github-security-report 0.7.0__tar.gz → 0.7.1__tar.gz

{github_security_report-0.7.0 → github_security_report-0.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: github-security-report
-Version: 0.7.0
+Version: 0.7.1
 Summary: Security and quality reporting across GitHub organisations
 Project-URL: Homepage, https://github.com/lfreleng-actions/github-security-report-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github-security-report-action
@@ -37,7 +37,7 @@ Requires-Dist: pytest-cov==7.1.0; extra == 'dev'
 Requires-Dist: pytest==9.1.1; extra == 'dev'
 Requires-Dist: respx==0.23.1; extra == 'dev'
 Requires-Dist: ruff==0.15.20; extra == 'dev'
-Requires-Dist: syrupy==5.3.4; extra == 'dev'
+Requires-Dist: syrupy==5.5.1; extra == 'dev'
 Requires-Dist: types-jsonschema==4.26.0.20260518; extra == 'dev'
 Requires-Dist: types-pyyaml==6.0.12.20250915; extra == 'dev'
 Description-Content-Type: text/markdown
@@ -460,13 +460,22 @@ The tool is published to PyPI and runs with `uvx`. Inside a Git checkout with a
 `upstream` remote, then `origin`) and prints a Rich table report:
 
 ```bash
-export GITHUB_TOKEN=ghp_your_token
+export GITHUB_TOKEN="your-token"
 uvx github-security-report report
 
 # Or org mode locally with a PAT:
 uvx github-security-report report --org lfreleng-actions
 ```
 
+### GitHub Enterprise Server
+
+The API endpoints honour the standard environment variables that GitHub
+Actions exports, so the tool works against GitHub Enterprise Server
+without code changes: set `GITHUB_API_URL` and `GITHUB_GRAPHQL_URL` to
+your enterprise endpoints (Actions sets these automatically on GHES
+runners). `SCORECARD_API_URL` overrides the external OpenSSF Scorecard
+API in the same way.
+
 ## Remediation
 
 The `remediate` subcommand is the in-tool counterpart to the report: it runs the

{github_security_report-0.7.0 → github_security_report-0.7.1}/README.md

@@ -416,13 +416,22 @@ The tool is published to PyPI and runs with `uvx`. Inside a Git checkout with a
 `upstream` remote, then `origin`) and prints a Rich table report:
 
 ```bash
-export GITHUB_TOKEN=ghp_your_token
+export GITHUB_TOKEN="your-token"
 uvx github-security-report report
 
 # Or org mode locally with a PAT:
 uvx github-security-report report --org lfreleng-actions
 ```
 
+### GitHub Enterprise Server
+
+The API endpoints honour the standard environment variables that GitHub
+Actions exports, so the tool works against GitHub Enterprise Server
+without code changes: set `GITHUB_API_URL` and `GITHUB_GRAPHQL_URL` to
+your enterprise endpoints (Actions sets these automatically on GHES
+runners). `SCORECARD_API_URL` overrides the external OpenSSF Scorecard
+API in the same way.
+
 ## Remediation
 
 The `remediate` subcommand is the in-tool counterpart to the report: it runs the

{github_security_report-0.7.0 → github_security_report-0.7.1}/pyproject.toml

@@ -63,7 +63,7 @@ dev = [
   "pytest-asyncio==1.4.0",
   "pytest-cov==7.1.0",
   "respx==0.23.1",
-  "syrupy==5.3.4",
+  "syrupy==5.5.1",
   "mypy==2.1.0",
   "ruff==0.15.20",
   "types-jsonschema==4.26.0.20260518",
@@ -95,7 +95,7 @@ dev = [
   "pytest-asyncio==1.4.0",
   "pytest-cov==7.1.0",
   "respx==0.23.1",
-  "syrupy==5.3.4",
+  "syrupy==5.5.1",
   "mypy==2.1.0",
   "ruff==0.15.20",
   "types-jsonschema==4.26.0.20260518",

{github_security_report-0.7.0 → github_security_report-0.7.1}/src/github_security_report/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.7.0'
-__version_tuple__ = version_tuple = (0, 7, 0)
+__version__ = version = '0.7.1'
+__version_tuple__ = version_tuple = (0, 7, 1)
 
