pyvbaanalysis 2.3.0__tar.gz → 2.3.1__tar.gz

{pyvbaanalysis-2.3.0 → pyvbaanalysis-2.3.1}/.github/workflows/ci.yml

@@ -21,8 +21,8 @@ jobs:
     name: Lint and type check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.12"
           cache: pip
@@ -41,8 +41,8 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.12"
           cache: pip
@@ -62,8 +62,8 @@ jobs:
       matrix:
         python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip

{pyvbaanalysis-2.3.0 → pyvbaanalysis-2.3.1}/.github/workflows/publish.yml

@@ -20,8 +20,18 @@ permissions:
   contents: read
 
 jobs:
+  # CodeQL, Semgrep and pip-audit (security.yml). Any finding fails this job,
+  # and publishing waits on it.
+  security:
+    name: Security analysis
+    uses: ./.github/workflows/security.yml
+    permissions:
+      contents: read
+      security-events: write
+
   publish:
     name: Build and publish to PyPI
+    needs: security
     runs-on: ubuntu-latest
     environment:
       name: pypi
@@ -29,8 +39,8 @@ jobs:
     permissions:
       id-token: write # OIDC token for PyPI Trusted Publishing
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.12"
           cache: pip
@@ -45,9 +55,29 @@ jobs:
       - name: Build sdist + wheel
         run: python -m build
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: dist
           path: dist/*
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+
+  attach-security-report:
+    name: Attach the security report to the release
+    needs: [security, publish]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        with:
+          name: security-report
+          path: report
+      - name: Upload to the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.event.release.tag_name }}
+        run: |
+          cd report
+          tar -czf security-sarif.tar.gz *.sarif *.json
+          gh release upload "$TAG" security-report.md security-sarif.tar.gz --clobber --repo "$GITHUB_REPOSITORY"

