pyrig-codeql 1.0.0__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pyrig_codeql/__init__.py +1 -0
- pyrig_codeql/py.typed +0 -0
- pyrig_codeql/rig/__init__.py +5 -0
- pyrig_codeql/rig/configs/__init__.py +5 -0
- pyrig_codeql/rig/configs/version_control/__init__.py +1 -0
- pyrig_codeql/rig/configs/version_control/remote/__init__.py +1 -0
- pyrig_codeql/rig/configs/version_control/remote/workflows/__init__.py +1 -0
- pyrig_codeql/rig/configs/version_control/remote/workflows/health_check.py +122 -0
- pyrig_codeql/rig/resources/CODEQL_ANALYZE_ACTION +3 -0
- pyrig_codeql/rig/resources/CODEQL_INIT_ACTION +3 -0
- pyrig_codeql/rig/resources/__init__.py +1 -0
- pyrig_codeql-1.0.0.dist-info/METADATA +100 -0
- pyrig_codeql-1.0.0.dist-info/RECORD +16 -0
- pyrig_codeql-1.0.0.dist-info/WHEEL +4 -0
- pyrig_codeql-1.0.0.dist-info/entry_points.txt +3 -0
- pyrig_codeql-1.0.0.dist-info/licenses/LICENSE +21 -0
pyrig_codeql/__init__.py
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
"""The top-level package for the project."""
|
pyrig_codeql/py.typed
ADDED
|
File without changes
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
"""CodeQL customizations for generated version-control configuration."""
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
"""CodeQL customizations for generated GitHub remote-repository configuration."""
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
"""CodeQL-specific GitHub Actions workflow configuration."""
|
|
@@ -0,0 +1,122 @@
|
|
|
1
|
+
"""Health check workflow extended with a CodeQL analysis job."""
|
|
2
|
+
|
|
3
|
+
from types import MethodType
|
|
4
|
+
from typing import Any
|
|
5
|
+
|
|
6
|
+
from pyrig.rig.configs.version_control.remote.workflows.health_check import (
|
|
7
|
+
HealthCheckWorkflowConfigFile as BaseHealthCheckWorkflowConfigFile,
|
|
8
|
+
)
|
|
9
|
+
|
|
10
|
+
from pyrig_codeql.rig import resources
|
|
11
|
+
|
|
12
|
+
|
|
13
|
+
class HealthCheckWorkflowConfigFile(BaseHealthCheckWorkflowConfigFile):
|
|
14
|
+
"""Health check workflow extended with a CodeQL analysis job."""
|
|
15
|
+
|
|
16
|
+
def jobs(self) -> dict[str, Any]:
|
|
17
|
+
"""Return the base class's jobs, extended with the CodeQL analysis job.
|
|
18
|
+
|
|
19
|
+
Returns:
|
|
20
|
+
The base class jobs plus the CodeQL analysis job.
|
|
21
|
+
"""
|
|
22
|
+
return {
|
|
23
|
+
**self.job_analyze(),
|
|
24
|
+
**super().jobs(),
|
|
25
|
+
}
|
|
26
|
+
|
|
27
|
+
def job_health_check_needs(self) -> tuple[MethodType, ...]:
|
|
28
|
+
"""Return the upstream jobs required before the aggregate job runs.
|
|
29
|
+
|
|
30
|
+
Prepends the CodeQL analysis job to the two base health-check jobs so
|
|
31
|
+
the aggregate status remains a release gate for every analysis.
|
|
32
|
+
|
|
33
|
+
Returns:
|
|
34
|
+
The base class's dependencies plus the CodeQL analysis job.
|
|
35
|
+
"""
|
|
36
|
+
return (self.job_analyze, *super().job_health_check_needs())
|
|
37
|
+
|
|
38
|
+
def job_analyze(self) -> dict[str, Any]:
|
|
39
|
+
"""Return the CodeQL analysis job.
|
|
40
|
+
|
|
41
|
+
Returns:
|
|
42
|
+
Job configuration with a matrix over `("python", "actions")`,
|
|
43
|
+
the permissions CodeQL needs to build a database and upload its
|
|
44
|
+
results, and the analysis steps.
