hyperi-ci 2.7.2__tar.gz → 2.7.3__tar.gz

{hyperi_ci-2.7.2 → hyperi_ci-2.7.3}/.github/workflows/ci.yml

@@ -47,11 +47,23 @@ concurrency:
   group: ${{ github.workflow }}-${{ inputs.tag || github.ref }}
   cancel-in-progress: true
 
+# Least-privilege GITHUB_TOKEN default for every job (CodeQL
+# actions/missing-workflow-permissions). Two jobs elevate: release-tail
+# (passes write down to _release-tail.yml -- semantic-release commit/tag +
+# GHCR) and plan (semantic-release push-access verify on a publish predict).
+# commit-check / quality / test / build are read-only.
+permissions:
+  contents: read
+
 jobs:
   plan:
     name: Plan
     if: github.event.pull_request.head.repo.fork != true
     runs-on: ubuntu-latest
+    # predict-version runs semantic-release, whose git plugin verifies push
+    # access (a `git push --dry-run`) on a publish predict -- needs write.
+    permissions:
+      contents: write
     outputs:
       run-checks: ${{ steps.predict.outputs.run-checks }}
       run-build: ${{ steps.predict.outputs.run-build }}
@@ -218,6 +230,14 @@ jobs:
   release-tail:
     name: Release tail
     needs: [plan, build]
+    # Elevated + passed to _release-tail.yml: its tag-and-publish job commits +
+    # tags (contents), pushes GHCR (packages) and runs the semantic-release GH
+    # plugin (issues + pull-requests). Capped by the caller's grant.
+    permissions:
+      contents: write
+      packages: write
+      issues: write
+      pull-requests: write
     # Local ref (dogfood): a change to the shared release tail is exercised
     # on hyperi-ci's own CI before any consumer pins it. The tail's own
     # tag-and-publish job is gated on will-publish == 'true', so a non-publish

{hyperi_ci-2.7.2 → hyperi_ci-2.7.3}/.github/workflows/go-ci.yml

@@ -106,6 +106,18 @@ concurrency:
 env:
   HYPERCI_PUBLISH_TARGET: ${{ inputs.publish-target }}
   HYPERCI_INSTALL: uvx --no-cache --refresh hyperi-ci
+  # Rare edge-case escape hatch: set the HYPERCI_QUALITY_SKIP repo/org
+  # variable (e.g. "semgrep") to force-skip a quality tool whose false
+  # positive is halting CI, until the real fix lands. Empty when unset.
+  HYPERCI_QUALITY_SKIP: ${{ vars.HYPERCI_QUALITY_SKIP }}
+
+# Least-privilege GITHUB_TOKEN default for every job (CodeQL
+# actions/missing-workflow-permissions). Two jobs elevate: release-tail
+# (passes write down to _release-tail.yml -- semantic-release commit/tag +
+# GHCR) and plan (semantic-release push-access verify on a publish predict).
+# commit-check / quality / test / build are read-only.
+permissions:
+  contents: read
 
 jobs:
   # ---------------------------------------------------------------------------
@@ -116,6 +128,10 @@ jobs:
     name: Plan
     if: github.event.pull_request.head.repo.fork != true
     runs-on: ubuntu-latest
+    # predict-version runs semantic-release, whose git plugin verifies push
+    # access (a `git push --dry-run`) on a publish predict -- needs write.
+    permissions:
+      contents: write
     outputs:
       run-checks: ${{ steps.predict.outputs.run-checks }}
       run-build: ${{ steps.predict.outputs.run-build }}
@@ -370,6 +386,14 @@ jobs:
   release-tail:
     name: Release tail
     needs: [plan, build]
+    # Elevated + passed to _release-tail.yml: its tag-and-publish job commits +
+    # tags (contents), pushes GHCR (packages) and runs the semantic-release GH
+    # plugin (issues + pull-requests). Capped by the caller's grant.
+    permissions:
+      contents: write
+      packages: write
+      issues: write
+      pull-requests: write
     uses: hyperi-io/hyperi-ci/.github/workflows/_release-tail.yml@main
     with:
       language: golang

