releaseradar 2026.1__tar.gz

releaseradar-2026.1/.gitattributes

@@ -0,0 +1,3 @@
+# Shell scripts run under bash, which reads a CR as part of the line: checked
+# out with core.autocrlf=true, release.sh died on `set -o pipefail\r`.
+*.sh text eol=lf

releaseradar-2026.1/.github/scripts/wait_for_pypi.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Wait until <package>==<version> can be downloaded from PyPI.
+# Uses pip itself, so it checks exactly what `pip install` in the Dockerfile needs.
+# Usage: wait_for_pypi.sh <package> <version> [attempts=30] [interval_seconds=20] [grace_seconds=45]
+set -uo pipefail
+
+if [ $# -lt 2 ]; then
+    echo "Usage: $0 <package> <version> [attempts] [interval_seconds]" >&2
+    exit 2
+fi
+
+PACKAGE="$1"
+VERSION="$2"
+ATTEMPTS="${3:-30}"
+INTERVAL="${4:-20}"
+GRACE="${5:-45}"
+DEST="$(mktemp -d)"
+trap 'rm -rf "$DEST"' EXIT
+
+for attempt in $(seq 1 "$ATTEMPTS"); do
+    if pip download --no-deps --no-cache-dir --disable-pip-version-check --quiet --dest "$DEST" "${PACKAGE}==${VERSION}"; then
+        echo "${PACKAGE}==${VERSION} available on PyPI (attempt ${attempt}/${ATTEMPTS})"
+        if [ "$GRACE" -gt 0 ]; then
+            echo "waiting ${GRACE}s for the index to agree with itself"
+            sleep "$GRACE"
+        fi
+        exit 0
+    fi
+    echo "${PACKAGE}==${VERSION} not yet available (attempt ${attempt}/${ATTEMPTS})"
+    if [ "$attempt" -lt "$ATTEMPTS" ]; then
+        sleep "$INTERVAL"
+    fi
+done
+
+echo "${PACKAGE}==${VERSION} still not available on PyPI after ${ATTEMPTS} attempts" >&2
+exit 1

releaseradar-2026.1/.github/workflows/bandit.yml

@@ -0,0 +1,36 @@
+name: Bandit Security Scan
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  schedule:
+    - cron: '30 3 * * 1'
+permissions:
+  contents: read
+  security-events: write
+jobs:
+  bandit:
+    name: Bandit
+    runs-on: ubuntu-26.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - name: Install Bandit
+        run: pip install bandit[sarif]
+      - name: Run Bandit
+        run: |
+          bandit -r releaseradar/ \
+            -f sarif \
+            -o bandit-results.sarif \
+            --severity-level medium \
+            --exit-zero
+      - name: Upload Bandit results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v4
+        if: always() && hashFiles('bandit-results.sarif') != ''
+        with:
+          sarif_file: bandit-results.sarif

releaseradar-2026.1/.github/workflows/codeql.yml

@@ -0,0 +1,35 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 6 * * 1'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-26.04
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        with:
+          languages: python
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        with:
+          category: "/language:python"