 __commit_id__ = commit_id = None

{github_security_report-0.7.0 → github_security_report-0.7.1}/src/github_security_report/categories.py

@@ -118,8 +118,7 @@ _CATEGORIES: dict[CategoryKey, CategoryMeta] = {
         fail_label=None,
         url="https://github.com/scanaislop/aislop",
         description=(
-            "aislop AI-slop / code-quality findings, ranked worst-first by "
-            "severity."
+            "aislop AI-slop / code-quality findings, ranked worst-first by severity."
         ),
         # aislop, like zizmor, populates only the SARIF level axis
         # (error/warning/note); "note" normalises to LOW (see severity.py), so

{github_security_report-0.7.0 → github_security_report-0.7.1}/src/github_security_report/classify.py

@@ -37,9 +37,7 @@ from github_security_report.severity import Severity
 FailSeverities = Mapping[SignalType, Severity]
 
 
-def _cutoff(
-    signal: SignalType, fail_severities: FailSeverities | None
-) -> Severity:
+def _cutoff(signal: SignalType, fail_severities: FailSeverities | None) -> Severity:
     """The fail-severity cutoff for ``signal`` (config override or default)."""
     if fail_severities is not None and signal in fail_severities:
         return fail_severities[signal]
@@ -131,13 +129,19 @@ def _code_scanning_tool_signal(
         facts.code_scanning_status == 200 and tool_name in facts.code_scanning_tools
     )
     if not enabled:
-        detail = "code scanning disabled" if facts.code_scanning_status == 404 else f"{tool_name} not enabled"
+        detail = (
+            "code scanning disabled"
+            if facts.code_scanning_status == 404
+            else f"{tool_name} not enabled"
+        )
         return RepoSignal(repo, signal, RepoState.NAG, detail=detail)
     counts = count_code_scanning(facts.code_scanning_alerts, tool_name)
     # Enabled with no findings is only "clean" when the alert read succeeded;
     # an unreadable sweep (e.g. org-bulk 403/5xx) must not masquerade as clean.
     if counts.total == 0 and facts.code_scanning_alerts_status != 200:
-        return RepoSignal(repo, signal, RepoState.UNKNOWN, detail="alert data unavailable")
+        return RepoSignal(
+            repo, signal, RepoState.UNKNOWN, detail="alert data unavailable"
+        )
     # Only findings at or above the category's fail-severity cutoff make the
     # repo an offender; sub-threshold findings (e.g. informational) fold into
     # the clean count.
@@ -201,21 +205,34 @@ def classify_scorecard(
         # the code-scanning cutoff logic used elsewhere in this file.
         clean = facts.scorecard_score >= 10.0 and not counts.at_or_above(cutoff)
         state = RepoState.CLEAN if clean else RepoState.OFFENDER
-        return RepoSignal(repo, SignalType.SCORECARD, state, counts=counts, score=facts.scorecard_score)
+        return RepoSignal(
+            repo,
+            SignalType.SCORECARD,
+            state,
+            counts=counts,
+            score=facts.scorecard_score,
+        )
     if has_cs:
         if counts.total == 0 and facts.code_scanning_alerts_status != 200:
-            return RepoSignal(repo, SignalType.SCORECARD, RepoState.UNKNOWN, detail="alert data unavailable")
-        state = (
-            RepoState.OFFENDER if counts.at_or_above(cutoff) else RepoState.CLEAN
-        )
+            return RepoSignal(
+                repo,
+                SignalType.SCORECARD,
+                RepoState.UNKNOWN,
+                detail="alert data unavailable",
+            )
+        state = RepoState.OFFENDER if counts.at_or_above(cutoff) else RepoState.CLEAN
         return RepoSignal(repo, SignalType.SCORECARD, state, counts=counts)
     # An indeterminate external request (a 403 forbidden/blocked, a 5xx
     # including the synthetic 503 a transport failure produces, or a forbidden
     # code-scanning probe) is unknown, not a definitive nag. Only a clean 404
     # with no code-scanning Scorecard data means "no results".
     if facts.code_scanning_status == 403 or facts.scorecard_status not in (200, 404):
-        return RepoSignal(repo, SignalType.SCORECARD, RepoState.UNKNOWN, detail="indeterminate")
-    return RepoSignal(repo, SignalType.SCORECARD, RepoState.NAG, detail="no Scorecard results")
+        return RepoSignal(
+            repo, SignalType.SCORECARD, RepoState.UNKNOWN, detail="indeterminate"
+        )
+    return RepoSignal(
+        repo, SignalType.SCORECARD, RepoState.NAG, detail="no Scorecard results"
+    )
 