pyvbaanalysis-2.3.1/.github/workflows/security.yml

@@ -0,0 +1,141 @@
+name: Security
+
+# Static security analysis: CodeQL (Python and the workflows themselves),
+# Semgrep, and pip-audit over the runtime dependency tree. Any finding fails
+# the run. Results go to the repository's Security tab as SARIF and to a
+# `security-report` artifact, which publish.yml attaches to every release.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "17 6 * * 1" # weekly, so new advisories surface between pushes
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  codeql:
+    name: CodeQL (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python, actions]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: github/codeql-action/init@1190a975f95ce23525efb6a3fc21ea29567c1b52 # v3
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-extended
+      - uses: github/codeql-action/analyze@1190a975f95ce23525efb6a3fc21ea29567c1b52 # v3
+        with:
+          category: codeql-${{ matrix.language }}
+          output: sarif
+      - name: Fail on any finding
+        run: |
+          count=$(jq '[.runs[].results[]] | length' sarif/*.sarif)
+          echo "CodeQL ${{ matrix.language }}: $count finding(s)"
+          jq -r '.runs[].results[] | "\(.ruleId): \(.locations[0].physicalLocation.artifactLocation.uri):\(.locations[0].physicalLocation.region.startLine) \(.message.text)"' sarif/*.sarif
+          test "$count" -eq 0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        if: always()
+        with:
+          name: sarif-codeql-${{ matrix.language }}
+          path: sarif/*.sarif
+
+  semgrep:
+    name: Semgrep
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"
+      - run: python -m pip install "semgrep>=1,<2"
+      - name: Scan (fails on any finding)
+        run: >
+          semgrep scan --metrics off --error
+          --config p/python --config p/security-audit
+          --config p/secrets --config p/github-actions
+          --sarif-output semgrep.sarif --text
+      - uses: github/codeql-action/upload-sarif@1190a975f95ce23525efb6a3fc21ea29567c1b52 # v3
+        if: always() && hashFiles('semgrep.sarif') != ''
+        with:
+          sarif_file: semgrep.sarif
+          category: semgrep
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        if: always()
+        with:
+          name: sarif-semgrep
+          path: semgrep.sarif
+
+  dependencies:
+    name: Dependency audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"
+      # The runtime tree without pyvbaanalysis itself, whose version is not on
+      # PyPI until the release that ships it; frozen before pip-audit is added.
+      - run: |
+          python -m pip install .
+          python -m pip freeze --exclude pyvbaanalysis > runtime.txt
+          cat runtime.txt
+          python -m pip install pip-audit
+      - name: Audit the runtime dependencies (fails on any known vulnerability)
+        run: pip-audit --strict --no-deps -r runtime.txt --format json --output pip-audit.json --progress-spinner off
+      - if: always()
+        run: pip-audit --strict --no-deps -r runtime.txt --progress-spinner off || true
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        if: always()
+        with:
+          name: pip-audit
+          path: pip-audit.json
+
+  report:
+    name: Security report
+    needs: [codeql, semgrep, dependencies]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        with:
+          path: results
+          merge-multiple: true
+      - name: Write the report
+        env:
+          CODEQL: ${{ needs.codeql.result }}
+          SEMGREP: ${{ needs.semgrep.result }}
+          DEPS: ${{ needs.dependencies.result }}
+        run: |
+          count() { if [ -f "$1" ]; then jq '[.runs[].results[]] | length' "$1"; else echo "not run"; fi; }
+          vulns=$(if [ -f results/pip-audit.json ]; then jq '[.dependencies[].vulns[]] | length' results/pip-audit.json; else echo "not run"; fi)
+          {
+            echo "# Security report"
+            echo
+            echo "Commit \`${GITHUB_SHA}\`, run ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+            echo
+            echo "| Check | Result | Findings |"
+            echo "| --- | --- | --- |"
+            echo "| CodeQL (Python, security-extended) | $CODEQL | $(count results/python.sarif) |"
+            echo "| CodeQL (GitHub Actions) | $CODEQL | $(count results/actions.sarif) |"
+            echo "| Semgrep (python, security-audit, secrets, github-actions) | $SEMGREP | $(count results/semgrep.sarif) |"
+            echo "| pip-audit (runtime dependencies) | $DEPS | $vulns |"
+          } > security-report.md
+          mkdir -p report && cp security-report.md report/ && cp results/*.sarif results/*.json report/ 2>/dev/null || true
+          cat security-report.md >> "$GITHUB_STEP_SUMMARY"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: security-report
+          path: report/

{pyvbaanalysis-2.3.0 → pyvbaanalysis-2.3.1}/CHANGELOG.md

@@ -5,6 +5,36 @@ All notable changes to pyVBAanalysis are recorded here. The format follows
 follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html): a minor version
 per milestone.
 
+## 2.3.1 - 2026-09-28
+
+Sync to XLIDE 10.14.1 (commit 67b844d), from 10.14.0, and a command-line flag
+for projects that ship as one file.
+
+### Added
+
+* `--whole-project` on the command line runs the whole-project checks
+  (`undeclared-variable`, `unknown-call`, `member-not-found`) on any input,
+  a single file included, such as a single-module distribution. It cannot be
+  combined with `--partial-project`, and the default is unchanged (#15).
+* Security checks. CodeQL, Semgrep and pip-audit run on every push and pull
+  request and weekly, and any finding fails the run. A release reaches PyPI
+  only when all three pass, and it carries `security-report.md` and the raw
+  results as assets. `SECURITY.md` describes private vulnerability reporting.
+
+### Fixed
+
+* `property-accessor-signature-mismatch` on a Property Set beside a Get of
+  another type, such as a Variant Get with an Object Set. Excel compiles it:
+  a Set's value is never compared with the Get. A Let must still match its Get
+  (XLIDE issue #152).
+
+### Verified
+
+* The oracle corpus (2251 diagnostics in 1289 modules), 16 real workbooks, 195
+  Office files, 693 further projects and 7 VB6 projects give identical findings
+  from both analyzers at 10.14.1. The recorded replay of upstream's test suite
+  did not run for this release.
+
 ## 2.3.0 - 2026-09-26
 
