pyrig-codeql 1.5.2__tar.gz → 1.6.0__tar.gz

{pyrig_codeql-1.5.2 → pyrig_codeql-1.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pyrig-codeql
-Version: 1.5.2
+Version: 1.6.0
 Summary: A pyrig plugin that integrates GitHub CodeQL.
 Keywords: pyrig
 Author: Winipedia

{pyrig_codeql-1.5.2 → pyrig_codeql-1.6.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pyrig-codeql"
-version = "1.5.2"
+version = "1.6.0"
 description = "A pyrig plugin that integrates GitHub CodeQL."
 readme = "README.md"
 requires-python = ">=3.12"

{pyrig_codeql-1.5.2 → pyrig_codeql-1.6.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "pyrig-codeql"
-version = "1.5.2"
+version = "1.6.0"
 description = "A pyrig plugin that integrates GitHub CodeQL."
 readme = "README.md"
 requires-python = ">=3.12"

{pyrig_codeql-1.5.2 → pyrig_codeql-1.6.0}/src/pyrig_codeql/rig/configs/version_control/remote/workflows/health_check.py

@@ -1,5 +1,6 @@
 """Health check workflow extended with CodeQL analysis and an open-alert gate."""
 
+from collections.abc import Callable
 from types import MethodType
 from typing import Any, override
 
@@ -30,39 +31,49 @@ class HealthCheckWorkflowConfigFile(BaseHealthCheckWorkflowConfigFile):
         return (self.job_analyze, *super().job_health_check_needs())
 
     @override
-    def jobs(self) -> dict[str, Any]:
+    def jobs(self) -> tuple[Callable[[], dict[str, Any]], ...]:
         """Return the base class's jobs, extended with the CodeQL analysis job.
 
         Returns:
             The base class jobs plus the CodeQL analysis job.
         """
-        return {
-            **self.job_analyze(),
-            **super().jobs(),
-        }
+        return (
+            self.job_analyze,
+            *super().jobs(),
+        )
 
     def job_analyze(self) -> dict[str, Any]:
         """Return the CodeQL analysis job.
 
         Returns:
             Job configuration with a matrix over `("python", "actions")`,
-            the permissions needed to analyze code, upload results, and read
-            alerts, and steps that fail the job on open CodeQL alerts.
+            the job's permissions, and steps that fail the job on open
+            CodeQL alerts.
         """
         return self.job(
             self.job_analyze,
             strategy=self.strategy_matrix(
                 matrix=self.matrix({"language": ["python", "actions"]}),
             ),
-            permissions={
-                **self.permission_contents(),
-                **self.permission("actions"),
-                **self.permission("security-events", write=True),
-            },
+            permissions=self.job_analyze_permissions(),
             steps=self.steps_analyze(),
             timeout_minutes=90,
         )
 
+    def job_analyze_permissions(self) -> dict[str, Any]:
+        """Return the permissions for the CodeQL analysis job.
+
+        Returns:
+            Permissions needed to analyze code (`contents: read`), read
+            workflow runs (`actions: read`), and upload results and read
+            alerts (`security-events: write`).
+        """
+        return {
+            **self.permission_contents(),
+            **self.permission("actions"),
+            **self.permission("security-events", write=True),
+        }
+
     def steps_analyze(self) -> list[dict[str, Any]]:
         """Return the steps for the CodeQL analysis job.