 
 def classify_secret_scanning(
@@ -226,9 +243,19 @@ def classify_secret_scanning(
     # other classifiers (they are dispatched positionally) and is unused here.
     repo = facts.repo
     if facts.secret_scanning_status == 403:
-        return RepoSignal(repo, SignalType.SECRET_SCANNING, RepoState.UNKNOWN, detail="insufficient permission")
+        return RepoSignal(
+            repo,
+            SignalType.SECRET_SCANNING,
+            RepoState.UNKNOWN,
+            detail="insufficient permission",
+        )
     if facts.secret_scanning_status == 404:
-        return RepoSignal(repo, SignalType.SECRET_SCANNING, RepoState.NAG, detail="secret scanning disabled")
+        return RepoSignal(
+            repo,
+            SignalType.SECRET_SCANNING,
+            RepoState.NAG,
+            detail="secret scanning disabled",
+        )
     # Flat open count; stored as HIGH so ranking (more == worse) works and the
     # repo-mode gate treats leaked secrets as serious, without conflating them
     # with CRITICAL code findings (which would make --fail-threshold critical
@@ -238,12 +265,19 @@ def classify_secret_scanning(
     # Positive evidence of leaked secrets is actionable even when the read was
     # incomplete (a later page failed) or the enablement probe was indeterminate.
     if facts.secret_scanning_open:
-        return RepoSignal(repo, SignalType.SECRET_SCANNING, RepoState.OFFENDER, counts=counts)
+        return RepoSignal(
+            repo, SignalType.SECRET_SCANNING, RepoState.OFFENDER, counts=counts
+        )
     # A zero count is only "clean" when both the enablement probe and the
     # open-count read succeeded; an indeterminate status (5xx) or an unreadable
     # sweep cannot confirm the repo is clean.
     if facts.secret_scanning_status != 200 or facts.secret_scanning_open_status != 200:
-        return RepoSignal(repo, SignalType.SECRET_SCANNING, RepoState.UNKNOWN, detail="alert data unavailable")
+        return RepoSignal(
+            repo,
+            SignalType.SECRET_SCANNING,
+            RepoState.UNKNOWN,
+            detail="alert data unavailable",
+        )
     return RepoSignal(repo, SignalType.SECRET_SCANNING, RepoState.CLEAN, counts=counts)
 
 
@@ -252,13 +286,25 @@ def classify_dependabot(
 ) -> RepoSignal:
     repo = facts.repo
     if facts.dependabot_enabled is None:
-        return RepoSignal(repo, SignalType.DEPENDABOT, RepoState.UNKNOWN, detail="indeterminate")
+        return RepoSignal(
+            repo, SignalType.DEPENDABOT, RepoState.UNKNOWN, detail="indeterminate"
+        )
     if facts.dependabot_enabled is False:
-        return RepoSignal(repo, SignalType.DEPENDABOT, RepoState.NAG, detail="Dependabot alerts disabled")
+        return RepoSignal(
+            repo,
+            SignalType.DEPENDABOT,
+            RepoState.NAG,
+            detail="Dependabot alerts disabled",
+        )
     counts = count_dependabot(facts.dependabot_alerts)
     # Enabled with no alerts is only "clean" when the alert read succeeded.
     if counts.total == 0 and facts.dependabot_alerts_status != 200:
-        return RepoSignal(repo, SignalType.DEPENDABOT, RepoState.UNKNOWN, detail="alert data unavailable")
+        return RepoSignal(
+            repo,
+            SignalType.DEPENDABOT,
+            RepoState.UNKNOWN,
+            detail="alert data unavailable",
+        )
     failing = counts.at_or_above(_cutoff(SignalType.DEPENDABOT, fail_severities))
     state = RepoState.OFFENDER if failing else RepoState.CLEAN
     return RepoSignal(repo, SignalType.DEPENDABOT, state, counts=counts)