releaseradar-2026.1/.github/workflows/docker-build-check.yml

@@ -0,0 +1,83 @@
+name: Docker Build Check
+# Builds the image and runs the smoke test without pushing anything. docker.yml
+# cannot serve this purpose: it publishes to Docker Hub, including the :latest
+# tag, so it is only safe to run for an already released version.
+#
+# The Dockerfile installs releaseradar from PyPI rather than from this checkout, so
+# the build needs a published version. It is resolved here rather than taken
+# from the Dockerfile's RELEASERADAR_VERSION default, which lags many releases behind.
+# On every push and pull request, because the only other thing that builds this image
+# is docker.yml, which publishes as it builds — so until this ran on its own, the first
+# attempt at a build was the one that released. It could not run on its own before: the
+# Dockerfile only knew how to install from the index, so it had to be handed a published
+# version to build anything at all.
+#
+# Given a version it still builds that one from the index, which is how an older image
+# is reproduced. Given nothing it builds this checkout.
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Published version to reproduce (default: build this checkout)'
+        required: false
+permissions:
+  contents: read
+jobs:
+  build:
+    runs-on: ubuntu-26.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Resolve the version to build
+        id: ver
+        env:
+          REQUESTED: ${{ inputs.version }}
+        run: |
+          if [ -n "$REQUESTED" ]; then
+            SOURCE=pypi
+            VERSION="${REQUESTED#v}"
+          else
+            SOURCE=local
+            VERSION=$(python3 -c "import releaseradar; print(releaseradar.__version__)")
+          fi
+          echo "source=$SOURCE" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Building releaseradar $VERSION"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          load: true
+          push: false
+          tags: releaseradar:build-check
+          build-args: |
+            RELEASERADAR_SOURCE=${{ steps.ver.outputs.source }}
+            RELEASERADAR_VERSION=${{ steps.ver.outputs.version }}
+
+      - name: Smoke test (the CLI runs as the container user)
+        env:
+          EXPECTED_VERSION: ${{ steps.ver.outputs.version }}
+        run: |
+          docker run --rm releaseradar:build-check --help > /dev/null
+          docker run --rm -i -e EXPECTED_VERSION --entrypoint python releaseradar:build-check - < tests/docker/smoke.py
+
+      # What the image contains, read from the image itself. This is the only place
+      # it can be read: Docker Desktop will not install on the machine this is
+      # developed on, where Windows 10 IoT Enterprise LTSC 2021 is build 19044 and
+      # Docker requires 19045 — a build that edition never receives. A Linux runner
+      # is the truer place for the question anyway.
+      #
+      # See tests/docker/inspect.sh for what it settles: SECURITY-EXCEPTIONS.toml
+      # answers two of its claims with evidence borrowed from patchradar's image
+      # rather than measured in this one.
+      - name: What the image contains
+        run: docker run --rm -i --entrypoint sh releaseradar:build-check - < tests/docker/inspect.sh

releaseradar-2026.1/.github/workflows/docker-scout.yml

@@ -0,0 +1,44 @@
+name: Docker Scout CVE Scan
+on:
+  # The scan reads maksimtech/releaseradar:latest from Docker Hub, so it is only
+  # meaningful once a new image is published — which happens on a tag, not on a
+  # push to main. Without this, re-scanning after a release meant re-running an
+  # earlier run by hand.
+  workflow_dispatch:
+  push:
+    branches: [ main ]
+  schedule:
+    - cron: '30 4 * * 1'
+permissions:
+  contents: read
+  security-events: write
+jobs:
+  scout:
+    name: Docker Scout
+    runs-on: ubuntu-26.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Login to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Docker Scout CVE scan
+        uses: docker/scout-action@v1
+        with:
+          # cves says what is broken in the image; recommendations says
+          # whether a base image exists that fixes it. On 2026-09-26 the first
+          # scan of exeradar found five HIGH CVEs, all of them in
+          # python:3.14-slim-trixie and none in this project's code — which is
+          # a fact nobody can act on without the second command.
+          command: cves,recommendations
+          image: maksimtech/releaseradar:latest
+          only-severities: critical,high
+          exit-code: false
+          sarif-file: scout-results.sarif
+      - name: Upload Scout results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v4
+        if: always() && hashFiles('scout-results.sarif') != ''
+        with:
+          sarif_file: scout-results.sarif