|
|
45
|
+
"""
|
|
46
|
+
return self.job(
|
|
47
|
+
self.job_analyze,
|
|
48
|
+
strategy=self.strategy_matrix(
|
|
49
|
+
matrix=self.matrix({"language": ["python", "actions"]}),
|
|
50
|
+
),
|
|
51
|
+
permissions={
|
|
52
|
+
**self.permission_contents(),
|
|
53
|
+
**self.permission("actions"),
|
|
54
|
+
**self.permission("security-events", write=True),
|
|
55
|
+
},
|
|
56
|
+
steps=self.steps_analyze(),
|
|
57
|
+
)
|
|
58
|
+
|
|
59
|
+
def steps_analyze(self) -> list[dict[str, Any]]:
|
|
60
|
+
"""Return the steps for the CodeQL analysis job.
|
|
61
|
+
|
|
62
|
+
Returns:
|
|
63
|
+
Steps that check out the repository, initialize CodeQL for the
|
|
64
|
+
current matrix language, and run the analysis.
|
|
65
|
+
"""
|
|
66
|
+
return [
|
|
67
|
+
self.step_checkout_repository(),
|
|
68
|
+
self.step_initialize_codeql(),
|
|
69
|
+
self.step_perform_codeql_analysis(),
|
|
70
|
+
]
|
|
71
|
+
|
|
72
|
+
def step_initialize_codeql(self) -> dict[str, Any]:
|
|
73
|
+
"""Build a step that initializes the CodeQL database.
|
|
74
|
+
|
|
75
|
+
Neither analyzed language is compiled, so no build step is
|
|
76
|
+
required between initialization and analysis. Runs the
|
|
77
|
+
`security-and-quality` query suite, the strictest built-in suite,
|
|
78
|
+
which is only available via advanced setup, not the default-setup
|
|
79
|
+
API (whose `query_suite` field is limited to `default`/`extended`).
|
|
80
|
+
|
|
81
|
+
Returns:
|
|
82
|
+
Step using `github/codeql-action/init@<ref>`.
|
|
83
|
+
"""
|
|
84
|
+
return self.step(
|
|
85
|
+
self.step_initialize_codeql,
|
|
86
|
+
uses=self.codeql_init_action(),
|
|
87
|
+
with_={
|
|
88
|
+
"languages": self.insert_expression("matrix.language"),
|
|
89
|
+
"build-mode": "none",
|
|
90
|
+
"queries": "security-and-quality",
|
|
91
|
+
},
|
|
92
|
+
)
|
|
93
|
+
|
|
94
|
+
def step_perform_codeql_analysis(self) -> dict[str, Any]:
|
|
95
|
+
"""Build a step that runs the CodeQL analysis and uploads results.
|
|
96
|
+
|
|
97
|
+
Fails the job if the analysis itself fails to run; code scanning
|
|
98
|
+
alerts found by the analysis do not fail the step.
|
|
99
|
+
|
|
100
|
+
Returns:
|
|
101
|
+
Step using `github/codeql-action/analyze@<ref>`.
|
|
102
|
+
"""
|
|
103
|
+
return self.step(
|
|
104
|
+
self.step_perform_codeql_analysis,
|
|
105
|
+
uses=self.codeql_analyze_action(),
|
|
106
|
+
)
|
|
107
|
+
|
|
108
|
+
def codeql_init_action(self) -> tuple[str, str, str]:
|
|
109
|
+
"""Return action metadata for `github/codeql-action/init`.
|
|
110
|
+
|
|
111
|
+
Returns:
|
|
112
|
+
Tuple of action name, pinned commit SHA, and release tag.
|
|
113
|
+
"""
|
|
114
|
+
return self.action_from_resource(self.codeql_init_action, resources)
|
|
115
|
+
|
|
116
|
+
def codeql_analyze_action(self) -> tuple[str, str, str]:
|
|
117
|
+
"""Return action metadata for `github/codeql-action/analyze`.
|
|
118
|
+
|
|
119
|
+
Returns:
|
|
120
|
+
Tuple of action name, pinned commit SHA, and release tag.
|
|
121
|
+
"""
|
|
122
|
+
return self.action_from_resource(self.codeql_analyze_action, resources)
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
"""Static resource files bundled with the project."""
|
|
@@ -0,0 +1,100 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: pyrig-codeql
|
|
3
|
+
Version: 1.0.0
|
|
4
|
+
Summary: A pyrig plugin that integrates GitHub CodeQL.
