pyrig-codeql 1.0.2__tar.gz → 1.1.0__tar.gz

{pyrig_codeql-1.0.2 → pyrig_codeql-1.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pyrig-codeql
-Version: 1.0.2
+Version: 1.1.0
 Summary: A pyrig plugin that integrates GitHub CodeQL.
 Keywords: pyrig
 Author: Winipedia
@@ -82,6 +82,8 @@ GitHub CodeQL analysis to your project's health-check workflow.
 
 - **CodeQL analysis** — analyzes Python and GitHub Actions code.
 - **Health-check integration** — adds CodeQL to the aggregate health-check gate.
+- **Source-only analysis** — excludes the project's `tests/` directory from
+  CodeQL analysis.
 
 ## Usage
 

{pyrig_codeql-1.0.2 → pyrig_codeql-1.1.0}/README.md

@@ -55,6 +55,8 @@ GitHub CodeQL analysis to your project's health-check workflow.
 
 - **CodeQL analysis** — analyzes Python and GitHub Actions code.
 - **Health-check integration** — adds CodeQL to the aggregate health-check gate.
+- **Source-only analysis** — excludes the project's `tests/` directory from
+  CodeQL analysis.
 
 ## Usage
 

{pyrig_codeql-1.0.2 → pyrig_codeql-1.1.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pyrig-codeql"
-version = "1.0.2"
+version = "1.1.0"
 description = "A pyrig plugin that integrates GitHub CodeQL."
 readme = "README.md"
 requires-python = ">=3.12"

{pyrig_codeql-1.0.2 → pyrig_codeql-1.1.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "pyrig-codeql"
-version = "1.0.2"
+version = "1.1.0"
 description = "A pyrig plugin that integrates GitHub CodeQL."
 readme = "README.md"
 requires-python = ">=3.12"

pyrig_codeql-1.1.0/src/pyrig_codeql/rig/configs/version_control/remote/code_analyzer.py

@@ -0,0 +1,40 @@
+"""CodeQL configuration that restricts analysis to shipped source code."""
+
+from pathlib import Path
+from typing import Any
+
+from pyrig.rig.configs.base.yaml import YMLDictConfigFile
+from pyrig.rig.tools.testing.project import ProjectTester
+from pyrig.rig.tools.version_control.remote.controller import (
+    RemoteVersionController,
+)
+
+
+class CodeAnalyzerConfigFile(YMLDictConfigFile):
+    """Configuration consumed by the CodeQL `init` action's `config-file` input.
+
+    Manages `.github/codeql.yml`, including the query suite and ignored paths.
+    """
+
+    def parent_path(self) -> Path:
+        """Return GitHub's special repository configuration directory."""
+        return RemoteVersionController.I.config_dir()
+
+    def stem(self) -> str:
+        """Return `'codeql'`."""
+        return "codeql"
+
+    def _configs(self) -> dict[str, Any]:
+        """Build the CodeQL configuration.
+
+        Runs the `security-and-quality` query suite. Excludes the project's
+        test package, as determined by `ProjectTester.I.package_root()`, so
+        CodeQL scans shipped source code without test-only patterns.
+
+        Returns:
+            Dict with the codeql configurations.
+        """
+        return {
+            "paths-ignore": [f"{ProjectTester.I.package_root().as_posix()}/**"],
+            "queries": [{"uses": "security-and-quality"}],
+        }

{pyrig_codeql-1.0.2 → pyrig_codeql-1.1.0}/src/pyrig_codeql/rig/configs/version_control/remote/workflows/health_check.py

@@ -8,6 +8,9 @@ from pyrig.rig.configs.version_control.remote.workflows.health_check import (
 )
 
 from pyrig_codeql.rig import resources
+from pyrig_codeql.rig.configs.version_control.remote.code_analyzer import (
+    CodeAnalyzerConfigFile,
+)
 
 
 class HealthCheckWorkflowConfigFile(BaseHealthCheckWorkflowConfigFile):
@@ -66,17 +69,14 @@ class HealthCheckWorkflowConfigFile(BaseHealthCheckWorkflowConfigFile):
         return [
             self.step_checkout_repository(),
             self.step_initialize_codeql(),
-            self.step_perform_codeql_analysis(),
+            self.step_analyze_code(),
         ]
 
     def step_initialize_codeql(self) -> dict[str, Any]:
         """Build a step that initializes the CodeQL database.
 
         Neither analyzed language is compiled, so no build step is
-        required between initialization and analysis. Runs the
-        `security-and-quality` query suite, the strictest built-in suite,
-        which is only available via advanced setup, not the default-setup
-        API (whose `query_suite` field is limited to `default`/`extended`).
+        required between initialization and analysis.
 
         Returns:
             Step using `github/codeql-action/init@<ref>`.
@@ -86,12 +86,11 @@ class HealthCheckWorkflowConfigFile(BaseHealthCheckWorkflowConfigFile):
             uses=self.codeql_init_action(),
             with_={
                 "languages": self.insert_expression("matrix.language"),
-                "build-mode": "none",
-                "queries": "security-and-quality",
+                "config-file": CodeAnalyzerConfigFile.I.path().as_posix(),
             },
         )
 
-    def step_perform_codeql_analysis(self) -> dict[str, Any]:
+    def step_analyze_code(self) -> dict[str, Any]:
         """Build a step that runs the CodeQL analysis and uploads results.
 
         Fails the job if the analysis itself fails to run; code scanning
@@ -101,7 +100,7 @@ class HealthCheckWorkflowConfigFile(BaseHealthCheckWorkflowConfigFile):
             Step using `github/codeql-action/analyze@<ref>`.
         """
         return self.step(
-            self.step_perform_codeql_analysis,
+            self.step_analyze_code,
             uses=self.codeql_analyze_action(),
         )