{hyperi_ci-2.7.2 → hyperi_ci-2.7.3}/.github/workflows/python-ci.yml

@@ -110,6 +110,18 @@ concurrency:
 env:
   HYPERCI_PUBLISH_TARGET: ${{ inputs.publish-target }}
   HYPERCI_INSTALL: uvx --no-cache --refresh hyperi-ci
+  # Rare edge-case escape hatch: set the HYPERCI_QUALITY_SKIP repo/org
+  # variable (e.g. "semgrep") to force-skip a quality tool whose false
+  # positive is halting CI, until the real fix lands. Empty when unset.
+  HYPERCI_QUALITY_SKIP: ${{ vars.HYPERCI_QUALITY_SKIP }}
+
+# Least-privilege GITHUB_TOKEN default for every job (CodeQL
+# actions/missing-workflow-permissions). Two jobs elevate: release-tail
+# (passes write down to _release-tail.yml -- semantic-release commit/tag +
+# GHCR) and plan (semantic-release push-access verify on a publish predict).
+# commit-check / quality / test / build are read-only.
+permissions:
+  contents: read
 
 jobs:
   # ---------------------------------------------------------------------------
@@ -121,6 +133,10 @@ jobs:
     name: Plan
     if: github.event.pull_request.head.repo.fork != true
     runs-on: ubuntu-latest
+    # predict-version runs semantic-release, whose git plugin verifies push
+    # access (a `git push --dry-run`) on a publish predict -- needs write.
+    permissions:
+      contents: write
     outputs:
       run-checks: ${{ steps.predict.outputs.run-checks }}
       run-build: ${{ steps.predict.outputs.run-build }}
@@ -367,6 +383,14 @@ jobs:
   release-tail:
     name: Release tail
     needs: [plan, build]
+    # Elevated + passed to _release-tail.yml: its tag-and-publish job commits +
+    # tags (contents), pushes GHCR (packages) and runs the semantic-release GH
+    # plugin (issues + pull-requests). Capped by the caller's grant.
+    permissions:
+      contents: write
+      packages: write
+      issues: write
+      pull-requests: write
     uses: hyperi-io/hyperi-ci/.github/workflows/_release-tail.yml@main
     with:
       language: python

{hyperi_ci-2.7.2 → hyperi_ci-2.7.3}/.github/workflows/rust-ci.yml

@@ -118,6 +118,18 @@ env:
   # publish), or `publish-target: both`, or a from-head dispatch (issue #35 —
   # a from-head release is GA, not a dev pre-release).
   HYPERCI_CHANNEL: ${{ (inputs.tag != '' || inputs.publish-target == 'both' || inputs.from-head == 'true') && 'release' || '' }}
+  # Rare edge-case escape hatch: set the HYPERCI_QUALITY_SKIP repo/org
+  # variable (e.g. "semgrep") to force-skip a quality tool whose false
+  # positive is halting CI, until the real fix lands. Empty when unset.
+  HYPERCI_QUALITY_SKIP: ${{ vars.HYPERCI_QUALITY_SKIP }}
+
+# Least-privilege GITHUB_TOKEN default for every job (CodeQL
+# actions/missing-workflow-permissions). Two jobs elevate: release-tail
+# (passes write down to _release-tail.yml -- semantic-release commit/tag +
+# GHCR) and plan (semantic-release push-access verify on a publish predict).
+# commit-check / quality / test / build are read-only.
+permissions:
+  contents: read
 
 jobs:
   # ---------------------------------------------------------------------------
@@ -136,6 +148,10 @@ jobs:
     name: Plan
     if: github.event.pull_request.head.repo.fork != true
     runs-on: ubuntu-latest
+    # predict-version runs semantic-release, whose git plugin verifies push
+    # access (a `git push --dry-run`) on a publish predict -- needs write.
+    permissions:
+      contents: write
     outputs:
       run-checks: ${{ steps.predict.outputs.run-checks }}
       run-build: ${{ steps.predict.outputs.run-build }}
@@ -424,6 +440,14 @@ jobs:
   release-tail:
     name: Release tail
     needs: [plan, build]
+    # Elevated + passed to _release-tail.yml: its tag-and-publish job commits +
+    # tags (contents), pushes GHCR (packages) and runs the semantic-release GH
+    # plugin (issues + pull-requests). Capped by the caller's grant.
+    permissions:
+      contents: write
+      packages: write
+      issues: write
+      pull-requests: write
     uses: hyperi-io/hyperi-ci/.github/workflows/_release-tail.yml@main
     with:
       language: rust