{github_security_report-0.7.0 → github_security_report-0.7.1}/src/github_security_report/cli.py

@@ -59,7 +59,10 @@ def _version_callback(value: bool) -> None:
 @app.callback()
 def main(
     _version: bool = typer.Option(
-        False, "--version", callback=_version_callback, is_eager=True,
+        False,
+        "--version",
+        callback=_version_callback,
+        is_eager=True,
         help="Show the version and exit.",
     ),
     verbose: bool = typer.Option(False, "--verbose", "-v", help="Verbose logging."),
@@ -176,9 +179,7 @@ def _slack_show(
     when any contributing org would show it on Slack -- mirroring the
     most-generous ``top_n`` rule for the same grouping.
     """
-    return lambda key: any(
-        oc.report.shows_category(key, "slack") for oc, _ in items
-    )
+    return lambda key: any(oc.report.shows_category(key, "slack") for oc, _ in items)
 
 
 def _write_org_files(
@@ -192,15 +193,11 @@ def _write_org_files(
     org_dir = output_dir / slug
     org_dir.mkdir(parents=True, exist_ok=True)
     (org_dir / "report.md").write_text(
-        md_render.render_org(
-            org, top_n=top_n, show=_show(report_cfg, "markdown")
-        ),
+        md_render.render_org(org, top_n=top_n, show=_show(report_cfg, "markdown")),
         encoding="utf-8",
     )
     (org_dir / "report.html").write_text(
-        html_render.render_org_html(
-            org, top_n=top_n, show=_show(report_cfg, "html")
-        ),
+        html_render.render_org_html(org, top_n=top_n, show=_show(report_cfg, "html")),
         encoding="utf-8",
     )
     # report.json is the complete machine-readable dataset, so the per-output
@@ -255,36 +252,48 @@ def _abort_network(console: Console, exc: NetworkError) -> NoReturn:
     raise typer.Exit(3)
 
 
-async def _run_org(cfg: Config, *, console: Console, output_dir: Path | None,
-                   pages_url: str | None, top_n: int | None, force_notify: bool,
-                   slack_channel: str | None = None,
-                   repo_min_age_days: int | None = None,
-                   release_max_age_days: int | None = None,
-                   releases_exclude: tuple[str, ...] | None = None,
-                   top_n_report: int | None = None,
-                   top_n_cli: int | None = None,
-                   top_n_slack: int | None = None) -> int:
+async def _run_org(
+    cfg: Config,
+    *,
+    console: Console,
+    output_dir: Path | None,
+    pages_url: str | None,
+    top_n: int | None,
+    force_notify: bool,
+    slack_channel: str | None = None,
+    repo_min_age_days: int | None = None,
+    release_max_age_days: int | None = None,
+    releases_exclude: tuple[str, ...] | None = None,
+    top_n_report: int | None = None,
+    top_n_cli: int | None = None,
+    top_n_slack: int | None = None,
+) -> int:
     now = dt.datetime.now(dt.timezone.utc)
     pairs: list[tuple[OrgConfig, OrgReport]] = []
     for org_cfg in cfg.organizations:
         token = config.resolve_token(org_cfg)
         if not token:
-            console.print(f"[red]No token in ${org_cfg.token_env} for {org_cfg.name}[/red]")
+            console.print(
+                f"[red]No token in ${org_cfg.token_env} for {org_cfg.name}[/red]"
+            )
             return 2
         # CLI overrides win over config for the Releases/Tagging controls.
         report_cfg = org_cfg.report
         if repo_min_age_days is not None:
             report_cfg = replace(report_cfg, repo_min_age_days=repo_min_age_days)
         if release_max_age_days is not None:
-            report_cfg = replace(
-                report_cfg, release_max_age_days=release_max_age_days
-            )
+            report_cfg = replace(report_cfg, release_max_age_days=release_max_age_days)
         effective_cfg = org_cfg
         if releases_exclude is not None:
             effective_cfg = replace(org_cfg, releases_exclude=releases_exclude)
         async with GitHubClient(token) as client:
             pairs.append(
-                (org_cfg, await collect.collect_org(client, effective_cfg, report_cfg, generated_at=now))
+                (
+                    org_cfg,
+                    await collect.collect_org(
+                        client, effective_cfg, report_cfg, generated_at=now
+                    ),
+                )
             )
     org_reports = [report for _, report in pairs]
 