 Sync to XLIDE 10.14.0 (commit 110c76e), from 10.7.1. Upstream measured the

{pyvbaanalysis-2.3.0 → pyvbaanalysis-2.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pyvbaanalysis
-Version: 2.3.0
+Version: 2.3.1
 Summary: Pure-Python static analysis for Excel VBA
 Project-URL: Homepage, https://github.com/WilliamSmithEdward/pyVBAanalysis
 Project-URL: Repository, https://github.com/WilliamSmithEdward/pyVBAanalysis
@@ -29,6 +29,12 @@ Description-Content-Type: text/markdown
 
 # pyVBAanalysis
 
+[![CI](https://github.com/WilliamSmithEdward/pyVBAanalysis/actions/workflows/ci.yml/badge.svg)](https://github.com/WilliamSmithEdward/pyVBAanalysis/actions/workflows/ci.yml)
+[![Security](https://github.com/WilliamSmithEdward/pyVBAanalysis/actions/workflows/security.yml/badge.svg)](https://github.com/WilliamSmithEdward/pyVBAanalysis/actions/workflows/security.yml)
+[![PyPI](https://img.shields.io/pypi/v/pyvbaanalysis)](https://pypi.org/project/pyvbaanalysis/)
+[![Python](https://img.shields.io/pypi/pyversions/pyvbaanalysis)](https://pypi.org/project/pyvbaanalysis/)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
+
 Static analysis for Office VBA. It reads your macros and reports likely bugs and the
 errors the VBA compiler would catch, without opening Office or running any code.
 
@@ -135,6 +141,14 @@ an agent that changes a macro runs them afterwards and treats an error
 as a failure rather than a suggestion, which is most of what stops a
 model shipping VBA that does not compile.
 
+## Security
+
+Report a vulnerability privately through
+[GitHub's advisory form](https://github.com/WilliamSmithEdward/pyVBAanalysis/security/advisories/new),
+not a public issue. CodeQL, Semgrep and pip-audit run on every push and gate
+every release, and each release carries its security report. See
+[SECURITY.md](SECURITY.md).
+
 ## License
 
 MIT. See [LICENSE](LICENSE).

{pyvbaanalysis-2.3.0 → pyvbaanalysis-2.3.1}/README.md

@@ -1,5 +1,11 @@
 # pyVBAanalysis
 
+[![CI](https://github.com/WilliamSmithEdward/pyVBAanalysis/actions/workflows/ci.yml/badge.svg)](https://github.com/WilliamSmithEdward/pyVBAanalysis/actions/workflows/ci.yml)
+[![Security](https://github.com/WilliamSmithEdward/pyVBAanalysis/actions/workflows/security.yml/badge.svg)](https://github.com/WilliamSmithEdward/pyVBAanalysis/actions/workflows/security.yml)
+[![PyPI](https://img.shields.io/pypi/v/pyvbaanalysis)](https://pypi.org/project/pyvbaanalysis/)
+[![Python](https://img.shields.io/pypi/pyversions/pyvbaanalysis)](https://pypi.org/project/pyvbaanalysis/)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
+
 Static analysis for Office VBA. It reads your macros and reports likely bugs and the
 errors the VBA compiler would catch, without opening Office or running any code.
 
@@ -106,6 +112,14 @@ an agent that changes a macro runs them afterwards and treats an error
 as a failure rather than a suggestion, which is most of what stops a
 model shipping VBA that does not compile.
 