|
|
5
|
+
Keywords: pyrig
|
|
6
|
+
Author: Winipedia
|
|
7
|
+
Author-email: Winipedia <winipedia@gmx.de>
|
|
8
|
+
License-Expression: MIT
|
|
9
|
+
License-File: LICENSE
|
|
10
|
+
Classifier: Operating System :: OS Independent
|
|
11
|
+
Classifier: Programming Language :: Python :: 3 :: Only
|
|
12
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
13
|
+
Classifier: Programming Language :: Python :: 3.13
|
|
14
|
+
Classifier: Programming Language :: Python :: 3.14
|
|
15
|
+
Classifier: Typing :: Typed
|
|
16
|
+
Requires-Dist: pyrig>=18.86.0
|
|
17
|
+
Requires-Dist: pyrig-runtime>=3.23.47
|
|
18
|
+
Maintainer: Winipedia
|
|
19
|
+
Maintainer-email: Winipedia <winipedia@gmx.de>
|
|
20
|
+
Requires-Python: >=3.12
|
|
21
|
+
Project-URL: Changelog, https://github.com/Winipedia/pyrig-codeql/releases
|
|
22
|
+
Project-URL: Documentation, https://Winipedia.github.io/pyrig-codeql
|
|
23
|
+
Project-URL: Homepage, https://github.com/Winipedia/pyrig-codeql
|
|
24
|
+
Project-URL: Issues, https://github.com/Winipedia/pyrig-codeql/issues
|
|
25
|
+
Project-URL: Source, https://github.com/Winipedia/pyrig-codeql
|
|
26
|
+
Description-Content-Type: text/markdown
|
|
27
|
+
|
|
28
|
+
# pyrig-codeql
|
|
29
|
+
|
|
30
|
+
<!-- project-status -->
|
|
31
|
+
[](https://github.com/Winipedia/pyrig-codeql/actions/workflows/health_check.yml)
|
|
32
|
+
[](https://github.com/Winipedia/pyrig-codeql/actions/workflows/release.yml)
|
|
33
|
+
[](https://codecov.io/gh/Winipedia/pyrig-codeql)
|
|
34
|
+
<!-- code-quality -->
|
|
35
|
+
[](https://github.com/pre-commit/pre-commit-hooks)
|
|
36
|
+
[](https://github.com/rhysd/actionlint)
|
|
37
|
+
[](https://github.com/zizmorcore/zizmor)
|
|
38
|
+
[](https://github.com/pre-commit/pre-commit-hooks)
|
|
39
|
+
[](https://github.com/osprey-oss/deptry)
|
|
40
|
+
[](https://github.com/pre-commit/pre-commit-hooks)
|
|
41
|
+
[](https://github.com/pre-commit/pre-commit-hooks)
|
|
42
|
+
[](https://github.com/pre-commit/pre-commit-hooks)
|
|
43
|
+
[](https://github.com/pre-commit/pre-commit-hooks)
|
|
44
|
+
[](https://github.com/pre-commit/pre-commit-hooks)
|
|
45
|
+
[](https://github.com/rvben/rumdl)
|
|
46
|
+
[](https://github.com/pre-commit/pre-commit-hooks)
|
|
47
|
+
[](https://github.com/pre-commit/pre-commit-hooks)
|
|
48
|
+
[](https://github.com/astral-sh/ruff)
|
|
49
|
+
[](https://github.com/Yelp/detect-secrets)
|
|
50
|
+
[](https://github.com/PyCQA/bandit)
|
|
51
|
+
[](https://github.com/mvdan/sh)
|
|
52
|
+
[](https://github.com/koalaman/shellcheck)
|
|
53
|
+
[](https://github.com/crate-ci/typos)
|
|
54
|
+
[](https://github.com/tombi-toml/tombi)
|
|
55
|
+
[](https://github.com/pre-commit/pre-commit-hooks)
|
|
56
|
+
[](https://github.com/astral-sh/ty)
|
|
57
|
+
[](https://github.com/owenlamont/ryl)
|
|
58
|
+
<!-- tooling -->
|
|
59
|
+
[](https://github.com/astral-sh/uv)
|
|
60
|
+
[](https://github.com/Winipedia/pyrig)
|
|
61
|
+
[](https://github.com/Winipedia/pyrig-codeql)
|
|
62
|
+
[](https://github.com/j178/prek)
|
|
63
|
+
[](https://git-scm.com)
|
|
64
|
+
<!-- project-info -->
|
|
65
|
+
[](https://Winipedia.github.io/pyrig-codeql)
|
|
66
|
+
[](https://pypi.org/project/pyrig-codeql)
|
|
67
|
+
[](https://www.python.org)
|
|
68
|
+
[](https://github.com/Winipedia/pyrig-codeql/blob/main/LICENSE)
|
|
69
|
+
|
|
70
|
+
---
|
|
71
|
+
|
|
72
|
+
> A pyrig plugin that integrates GitHub CodeQL.