{hyperi_ci-2.7.2 → hyperi_ci-2.7.3}/.github/workflows/ts-ci.yml

@@ -108,6 +108,18 @@ concurrency:
 env:
   HYPERCI_PUBLISH_TARGET: ${{ inputs.publish-target }}
   HYPERCI_INSTALL: uvx --no-cache --refresh hyperi-ci
+  # Rare edge-case escape hatch: set the HYPERCI_QUALITY_SKIP repo/org
+  # variable (e.g. "semgrep") to force-skip a quality tool whose false
+  # positive is halting CI, until the real fix lands. Empty when unset.
+  HYPERCI_QUALITY_SKIP: ${{ vars.HYPERCI_QUALITY_SKIP }}
+
+# Least-privilege GITHUB_TOKEN default for every job (CodeQL
+# actions/missing-workflow-permissions). Two jobs elevate: release-tail
+# (passes write down to _release-tail.yml -- semantic-release commit/tag +
+# GHCR) and plan (semantic-release push-access verify on a publish predict).
+# commit-check / quality / test / build are read-only.
+permissions:
+  contents: read
 
 jobs:
   # ---------------------------------------------------------------------------
@@ -118,6 +130,10 @@ jobs:
     name: Plan
     if: github.event.pull_request.head.repo.fork != true
     runs-on: ubuntu-latest
+    # predict-version runs semantic-release, whose git plugin verifies push
+    # access (a `git push --dry-run`) on a publish predict -- needs write.
+    permissions:
+      contents: write
     outputs:
       run-checks: ${{ steps.predict.outputs.run-checks }}
       run-build: ${{ steps.predict.outputs.run-build }}
@@ -378,6 +394,14 @@ jobs:
   release-tail:
     name: Release tail
     needs: [plan, build]
+    # Elevated + passed to _release-tail.yml: its tag-and-publish job commits +
+    # tags (contents), pushes GHCR (packages) and runs the semantic-release GH
+    # plugin (issues + pull-requests). Capped by the caller's grant.
+    permissions:
+      contents: write
+      packages: write
+      issues: write
+      pull-requests: write
     uses: hyperi-io/hyperi-ci/.github/workflows/_release-tail.yml@main
     with:
       language: typescript

{hyperi_ci-2.7.2 → hyperi_ci-2.7.3}/.hyperi-ci.yaml

@@ -33,3 +33,7 @@ quality:
         - python.lang.compatibility.python36.python36-compatibility-importlib2
         - python.lang.compatibility.python37.python37-compatibility-importlib2
       reason: "importlib.resources is stdlib; repo requires-python >= 3.12, no py<3.9 support"
+    - tool: semgrep
+      ids:
+        - yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
+      reason: "gitops_templates/ ships floating @vN action refs as a readable starting point; downstream repos pin via their own Renovate. This repo's own workflows are SHA-pinned (versions.yaml + pre-commit hook) so the rule is redundant here. Rule-scoped, not a path exclude, so other semgrep rules still cover the templates."