releaseradar-2026.1/.github/workflows/docker.yml

@@ -0,0 +1,81 @@
+name: Build and Push Docker Image
+on:
+  push:
+    tags:
+      - 'v*'
+  schedule:
+    # Weekly rebuild of `latest` from the newest tag so the image picks up
+    # Debian's patches without waiting for a new release.
+    - cron: '0 5 * * 1'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version tag (e.g. v2026.1)'
+        required: true
+        default: 'v2026.1'
+permissions:
+  contents: read
+  security-events: write
+jobs:
+  docker:
+    runs-on: ubuntu-26.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+      - name: Login to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Extract version
+        id: version
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            RAW="${{ github.event.inputs.version }}"
+          elif [ "${{ github.event_name }}" = "schedule" ]; then
+            RAW=$(git tag --list 'v*' --sort=-v:refname | head -n 1)
+          else
+            RAW="${GITHUB_REF#refs/tags/}"
+          fi
+          echo "VERSION=${RAW}" >> $GITHUB_OUTPUT
+          STRIPPED="${RAW#v}"
+          NORMALIZED=$(python3 -c "parts='${STRIPPED}'.split('.'); print('.'.join(str(int(p)) for p in parts))")
+          echo "PIP_VERSION=${NORMALIZED}" >> $GITHUB_OUTPUT
+      - name: Stand on the tag being built
+        env:
+          VERSION: ${{ steps.version.outputs.VERSION }}
+        run: git checkout --detach "refs/tags/${VERSION}"
+      - name: Build and push
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            maksimtech/releaseradar:latest
+            ${{ github.event_name != 'schedule' && format('maksimtech/releaseradar:{0}', steps.version.outputs.VERSION) || '' }}
+          build-args: |
+            RELEASERADAR_SOURCE=local
+          pull: true
+          no-cache: ${{ github.event_name == 'schedule' }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+      - name: Docker Scout CVE scan
+        uses: docker/scout-action@v1
+        with:
+          command: cves
+          image: maksimtech/releaseradar:${{ github.event_name == 'schedule' && 'latest' || steps.version.outputs.VERSION }}
+          only-severities: critical,high
+          exit-code: false
+          sarif-file: scout-results.sarif
+      - name: Upload Scout SARIF
+        uses: github/codeql-action/upload-sarif@v4
+        if: always()
+        with:
+          sarif_file: scout-results.sarif

releaseradar-2026.1/.github/workflows/licenses.yml

@@ -0,0 +1,33 @@
+name: License Check
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+permissions:
+  contents: read
+jobs:
+  licenses:
+    name: License Check
+    runs-on: ubuntu-26.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - name: Install dependencies
+        run: |
+          pip install -e .  # NOSONAR
+          pip install pip-licenses
+      - name: Check licenses
+        run: |
+          pip-licenses \
+            --order=license \
+            --format=markdown \
+            --output-file=licenses.md
+          cat licenses.md
+      - name: Fail on forbidden licenses
+        run: |
+          pip-licenses --fail-on="GPL;AGPL;LGPL"

releaseradar-2026.1/.github/workflows/mutation.yml

@@ -0,0 +1,42 @@
+name: Mutation testing
+on:
+  # Off the critical path on purpose: a mutation run is measured in hours, and
+  # its result is a reading on the test suite rather than a gate on a change.
+  schedule:
+    - cron: '0 4 * * 6'
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  mutmut:
+    name: mutmut
+    runs-on: ubuntu-26.04
+    # mutmut refuses to run on Windows and points at WSL, so ubuntu is not a
+    # preference here — it is the only host that works.
+    timeout-minutes: 350
+    steps:
+      - uses: actions/checkout@v7
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"  # NOSONAR - trusted internal project, no external setup scripts
+      - name: Run mutation testing
+        # A surviving mutant is a finding, not a failure: mutmut exits 0 and
+        # prints the score. The job still fails if mutmut itself crashes, which
+        # is the distinction "|| true" would have destroyed.
+        run: mutmut run --max-children 4
+      - name: Export the score
+        run: mutmut export-cicd-stats
+      - name: Show surviving mutants
+        run: mutmut results
+      - name: Upload the report
+        uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: mutmut-stats
+          path: mutants/mutmut-cicd-stats.json
+          if-no-files-found: warn