@@ -376,7 +385,10 @@ async def _run_org(cfg: Config, *, console: Console, output_dir: Path | None,
         outputs["slack_payload"] = json.dumps(payloads[0])
         if output_dir:
             for payload in payloads:
-                dest = output_dir / f"slack-payload-{_safe_component(payload['channel'])}.json"
+                dest = (
+                    output_dir
+                    / f"slack-payload-{_safe_component(payload['channel'])}.json"
+                )
                 dest.write_text(json.dumps(payload, indent=2) + "\n", encoding="utf-8")
     runner.write_github_output(outputs)
     # The job summary mirrors the GitHub Pages Markdown, so it uses the report
@@ -396,9 +408,15 @@ async def _run_org(cfg: Config, *, console: Console, output_dir: Path | None,
     return 0
 
 
-async def _run_repo(owner: str, repo_name: str, *, token_env: str, console: Console,
-                    fail_threshold: str,
-                    ruleset_workflows: Mapping[str, str] | None = None) -> int:
+async def _run_repo(
+    owner: str,
+    repo_name: str,
+    *,
+    token_env: str,
+    console: Console,
+    fail_threshold: str,
+    ruleset_workflows: Mapping[str, str] | None = None,
+) -> int:
     token = os.environ.get(token_env, "").strip()
     if not token:
         console.print(f"[red]No token in ${token_env}[/red]")
@@ -411,7 +429,9 @@ async def _run_repo(owner: str, repo_name: str, *, token_env: str, console: Cons
         return 2
 
     now = dt.datetime.now(dt.timezone.utc)
-    org = build_org_report(f"{owner}/{repo_name}", signals, repo_count=1, generated_at=now)
+    org = build_org_report(
+        f"{owner}/{repo_name}", signals, repo_count=1, generated_at=now
+    )
     term_render.render_org(org, console)
 
     runner.append_step_summary(md_render.render_org(org))
@@ -466,7 +486,9 @@ async def _run_remediate(
 
 def _repo_outputs(signals: list[RepoSignal], fail_threshold: str) -> dict[str, str]:
     outputs = {s.signal.value + "_open": str(s.counts.total) for s in signals}
-    outputs["failed"] = "true" if runner.should_fail(signals, fail_threshold) else "false"
+    outputs["failed"] = (
+        "true" if runner.should_fail(signals, fail_threshold) else "false"
+    )
     return outputs
 