|
|
73
|
+
|
|
74
|
+
---
|
|
75
|
+
|
|
76
|
+
## Overview
|
|
77
|
+
|
|
78
|
+
`pyrig-codeql` is a [pyrig](https://github.com/Winipedia/pyrig) plugin that adds
|
|
79
|
+
GitHub CodeQL analysis to your project's health-check workflow.
|
|
80
|
+
|
|
81
|
+
## What it adds
|
|
82
|
+
|
|
83
|
+
- **CodeQL analysis** — analyzes Python and GitHub Actions code.
|
|
84
|
+
- **Health-check integration** — adds CodeQL to the aggregate health-check gate.
|
|
85
|
+
|
|
86
|
+
## Usage
|
|
87
|
+
|
|
88
|
+
Add the plugin as a development dependency, then synchronize your project:
|
|
89
|
+
|
|
90
|
+
```bash
|
|
91
|
+
uv add pyrig-codeql --dev
|
|
92
|
+
uv run pyrig sync
|
|
93
|
+
```
|
|
94
|
+
|
|
95
|
+
The plugin requires Python 3.12 or newer.
|
|
96
|
+
|
|
97
|
+
## Documentation
|
|
98
|
+
|
|
99
|
+
Full documentation, including the auto-generated API reference, is available on
|
|
100
|
+
the [documentation site](https://Winipedia.github.io/pyrig-codeql).
|
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
pyrig_codeql/__init__.py,sha256=HH9n06Zr7_KEC8dgKVlx1UAKMw_PcalkOs6U1WJ2r1k,45
|
|
2
|
+
pyrig_codeql/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
3
|
+
pyrig_codeql/rig/__init__.py,sha256=F4PE0lLxuBF4Fsf8tcD6vo9WwPmlkiwodOtfLVbAVvg,204
|
|
4
|
+
pyrig_codeql/rig/configs/__init__.py,sha256=gQKsVM1qQlKUYrhW8HNTy8wPNRBMzyK2dWRP31eiJ70,226
|
|
5
|
+
pyrig_codeql/rig/configs/version_control/__init__.py,sha256=fFpyB2iLX46_bhjXsV6icfgsozwRnJDdH7vjoVcP_vU,73
|
|
6
|
+
pyrig_codeql/rig/configs/version_control/remote/__init__.py,sha256=gdxgUcAnL7Qq49oIangkBPkk4sbKT3M79Fwr9Jz2I8Y,82
|
|
7
|
+
pyrig_codeql/rig/configs/version_control/remote/workflows/__init__.py,sha256=V7JEOMbme2No7t-cqtYw116iy7EK6lA6sOZyoglrQp0,61
|
|
8
|
+
pyrig_codeql/rig/configs/version_control/remote/workflows/health_check.py,sha256=iBVv6AgtDQ-3kE8JqrWTRvyYdjsq0w98LrLW2kz3LXs,4393
|
|
9
|
+
pyrig_codeql/rig/resources/CODEQL_ANALYZE_ACTION,sha256=bTTFwVG5V_6Oko9gqzcZQ6Qvr45ouE1lYATtktnf58w,78
|
|
10
|
+
pyrig_codeql/rig/resources/CODEQL_INIT_ACTION,sha256=pcHqjR9zm8w8krkivA36fVQPhP2aIIMuzL3EPAqty78,75
|
|
11
|
+
pyrig_codeql/rig/resources/__init__.py,sha256=KZhSmlcY-ATck1eB0HrEJsIAU-CfO2UO4pL3a0nbcA8,54
|
|
12
|
+
pyrig_codeql-1.0.0.dist-info/licenses/LICENSE,sha256=bq9F9vtTB9CLiLEiaapOI_7SyICeXX4ZcI-DHOH1bv0,1066
|
|
13
|
+
pyrig_codeql-1.0.0.dist-info/WHEEL,sha256=7hzKWg-J8I3Buqyw5tBii5z_MmAVsDYXXijd_QAtNZ8,81
|
|
14
|
+
pyrig_codeql-1.0.0.dist-info/entry_points.txt,sha256=VdDsqExXCObUuml_dANfLLqi-eE3Nl99BPnq0sR3xIE,66
|
|
15
|
+
pyrig_codeql-1.0.0.dist-info/METADATA,sha256=ChRxVMJ2dVDfbtyOfVYFukwJNLqBcv4NgZd_xZGll2k,6563
|
|
16
|
+
pyrig_codeql-1.0.0.dist-info/RECORD,,
|
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2026 Winipedia
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|