{hyperi_ci-2.7.2 → hyperi_ci-2.7.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hyperi-ci
-Version: 2.7.2
+Version: 2.7.3
 Summary: HyperI CI/CD CLI tool — multi-language build, test, and publish automation
 Project-URL: Homepage, https://github.com/hyperi-io/hyperi-ci
 Project-URL: Repository, https://github.com/hyperi-io/hyperi-ci
@@ -79,6 +79,17 @@ only — those code paths have been removed.
 - Semantic-release config that just works
 - A commit hook that catches bad messages before they hit CI
 
+## Preventative, Not Detective
+
+hyperi-ci is the preventative layer: gitleaks blocks a secret before
+the push, commit validation blocks a bad message before it lands,
+quality gates block a broken build before it merges. GitHub's native
+security features (secret scanning alerts, CodeQL code scanning,
+Dependabot) are the detective layer - they find what already landed,
+or what arrived from upstream in repos hyperi-ci never runs on
+(external forks, mirrors). Run both: hyperi-ci stops you making the
+mess, the GitHub side catches the mess you inherited.
+
 ## Install
 
 ```bash
@@ -104,6 +115,7 @@ This creates `.hyperi-ci.yaml`, `Makefile`, `.github/workflows/ci.yml`,
 hyperi-ci check                         # Quality + test
 hyperi-ci check --quick                 # Quality only (fast)
 hyperi-ci check --full                  # Quality + test + build
+hyperi-ci check --strict                # Also fail on warn-tier findings (zero warnings)
 
 # 3. Commit (hook validates your message format)
 git commit -m "fix: resolve timeout in auth handler"
@@ -274,6 +286,7 @@ No code changes, no workflow changes.
 | `hyperi-ci check` | Pre-push validation (quality + test) |
 | `hyperi-ci check --quick` | Quality only |
 | `hyperi-ci check --full` | Quality + test + build |
+| `hyperi-ci check --strict` | Also fail on warn-tier findings - see [docs/quality-gate.md](docs/quality-gate.md) |
 | `hyperi-ci push` | Push (validate-only — no tag, no publish) |
 | `hyperi-ci push --publish` | Stamp `Publish: true` trailer, push, single-run publish |
 | `hyperi-ci push --bump-patch` | Force +0.0.1 release even with no-bump commits |

{hyperi_ci-2.7.2 → hyperi_ci-2.7.3}/README.md

@@ -46,6 +46,17 @@ only — those code paths have been removed.
 - Semantic-release config that just works
 - A commit hook that catches bad messages before they hit CI
 
+## Preventative, Not Detective
+
+hyperi-ci is the preventative layer: gitleaks blocks a secret before
+the push, commit validation blocks a bad message before it lands,
+quality gates block a broken build before it merges. GitHub's native
+security features (secret scanning alerts, CodeQL code scanning,
+Dependabot) are the detective layer - they find what already landed,
+or what arrived from upstream in repos hyperi-ci never runs on
+(external forks, mirrors). Run both: hyperi-ci stops you making the
+mess, the GitHub side catches the mess you inherited.
+
 ## Install
 
 ```bash
@@ -71,6 +82,7 @@ This creates `.hyperi-ci.yaml`, `Makefile`, `.github/workflows/ci.yml`,
 hyperi-ci check                         # Quality + test
 hyperi-ci check --quick                 # Quality only (fast)
 hyperi-ci check --full                  # Quality + test + build
+hyperi-ci check --strict                # Also fail on warn-tier findings (zero warnings)
 
 # 3. Commit (hook validates your message format)
 git commit -m "fix: resolve timeout in auth handler"
@@ -241,6 +253,7 @@ No code changes, no workflow changes.
 | `hyperi-ci check` | Pre-push validation (quality + test) |
 | `hyperi-ci check --quick` | Quality only |
 | `hyperi-ci check --full` | Quality + test + build |
+| `hyperi-ci check --strict` | Also fail on warn-tier findings - see [docs/quality-gate.md](docs/quality-gate.md) |
 | `hyperi-ci push` | Push (validate-only — no tag, no publish) |
 | `hyperi-ci push --publish` | Stamp `Publish: true` trailer, push, single-run publish |
 | `hyperi-ci push --bump-patch` | Force +0.0.1 release even with no-bump commits |