 
@@ -475,24 +497,77 @@ def _repo_outputs(signals: list[RepoSignal], fail_threshold: str) -> dict[str, s
 # --------------------------------------------------------------------------- #
 @app.command()
 def report(
-    config_file: str | None = typer.Option(None, "--config", "-c", help="Path to a JSON config file."),
-    config_data: str | None = typer.Option(None, "--config-data", help="Raw or base64 JSON config (vars/secrets)."),
-    org: str | None = typer.Option(None, "--org", help="Single organisation (shorthand for org mode)."),
+    config_file: str | None = typer.Option(
+        None, "--config", "-c", help="Path to a JSON config file."
+    ),
+    config_data: str | None = typer.Option(
+        None, "--config-data", help="Raw or base64 JSON config (vars/secrets)."
+    ),
+    org: str | None = typer.Option(
+        None, "--org", help="Single organisation (shorthand for org mode)."
+    ),
     scope: str = typer.Option("auto", "--scope", help="auto | org | repo."),
-    repo: str | None = typer.Option(None, "--repo", help="owner/name for repo mode (else git-detected)."),
-    token_env: str = typer.Option("GITHUB_TOKEN", "--token-env", help="Env var holding the repo-mode token."),
-    output_dir: str | None = typer.Option(None, "--output-dir", "-o", help="Directory for Pages output (org mode)."),
-    pages_url: str | None = typer.Option(None, "--pages-url", help="GitHub Pages URL for the Slack link."),
-    slack_channel: str | None = typer.Option(None, "--slack-channel", help="Slack channel ID; overrides config slack.channel (e.g. SLACK_CHANNEL_ID)."),
-    top_n: int | None = typer.Option(None, "--top-n", help="Offenders shown per signal across all outputs (0 = no limit; default: config, else 10). Overridden per output by the flags below."),
-    top_n_report: int | None = typer.Option(None, "--top-n-report", help="Offenders per signal in the GitHub Pages output (0 = no limit; overrides --top-n)."),
-    top_n_cli: int | None = typer.Option(None, "--top-n-cli", help="Offenders per signal in the terminal output (0 = no limit; overrides --top-n)."),
-    top_n_slack: int | None = typer.Option(None, "--top-n-slack", help="Offenders per signal in the Slack digest (0 = no limit; overrides --top-n)."),
-    fail_threshold: str = typer.Option("none", "--fail-threshold", help="none|low|medium|high|critical|any (repo mode)."),
-    force_notify: bool = typer.Option(False, "--force-notify", help="Post to Slack regardless of report_day."),
-    repo_min_age_days: int | None = typer.Option(None, "--repo-min-age-days", "--release-min-age-days", help="Exclude repos created within N days from Releases/Tagging (0 = include all; default: config, else 28). --release-min-age-days is a deprecated alias."),
-    release_max_age_days: int | None = typer.Option(None, "--release-max-age-days", help="Flag a repo in Releases/Tagging only when its newest release or tag is older than N days (0 = flag every eligible repo; default: config, else 60)."),
-    releases_exclude: list[str] | None = typer.Option(None, "--releases-exclude", help="Repository name to omit from the Releases/Tagging table (repeatable; overrides config)."),
+    repo: str | None = typer.Option(
+        None, "--repo", help="owner/name for repo mode (else git-detected)."
+    ),
+    token_env: str = typer.Option(
+        "GITHUB_TOKEN", "--token-env", help="Env var holding the repo-mode token."
+    ),
+    output_dir: str | None = typer.Option(
+        None, "--output-dir", "-o", help="Directory for Pages output (org mode)."
+    ),
+    pages_url: str | None = typer.Option(
+        None, "--pages-url", help="GitHub Pages URL for the Slack link."
+    ),
+    slack_channel: str | None = typer.Option(
+        None,
+        "--slack-channel",
+        help="Slack channel ID; overrides config slack.channel (e.g. SLACK_CHANNEL_ID).",
+    ),
+    top_n: int | None = typer.Option(
+        None,
+        "--top-n",
+        help="Offenders shown per signal across all outputs (0 = no limit; default: config, else 10). Overridden per output by the flags below.",
+    ),
+    top_n_report: int | None = typer.Option(
+        None,
+        "--top-n-report",
+        help="Offenders per signal in the GitHub Pages output (0 = no limit; overrides --top-n).",
+    ),
+    top_n_cli: int | None = typer.Option(
+        None,
+        "--top-n-cli",
+        help="Offenders per signal in the terminal output (0 = no limit; overrides --top-n).",
+    ),
+    top_n_slack: int | None = typer.Option(
+        None,
+        "--top-n-slack",
+        help="Offenders per signal in the Slack digest (0 = no limit; overrides --top-n).",
+    ),
+    fail_threshold: str = typer.Option(
+        "none",
+        "--fail-threshold",
+        help="none|low|medium|high|critical|any (repo mode).",
+    ),
+    force_notify: bool = typer.Option(
+        False, "--force-notify", help="Post to Slack regardless of report_day."
+    ),
+    repo_min_age_days: int | None = typer.Option(
+        None,
+        "--repo-min-age-days",
+        "--release-min-age-days",
+        help="Exclude repos created within N days from Releases/Tagging (0 = include all; default: config, else 28). --release-min-age-days is a deprecated alias.",
+    ),
+    release_max_age_days: int | None = typer.Option(
+        None,
+        "--release-max-age-days",
+        help="Flag a repo in Releases/Tagging only when its newest release or tag is older than N days (0 = flag every eligible repo; default: config, else 60).",
+    ),
+    releases_exclude: list[str] | None = typer.Option(
+        None,
+        "--releases-exclude",
+        help="Repository name to omit from the Releases/Tagging table (repeatable; overrides config).",
+    ),
     no_color: bool = typer.Option(False, "--no-color", help="Disable coloured output."),
 ) -> None:
     """Generate a security and quality report."""
@@ -548,13 +623,18 @@ def report(
         try:
             code = asyncio.run(
                 _run_org(
-                    cfg, console=console,
+                    cfg,
+                    console=console,
                     output_dir=Path(output_dir) if output_dir else None,
-                    pages_url=pages_url, top_n=top_n, force_notify=force_notify,
+                    pages_url=pages_url,
+                    top_n=top_n,
+                    force_notify=force_notify,
                     slack_channel=slack_channel or None,
                     repo_min_age_days=repo_min_age_days,
                     release_max_age_days=release_max_age_days,
-                    releases_exclude=tuple(releases_exclude) if releases_exclude else None,
+                    releases_exclude=tuple(releases_exclude)
+                    if releases_exclude
+                    else None,
                     top_n_report=top_n_report,
                     top_n_cli=top_n_cli,
                     top_n_slack=top_n_slack,
@@ -571,8 +651,11 @@ def report(
         try:
             code = asyncio.run(
                 _run_repo(
-                    detected[0], detected[1], token_env=token_env,
-                    console=console, fail_threshold=fail_threshold,
+                    detected[0],
+                    detected[1],
+                    token_env=token_env,
+                    console=console,
+                    fail_threshold=fail_threshold,
                     ruleset_workflows=rw,
                 )
             )
@@ -583,13 +666,35 @@ def report(
 