+## Security
+
+Report a vulnerability privately through
+[GitHub's advisory form](https://github.com/WilliamSmithEdward/pyVBAanalysis/security/advisories/new),
+not a public issue. CodeQL, Semgrep and pip-audit run on every push and gate
+every release, and each release carries its security report. See
+[SECURITY.md](SECURITY.md).
+
 ## License
 
 MIT. See [LICENSE](LICENSE).

pyvbaanalysis-2.3.1/SECURITY.md

@@ -0,0 +1,39 @@
+# Security
+
+## Supported versions
+
+Security fixes go into the latest release on PyPI. Upgrade to it before
+reporting a problem.
+
+## Reporting a vulnerability
+
+Report privately through GitHub:
+[Security > Report a vulnerability](https://github.com/WilliamSmithEdward/pyVBAanalysis/security/advisories/new).
+Please do not open a public issue for a vulnerability.
+
+Include the version, what you ran, the input that triggers the problem (a
+minimal module or file if you can share one), and what happened. You will get a
+reply within a week.
+
+## What counts
+
+pyVBAanalysis reads Office files and VBA source and never runs them. A file
+that makes the reader or the analyzer crash, hang, use unbounded memory, write
+outside where it was asked to, or run code is a vulnerability. A wrong or
+missing diagnostic is an ordinary bug; open an issue for it.
+
+## How the code is checked
+
+Every push, pull request and release runs [security.yml](.github/workflows/security.yml):
+
+- CodeQL with the `security-extended` queries, over the Python package and the
+  GitHub Actions workflows.
+- Semgrep with the `python`, `security-audit`, `secrets` and `github-actions`
+  rule sets.
+- pip-audit over the runtime dependencies.
+
+Any finding fails the run, and a release is not published to PyPI until all
+three pass. Each release carries the resulting `security-report.md` and the raw
+SARIF and pip-audit output as assets. Dependabot keeps the dependencies and the
+workflow actions current, and the run repeats weekly so new advisories surface
+between releases.

{pyvbaanalysis-2.3.0 → pyvbaanalysis-2.3.1}/docs/usage.md

@@ -235,7 +235,8 @@ for a partial view:
   Pass `whole_project=True` if that single file really is the entire project.
 * `analyze_project` defaults to whole-project; pass `whole_project=False` for a fragment.
 * On the command line, a folder or several files is a whole project, a single targeted
-  file is partial automatically, and `--partial-project` forces partial for any input.
+  file is partial automatically, `--partial-project` forces partial for any input, and
+  `--whole-project` runs the whole-project checks on any input, a single file included.
 
 Every other check is local or resolves positively (it reports only when it can prove
 the problem), so a partial view never turns it into a false positive.
@@ -311,6 +312,7 @@ Flags:
 | `--select CODE` | Report only these codes; repeatable. Codes match case-insensitively; an unknown code exits 2. |
 | `--ignore CODE` | Hide these codes from the report; repeatable. Codes match case-insensitively; an unknown code exits 2. |
 | `--partial-project` | Treat the input as a fragment of a larger project: skip the whole-project checks (`undeclared-variable`, `unknown-call`, `member-not-found`). A single targeted file is treated as partial automatically. |
+| `--whole-project` | Treat the input as the complete project and run the whole-project checks, even on a single file such as a single-module distribution. Cannot be combined with `--partial-project`. |
 | `--no-inline-suppression` | Ignore `'@pyvba-ignore` directives in the source and report every diagnostic (an audit run). |
 | `--fail-level LEVEL` | Exit non-zero only when a diagnostic at or above `error`/`warning`/`information` is reported (default `information`, meaning any). |
 | `--format text\|json` | Output format (default `text`). |

{pyvbaanalysis-2.3.0 → pyvbaanalysis-2.3.1}/pyvbaanalysis/__init__.py

@@ -41,7 +41,7 @@ from .reader import (
 )
 from .symbols import ModuleInput, ModuleSymbolKind, ProjectIndex, ProjectIndexOptions
 
-__version__ = "2.3.0"
+__version__ = "2.3.1"
 
