a workflow-driven tool, so the
+    repository is neither nagged nor counted for that signal.
     """
-    return [classifier(facts, fail_severities) for classifier in _CLASSIFIERS]
+    return [
+        classifier(facts, fail_severities)
+        for signal, classifier in _CLASSIFIERS.items()
+        if signal not in skip
+    ]