hyperi_ci-2.7.3/VERSION

@@ -0,0 +1 @@
+2.7.3

{hyperi_ci-2.7.2 → hyperi_ci-2.7.3}/docs/ARCHITECTURE.md

@@ -188,7 +188,7 @@ Third-party pinning policy: [dependencies/DEPS-PINNING.md](dependencies/DEPS-PIN
 
 ```
 hyperi-ci run <stage>      quality | test | build | publish
-hyperi-ci check [--quick|--full]   pre-push: quality(+test)(+native build)
+hyperi-ci check [--quick|--full|--strict]  pre-push: quality(+test)(+build); --strict fails on warn-tier findings
 hyperi-ci push [--publish]         commit + push, opt-in Publish: true trailer
 hyperi-ci release <tag>            dispatch a GA/optimised release run
 hyperi-ci publish                  run the publish stage

{hyperi_ci-2.7.2 → hyperi_ci-2.7.3}/docs/DESIGN.md

@@ -182,6 +182,7 @@ hyperi-ci run <stage>     Run CI stage (setup, quality, test, build, publish)
 hyperi-ci check           Pre-push validation (quality + test)
 hyperi-ci check --full    Pre-push with build (native target only)
 hyperi-ci check --quick   Quality checks only
+hyperi-ci check --strict  Also fail on warn-tier findings (zero-warnings gate)
 hyperi-ci init            Generate project scaffolding
 hyperi-ci detect          Show detected language
 hyperi-ci config          Show merged configuration

hyperi_ci-2.7.3/docs/quality-gate.md

@@ -0,0 +1,142 @@
+# Project:   HyperI CI
+# File:      docs/quality-gate.md
+# Purpose:   Reference for the quality stage - tools, modes, --strict, skip hatch
+#
+# License:   BUSL-1.1 -- HYPERI PTY LIMITED
+# Copyright: (c) 2026 HYPERI PTY LIMITED
+
+# Quality gate
+
+The quality stage runs a fixed set of tools and decides, per tool, whether a
+finding is fatal. Two cross-language scanners (gitleaks, semgrep) run once at
+the dispatch level; the rest run in the per-language handler. Each tool's
+**effective mode** is resolved from config, an optional strict upgrade, and a
+force-skip escape hatch, in that precedence.
+
+Same code runs locally (`hyperi-ci check`) and in CI (`hyperi-ci run quality`).
+The only difference is the local-vs-CI handling of a missing tool (below).
+
+## Effective mode - how a tool's fate is decided
+
+Bottom line: **skip beats strict beats configured mode.** A force-skip disables
+the tool; otherwise strict upgrades a `warn` tool to `blocking`; otherwise the
+configured mode stands.
+
+```mermaid
+flowchart TB
+    T["a quality tool"] --> SK{"tool in<br/>HYPERCI_QUALITY_SKIP?"}
+    SK -->|yes| D["disabled<br/>(loud CI warning)"]:::skip
+    SK -->|no| M["configured mode<br/>quality.&lt;tool&gt; or quality.&lt;lang&gt;.&lt;tool&gt;"]
+    M --> ST{"--strict AND<br/>mode is warn?"}
+    ST -->|yes| B["blocking"]:::block
+    ST -->|no| K["keep configured mode<br/>(blocking / warn / disabled)"]
+    classDef skip fill:#D55E00,color:#fff
+    classDef block fill:#0072B2,color:#fff
+```
+
+Resolution lives in `src/hyperi_ci/languages/quality_common.py`
+(`resolve_tool_mode`, `apply_strict`, `is_skipped`) and is shared by the
+per-language handlers and the dispatch-level semgrep module, so the precedence
+is identical everywhere.
+
+## Modes
+
+| Mode | Finding behaviour |
+|---|---|
+| `blocking` | A finding fails the stage (non-zero exit) |
+| `warn` | A finding prints but does not fail |
+| `disabled` | The tool does not run |
+
+Set per project in `.hyperi-ci.yaml` under `quality.<lang>.<tool>` (or
+`quality.<tool>` for the cross-language `gitleaks` / `semgrep`); defaults live in
+`src/hyperi_ci/config/defaults.yaml`.
+
+## Tools
+
+| Tool | Scope | Where |
+|---|---|---|
+| gitleaks | cross-language secret scan | dispatch (`quality/gitleaks.py`) |
+| semgrep | cross-language SAST (`--config auto`) | dispatch (`quality/semgrep.py`) |
