github-security-report 0.8.0__tar.gz → 0.9.0__tar.gz

{github_security_report-0.8.0 → github_security_report-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: github-security-report
-Version: 0.8.0
+Version: 0.9.0
 Summary: Security and quality reporting across GitHub organisations
 Project-URL: Homepage, https://github.com/lfreleng-actions/github-security-report-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github-security-report-action
@@ -29,14 +29,14 @@ Requires-Dist: jinja2==3.1.6
 Requires-Dist: jsonschema==4.26.0
 Requires-Dist: pyyaml==6.0.3
 Requires-Dist: rich==15.0.0
-Requires-Dist: typer==0.26.8
+Requires-Dist: typer==0.27.0
 Provides-Extra: dev
 Requires-Dist: mypy==2.3.0; extra == 'dev'
 Requires-Dist: pytest-asyncio==1.4.0; extra == 'dev'
 Requires-Dist: pytest-cov==7.1.0; extra == 'dev'
 Requires-Dist: pytest==9.1.1; extra == 'dev'
 Requires-Dist: respx==0.23.1; extra == 'dev'
-Requires-Dist: ruff==0.15.21; extra == 'dev'
+Requires-Dist: ruff==0.15.22; extra == 'dev'
 Requires-Dist: syrupy==5.5.3; extra == 'dev'
 Requires-Dist: types-jsonschema==4.26.0.20260518; extra == 'dev'
 Requires-Dist: types-pyyaml==6.0.12.20250915; extra == 'dev'

{github_security_report-0.8.0 → github_security_report-0.9.0}/pyproject.toml

@@ -45,7 +45,7 @@ keywords = [
 ]
 dependencies = [
   "httpx[http2]==0.28.1",
-  "typer==0.26.8",
+  "typer==0.27.0",
   "rich==15.0.0",
   "jinja2==3.1.6",
   "jsonschema==4.26.0",
@@ -65,7 +65,7 @@ dev = [
   "respx==0.23.1",
   "syrupy==5.5.3",
   "mypy==2.3.0",
-  "ruff==0.15.21",
+  "ruff==0.15.22",
   "types-jsonschema==4.26.0.20260518",
   "types-PyYAML==6.0.12.20250915",
 ]
@@ -97,7 +97,7 @@ dev = [
   "respx==0.23.1",
   "syrupy==5.5.3",
   "mypy==2.3.0",
-  "ruff==0.15.21",
+  "ruff==0.15.22",
   "types-jsonschema==4.26.0.20260518",
   "types-PyYAML==6.0.12.20250915",
 ]

{github_security_report-0.8.0 → github_security_report-0.9.0}/src/github_security_report/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.8.0'
-__version_tuple__ = version_tuple = (0, 8, 0)
+__version__ = version = '0.9.0'
+__version_tuple__ = version_tuple = (0, 9, 0)
 
 __commit_id__ = commit_id = None

{github_security_report-0.8.0 → github_security_report-0.9.0}/src/github_security_report/categories.py

@@ -67,9 +67,9 @@ class CategoryMeta:
     # A repository fails (appears as an offender) only when it carries a finding
     # at or above this rung; findings below it fold into the clean count. The
     # global default is MEDIUM, so Low and Informational findings pass; a
-    # category may lower it (Zizmor uses LOW, so only Informational passes).
-    # Meaningful only for the severity-ranked signals; binary categories ignore
-    # it. Overridable per category via the JSON config.
+    # category may lower it (Zizmor uses INFORMATIONAL, so every finding
+    # counts). Meaningful only for the severity-ranked signals; binary
+    # categories ignore it. Overridable per category via the JSON config.
     fail_severity: Severity = Severity.MEDIUM
 
 
@@ -106,10 +106,18 @@ _CATEGORIES: dict[CategoryKey, CategoryMeta] = {
             "Zizmor static analysis of GitHub Actions workflows, ranked "
             "worst-first by severity."
         ),
-        # zizmor emits its Low findings at SARIF level "note", which
-        # normalises to LOW (see severity.py), so any zizmor finding fails --
-        # matching the ruleset-enforced PR gate that blocks on note-and-above.
-        fail_severity=Severity.LOW,
+        # The organisation scan pipeline runs zizmor with an
+        # 'informational' floor, so every finding it can report reaches the
+        # SARIF. Match that here: any zizmor finding counts, at any
+        # severity. This mirrors the ruleset-enforced PR gate, which blocks
+        # on any finding regardless of level.
+        #
+        # zizmor emits both Low and Informational findings at SARIF level
+        # "note", and the code-scanning alerts API exposes only that level
+        # (not zizmor's own severity property), so the two are
+        # indistinguishable here. Cutting at INFORMATIONAL sidesteps the
+        # ambiguity: both surface either way.
+        fail_severity=Severity.INFORMATIONAL,
     ),
     CategoryKey.AISLOP: CategoryMeta(
         key=CategoryKey.AISLOP,

{github_security_report-0.8.0 → github_security_report-0.9.0}/src/github_security_report/severity.py

@@ -19,10 +19,13 @@ directly.
 The ``note`` mapping mirrors zizmor's own SARIF encoder, which emits both its
 Low and Informational findings at SARIF level ``note`` (Medium -> ``warning``,
 High -> ``error``). The organisation scan pipeline runs zizmor with
-``--min-severity low``, so informational findings never reach the uploaded
-SARIF: every ``note`` alert in code scanning is a genuine Low finding, and the
-ruleset-enforced PR gate blocks on it. Mapping ``note`` below LOW would
-(and previously did) under-state the estate's posture relative to that gate.
+``--min-severity informational``, so both tiers reach the uploaded SARIF and a
+``note`` alert may be either. The code-scanning alerts API exposes only the
+SARIF level -- not the ``zizmor/severity`` property carried in the raw SARIF --
+so the two cannot be separated here. ``note`` therefore stays at LOW rather
+than INFORMATIONAL, which errs towards over- rather than under-stating the
+estate's posture; the zizmor category cuts at INFORMATIONAL (see
+``categories.py``) so both tiers are reported regardless of where this maps.
 """
 
 from __future__ import annotations
@@ -59,11 +62,13 @@ _SECURITY_NAMES: dict[str, Severity] = {
 }
 
 # SARIF level -> security scale, used only as a fallback (zizmor, aislop).
-# zizmor's SARIF encoder emits Low AND Informational findings as ``note``, but
-# the scan pipeline's --min-severity low floor keeps informational findings out
-# of the SARIF entirely, so a ``note`` alert is a genuine Low finding (matching
-# the ruleset-enforced PR gate, which blocks on note-and-above). aislop uses
-# the same three levels. The rare ``none`` level stays at INFORMATIONAL.
+# zizmor's SARIF encoder emits Low AND Informational findings as ``note``, and
+# the scan pipeline's --min-severity informational floor lets both through, so
+# a ``note`` alert may be either tier. The alerts API does not expose zizmor's
+# own severity property, so they are indistinguishable here; ``note`` maps to
+# LOW to avoid under-stating, and the zizmor category's INFORMATIONAL cutoff
+# ensures both are reported. aislop uses the same three levels. The rare
+# ``none`` level stays at INFORMATIONAL.
 _SARIF_LEVEL_NAMES: dict[str, Severity] = {
     "error": Severity.HIGH,
     "warning": Severity.MEDIUM,