 __all__ = [
     "AnalyzeModuleOptions",

{pyvbaanalysis-2.3.0 → pyvbaanalysis-2.3.1}/pyvbaanalysis/cli.py

@@ -288,13 +288,20 @@ def _build_parser() -> argparse.ArgumentParser:
         metavar="CODE",
         help="hide these diagnostic codes from the report; repeatable",
     )
-    parser.add_argument(
+    scope = parser.add_mutually_exclusive_group()
+    scope.add_argument(
         "--partial-project",
         action="store_true",
         help="treat the input as a fragment of a larger project: skip the whole-project "
         "checks (undeclared-variable, unknown-call, member-not-found) that need every "
         "module. A single targeted file is treated as partial automatically.",
     )
+    scope.add_argument(
+        "--whole-project",
+        action="store_true",
+        help="treat the input as the complete project and run the whole-project checks, "
+        "even on a single file, such as a single-module distribution.",
+    )
     parser.add_argument(
         "--no-inline-suppression",
         action="store_true",
@@ -357,7 +364,10 @@ def main(argv: Sequence[str] | None = None) -> int:
 
     # A single targeted file is a partial view of any real project, so the whole-project
     # rules are suppressed for it; a folder or several files are treated as the project.
-    loose_whole_project = not (args.partial_project or len(loose_paths) <= 1)
+    # --whole-project and --partial-project override either way.
+    loose_whole_project = args.whole_project or not (
+        args.partial_project or len(loose_paths) <= 1
+    )
     inline_suppression = not args.no_inline_suppression
     loose_results, warnings, loose_errors = _analyze_loose_group(
         loose_paths, args.only, overrides, loose_whole_project, inline_suppression

{pyvbaanalysis-2.3.0 → pyvbaanalysis-2.3.1}/pyvbaanalysis/data/diagnostic_influence_audit.json

@@ -1382,7 +1382,11 @@
       "status": "spec-derived",
       "sourceOfTruth": "MS-VBAL 5.3.1.4 paired Property Get/Let/Set procedure signature consistency",
       "corpusInfluence": "none",
-      "assertedOracleCases": [],
+      "assertedOracleCases": [
+        "issue152_g_compile",
+        "issue152_h_compile",
+        "issue152_o_compile"
+      ],
       "observeOnlyOracleCases": [],
       "pendingLegacyCorpusFiles": [
         "excel_vba_analysis_final_hardening_cases.md",

{pyvbaanalysis-2.3.0 → pyvbaanalysis-2.3.1}/pyvbaanalysis/data/manifest.json

@@ -1,22 +1,22 @@
 {
   "sourceRepo": "WilliamSmithEdward/xlide_vscode",
-  "xlideVersion": "10.14.0",
-  "xlideCommit": "110c76e91145b322be2e1970b7cbe54eda52468f",
+  "xlideVersion": "10.14.1",
+  "xlideCommit": "67b844d2a573a1f1f2cf9fcfdf820603d2837190",
   "files": {
     "vbe_oracle_cases.json": {
-      "sha256": "325418258ac805a05181d5954d8e35195689e879ce641a5133872bf9496ae2fc",
-      "bytes": 329910
+      "sha256": "b14f2ea3a70a93911033063c8447cd74ae563ef8e3a49a1ee85f3e837d7f5253",
+      "bytes": 344580
     },
     "diagnostic_influence_audit.json": {
-      "sha256": "5e3c18e122edfa141baad321e0f6c79652d3eb8f99162b8e0e0f1fdc8d1c900a",
-      "bytes": 165870
+      "sha256": "5d9b938edada6b23e31ac3c836f1afd1e1cc9ff6387e4b5ebeb79e7cb30279b3",
+      "bytes": 165966
     },
     "rule_metadata.json": {
       "sha256": "3413c1c92e72c31442d46785c7681b39e8470f3ab40e846f183daa43e50c6c16",
       "bytes": 64383
     }
   },
-  "oracleCaseCount": 596,
+  "oracleCaseCount": 612,
   "diagnosticCodeCount": 168,
   "diagnosticCodes": [
     "ambiguous-enum-member",