+| ruff (lint, format, docstrings) | Python | `languages/python/quality.py` |
+| ty | Python types | Python handler |
+| pip-audit, bandit, vulture | Python | Python handler |
+| clippy, rustfmt, cargo-audit/deny, osv-scanner | Rust | `languages/rust/quality.py` |
+| eslint, prettier, tsc, npm audit, osv-scanner | TypeScript | `languages/typescript/quality.py` |
+| gofmt, govet, golangci-lint, gosec, govulncheck | Go | `languages/golang/quality.py` |
+
+semgrep and gitleaks moved to the dispatch level because their rulesets are
+language-agnostic - running them once avoids the drift where only one handler
+passed shared excludes.
+
+## --strict - a zero-warnings pre-push gate
+
+`hyperi-ci check --strict` treats every `warn`-tier finding as `blocking`, so a
+developer sees - and fixes or explicitly ignores - everything CI would surface
+BEFORE the push, not after. It sets `HYPERCI_QUALITY_STRICT=1`, which
+`apply_strict` reads.
+
+`disabled` tools stay off (strict enforces warnings, it does not resurrect a
+tool a project turned off). A tool that is not installed locally (and has no
+`uv` fallback) is still warn-skipped even under `--strict` - strict enforces
+what runs, not what your machine has; CI, where the tools are present, is the
+backstop.
+
+```bash
+hyperi-ci check --strict --quick     # strict quality only, no tests
+# -> non-zero if any tool has findings; fix or ignore each, then re-run
+```
+
+## HYPERCI_QUALITY_SKIP - the rare escape hatch
+
+> **Note:** This is an EMERGENCY override, not the normal path. The reviewed,
+> auditable way to silence a tool is the config (`quality.<tool>: disabled` or
+> the `quality.ignore` list).
+
+When a tool's false positive halts CI - a semgrep rule misfiring on a
+dependency, an audit advisory with no fix yet - set `HYPERCI_QUALITY_SKIP` to
+the tool name (comma-separated for several) to force it to `disabled` for the
+blocked runs WITHOUT a config commit, then remove it once the real fix lands.
+
+A force-skip is logged LOUDLY: a `warn()` line plus, in CI, a real GitHub
+`::warning::` annotation that lands in the run summary (it does not hide inside
+a collapsed log group) - so skipping a security scanner like gitleaks cannot
+pass unnoticed.
+
+In CI, set the `HYPERCI_QUALITY_SKIP` repo or org Actions variable; the four
+reusable language workflows pass it through (empty variable = no-op). Only a
+repo admin / org owner can set it.
+
+```bash
+# local one-off: skip semgrep for this run
+HYPERCI_QUALITY_SKIP=semgrep hyperi-ci run quality
+```
+
+## Suppressing a specific rule (the reviewed path)
+
+To silence one noisy rule permanently, use `quality.ignore` in `.hyperi-ci.yaml`
+- it is committed, diffable, and carries a `reason`:
+
+```yaml
+quality:
+  ignore:
+    - tool: semgrep
+      ids:
+        - <full.rule.id>
+      reason: "why this rule is noise here"
+```
+
+This is rule-scoped (not a path exclude), so the rest of the tool's coverage
+stays active. `for_tool` in `src/hyperi_ci/quality/ignores.py` feeds these to
+the tool's native ignore flag.
+
+## Missing tool - local vs CI
+
+A tool that is not installed and has no `uv`/`uvx` fallback:
+
+- **In CI** (`CI` env set): a `blocking` tool FAILS - every tool must be
+  present, and a silent skip would mask a coverage gap.
+- **Locally**: it warn-skips and carries on, so `hyperi-ci check` still runs
+  whatever IS installed and tells you what it skipped.
+
+This matches the gitleaks stage's existing behaviour (`is_ci()` in
+`src/hyperi_ci/common.py`).

{hyperi_ci-2.7.2 → hyperi_ci-2.7.3}/src/hyperi_ci/cli.py

@@ -8,7 +8,7 @@
 
 Usage:
     hyperi-ci run <stage>               Run a CI stage (setup, quality, test, build, publish)