 @app.command()
 def remediate(
-    config_file: str | None = typer.Option(None, "--config", "-c", help="Path to a JSON config file."),
-    config_data: str | None = typer.Option(None, "--config-data", help="Raw or base64 JSON config (vars/secrets)."),
-    org: str | None = typer.Option(None, "--org", help="Single organisation (shorthand for org mode)."),
-    scope: str = typer.Option("org", "--scope", help="Only 'org' is supported; remediation is organisation-scoped."),
-    category: list[str] | None = typer.Option(None, "--category", help="Remediable category to act on (repeatable; default: all). One of: codeql, secret_scanning, dependabot_alerts_enabled, dependabot_updates_enabled, private_vulnerability_reporting."),
-    token_env: str = typer.Option("GITHUB_TOKEN", "--token-env", help="Env var holding a WRITE-capable org-admin PAT. Used for both reading posture and enabling features across every configured org."),
-    apply: bool = typer.Option(False, "--apply", help="Perform the writes. Without this flag remediate only previews (dry run)."),
+    config_file: str | None = typer.Option(
+        None, "--config", "-c", help="Path to a JSON config file."
+    ),
+    config_data: str | None = typer.Option(
+        None, "--config-data", help="Raw or base64 JSON config (vars/secrets)."
+    ),
+    org: str | None = typer.Option(
+        None, "--org", help="Single organisation (shorthand for org mode)."
+    ),
+    scope: str = typer.Option(
+        "org",
+        "--scope",
+        help="Only 'org' is supported; remediation is organisation-scoped.",
+    ),
+    category: list[str] | None = typer.Option(
+        None,
+        "--category",
+        help="Remediable category to act on (repeatable; default: all). One of: codeql, secret_scanning, dependabot_alerts_enabled, dependabot_updates_enabled, private_vulnerability_reporting.",
+    ),
+    token_env: str = typer.Option(
+        "GITHUB_TOKEN",
+        "--token-env",
+        help="Env var holding a WRITE-capable org-admin PAT. Used for both reading posture and enabling features across every configured org.",
+    ),
+    apply: bool = typer.Option(
+        False,
+        "--apply",
+        help="Perform the writes. Without this flag remediate only previews (dry run).",
+    ),
     no_color: bool = typer.Option(False, "--no-color", help="Disable coloured output."),
 ) -> None:
     """Enable security features on repositories that lack them.