-    hyperi-ci check                     Pre-push checks (quality + test; --full adds build)
+    hyperi-ci check                     Pre-push checks (quality + test; --full adds build, --strict fails on warnings)
     hyperi-ci push                      Push with pre-checks (replaces bare git push)
     hyperi-ci init                      Initialise project (config, Makefile, workflow)
     hyperi-ci detect                    Detect project language
@@ -41,6 +41,7 @@ rely on muscle memory. In particular:
 from __future__ import annotations
 
 import json
+import os
 import sys
 from pathlib import Path
 from typing import Annotated
@@ -117,10 +118,32 @@ def check(
         bool,
         typer.Option("--quick", help="Quality checks only (skip tests)"),
     ] = False,
+    strict: Annotated[
+        bool,
+        typer.Option(
+            "--strict",
+            help=(
+                "Fail on warn-tier quality findings (ty, semgrep, "
+                "docstrings, ...) too -- a zero-warnings pre-push gate that "
+                "surfaces everything CI would show, before the push."
+            ),
+        ),
+    ] = False,
 ) -> None:
-    """Run local pre-push checks (quality + test by default)."""
+    """Run local pre-push checks (quality + test by default).
+
+    With ``--strict``, warn-tier quality findings (which CI tolerates but
+    still prints) are treated as failures, so nothing is carried into a
+    push unseen. Fix each, or flag it to ignore if it genuinely should be.
+    A tool that is not installed locally (and has no uv fallback) is still
+    warn-skipped even under ``--strict`` -- strict enforces what runs, not
+    what your machine has; CI, where the tools are present, is the backstop.
+    """
     dir_path = Path(project_dir) if project_dir else None
 
+    if strict:
+        os.environ["HYPERCI_QUALITY_STRICT"] = "1"
+
     stages = ["quality"]
     if not quick:
         stages.append("test")
@@ -239,8 +262,6 @@ def push(
     With ``--no-ci``: amends the last commit with ``[skip ci]`` and
     pushes (skips CI altogether).
     """
-    import os
-
     from hyperi_ci.push import push as do_push
 
     if bump_patch and bump_minor:

{hyperi_ci-2.7.2 → hyperi_ci-2.7.3}/src/hyperi_ci/config/defaults.yaml

@@ -69,6 +69,7 @@ quality:
   enabled: true
   exclude_paths: []
   gitleaks: blocking
+  semgrep: warn              # Semgrep SAST (cross-language) - runs once at dispatch, like gitleaks
 
   # Directories treated as test code (relaxed rules applied)
   # Override per project in .hyperi-ci.yaml
@@ -79,7 +80,6 @@ quality:
     ruff: blocking
     ty: warn                   # Astral's type checker (OSS, Rust-based, replaces pyright/mypy)
     pyright: disabled          # Superseded by ty
-    semgrep: warn              # Semgrep SAST — auto-config rules for Python
     bandit: disabled            # Superseded by ruff S rules
     bandit_exclude_tests: true  # Legacy — only used if bandit re-enabled
     pip_audit: blocking
@@ -114,7 +114,6 @@ quality:
     audit: blocking
     audit_level: moderate
     osv_scanner: warn          # malicious-package (MAL-*) scan; npm audit is CVE-only
-    semgrep: warn              # Semgrep SAST — auto-config rules for TypeScript
     test_ignore:
       - "@typescript-eslint/no-explicit-any"
       - "@typescript-eslint/no-non-null-assertion"
@@ -126,7 +125,6 @@ quality:
     golangci_lint: blocking
     gosec: blocking
     govulncheck: warn
-    semgrep: warn              # Semgrep SAST — auto-config rules for Go
     test_ignore:
       - errcheck
       - gosec
@@ -138,7 +136,6 @@ quality:
     osv_scanner: warn          # malicious-package (MAL-*) scan; OSV feed not in RustSec
     deny: warn
     features: all
-    semgrep: warn              # Semgrep SAST — auto-config rules for Rust
     # Feature-matrix check: catches feature-gating bugs where a module behind
     # feature X uses a crate only declared by feature Y. Without this check,
     # transitive deps from other features mask the bug until a downstream

{hyperi_ci-2.7.2 → hyperi_ci-2.7.3}/src/hyperi_ci/dispatch.py

@@ -31,7 +31,7 @@ from hyperi_ci.common import (
 )
 from hyperi_ci.config import VALID_PROJECT_STATUSES, CIConfig, load_config
 from hyperi_ci.detect import detect_language
-from hyperi_ci.quality import commit_validation, gitleaks
+from hyperi_ci.quality import commit_validation, gitleaks, semgrep
 
 
 class StageRunFn(Protocol):
@@ -181,6 +181,13 @@ def stage_quality(language: str, config: CIConfig, *, local: bool = False) -> in
         if rc != 0:
             return rc
 
+    # Semgrep SAST is cross-language too (python / go / ts / rust / yaml /
+    # ...), so it runs here once rather than inside every language handler.
+    with group("Semgrep SAST scanning"):
+        rc = semgrep.run(config, language=language)
+        if rc != 0:
+            return rc
+
     # Commit-message validation. In CI this is the dedicated `commit-check`
     # workflow job -- it runs on every merge to main (not just the
     # publish-worthy pushes the run-checks-gated quality job covers) and is

{hyperi_ci-2.7.2 → hyperi_ci-2.7.3}/src/hyperi_ci/languages/golang/quality.py

@@ -11,16 +11,16 @@ from __future__ import annotations
 import shutil
 import subprocess
 
-from hyperi_ci.common import error, info, success, warn
+from hyperi_ci.common import error, info, is_ci, success, warn
 from hyperi_ci.config import CIConfig
-from hyperi_ci.languages.quality_common import get_test_ignore
+from hyperi_ci.languages.quality_common import get_test_ignore, resolve_tool_mode
 from hyperi_ci.quality.ignores import for_tool, load_ignores
 
 _DEFAULT_GO_TEST_IGNORE = ["errcheck", "gosec"]
 
 
 def _get_tool_mode(tool: str, config: CIConfig) -> str:
-    return str(config.get(f"quality.golang.{tool}", "blocking"))
+    return resolve_tool_mode(tool, config, "golang")
 
 
 def _resolve_tool_cmd(cmd: list[str], use_uvx: bool = False) -> list[str]:
@@ -44,10 +44,15 @@ def _run_tool(
 
     resolved = _resolve_tool_cmd(cmd, use_uvx=use_uvx)
     if resolved == cmd and not shutil.which(cmd[0]):
-        if mode == "blocking":
+        # A missing tool fails the gate only in CI, where every tool MUST
+        # be present -- a silent skip would mask a coverage gap. Locally it
+        # is an environment gap, not a quality finding: warn and carry on
+        # so `hyperi-ci check` still runs whatever IS installed (matches
+        # the gitleaks stage's local-vs-CI handling).
+        if mode == "blocking" and is_ci():
             error(f"  {tool_name}: not installed (required)")
             return False
-        warn(f"  {tool_name}: not installed (skipping)")
+        warn(f"  {tool_name}: not installed (skipping locally)")
         return True
 
     result = subprocess.run(resolved, capture_output=True, text=True)
@@ -131,12 +136,4 @@ def run(config: CIConfig, extra_env: dict[str, str] | None = None) -> int:
     if not _run_tool("govulncheck", ["govulncheck", "./..."], mode):
         had_failure = True
 
-    # Semgrep SAST scanning
-    mode = _get_tool_mode("semgrep", config)
-    semgrep_cmd = ["semgrep", "scan", "--config", "auto", "--error", "--quiet"]
-    for entry in for_tool(ignores, "semgrep"):
-        semgrep_cmd.extend(["--exclude-rule", entry.id])
-    if not _run_tool("semgrep", semgrep_cmd, mode, use_uvx=True):
-        had_failure = True
-
     return 1 if had_failure else 0