releaseradar-2026.1/.github/workflows/publish.yml

@@ -0,0 +1,65 @@
+name: Publish to PyPI
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+jobs:
+  build-and-publish:
+    name: Build and publish to PyPI
+    runs-on: ubuntu-26.04
+    environment:
+      name: pypi
+      url: https://pypi.org/p/releaseradar
+    permissions:
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - name: Install build dependencies
+        run: pip install --upgrade build hatchling  # NOSONAR
+      - name: Build package
+        run: python -m build
+      - name: Import GPG key
+        run: |
+          echo "${{ secrets.GPG_PRIVATE_KEY }}" > /tmp/gpg_key.asc
+          gpg --batch --import /tmp/gpg_key.asc
+          rm /tmp/gpg_key.asc
+          echo "${{ secrets.GPG_PASSPHRASE }}" | gpg --batch --passphrase-fd 0 --pinentry-mode loopback --list-secret-keys
+      - name: Sign packages
+        run: |
+          for f in dist/*; do
+            echo "${{ secrets.GPG_PASSPHRASE }}" | gpg --batch --passphrase-fd 0 \
+              --pinentry-mode loopback \
+              --armor --detach-sign "$f"
+          done
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          verify-metadata: false
+
+      - name: Extract version
+        id: version
+        env:
+          RAW: ${{ github.ref_name }}
+        run: |
+          STRIPPED="${RAW#v}"
+          NORMALIZED=$(python3 -c "parts='${STRIPPED}'.split('.'); print('.'.join(str(int(p)) for p in parts))")
+          echo "VERSION=${NORMALIZED}" >> "$GITHUB_OUTPUT"
+
+      - name: Wait for the index to catch up
+        env:
+          VERSION: ${{ steps.version.outputs.VERSION }}
+        run: bash .github/scripts/wait_for_pypi.sh releaseradar "$VERSION" 30 20 0
+
+      - name: Check the published wheel installs and runs
+        env:
+          VERSION: ${{ steps.version.outputs.VERSION }}
+        run: |
+          python -m venv "${RUNNER_TEMP}/verify"
+          "${RUNNER_TEMP}/verify/bin/pip" install --no-cache-dir "releaseradar==${VERSION}"
+          "${RUNNER_TEMP}/verify/bin/releaseradar" --version

releaseradar-2026.1/.github/workflows/quality.yml

@@ -0,0 +1,33 @@
+name: Quality
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+permissions:
+  contents: read
+jobs:
+  quality:
+    # One name, not a matrix: ruff and mypy read their target version from
+    # pyproject.toml, so running them on four interpreters would repeat the
+    # same answer four times.
+    name: Quality
+    runs-on: ubuntu-26.04
+    steps:
+      - uses: actions/checkout@v7
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"  # NOSONAR - trusted internal project, no external setup scripts
+      # `tools/` is in here because it was not, and that is where
+      # security_exceptions.py lives: the script that refuses a build over an
+      # unexplained alert had never been seen by the linter that gates the build.
+      # Found on 2026-10-02 by running ruff over the whole tree by hand.
+      - name: Lint (ruff)
+        run: ruff check releaseradar tests tools
+      - name: Type check (mypy)
+        run: mypy releaseradar

releaseradar-2026.1/.github/workflows/release.yml

@@ -0,0 +1,47 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    name: Create GitHub Release
+    runs-on: ubuntu-26.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Extract version from tag
+        id: version
+        run: |
+          VERSION=${GITHUB_REF#refs/tags/v}
+          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
+          echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
+
+      - name: Extract changelog for this version
+        id: changelog
+        run: |
+          VERSION=${{ steps.version.outputs.VERSION }}
+          NOTES=$(awk "/## \[$VERSION\]/{flag=1; next} /## \[/{flag=0} flag" CHANGELOG.md)
+          if [ -z "$NOTES" ]; then
+            NOTES="Release $VERSION"
+          fi
+          echo "NOTES<<EOF" >> $GITHUB_OUTPUT
+          echo "$NOTES" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
+        with:
+          tag_name: ${{ steps.version.outputs.TAG }}
+          name: ReleaseRadar ${{ steps.version.outputs.VERSION }}
+          body: ${{ steps.changelog.outputs.NOTES }}
+          draft: false
+          prerelease: false

releaseradar-2026.1/.github/workflows/security-posture.yml

@@ -0,0 +1,120 @@
+name: Security Posture
+# The gate that refuses. Every other security workflow here reports: snyk.yml
+# carries `continue-on-error` so a pull request is not blocked by findings that
+# were already there, CodeQL and Docker Scout upload SARIF, and SonarCloud
+# evaluates its quality gate after its job has finished succeeding. On 2026-09-28
+# all of them were green while thirteen high-severity alerts were open and the
+# Sonar gate was red.
+#
+# This job reads what they published — GitHub's code scanning alerts, which is
+# where all four end up — and fails when a blocking finding has nobody's name
+# against it. `SECURITY-EXCEPTIONS.toml` holds the accepted ones, each with a
+# reason and a review date; tools/security_exceptions.py is the rule, and its
+# tests are in tests/test_security_exceptions.py.
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  # Weekly, because an exception expires by the calendar and not by a commit: a
+  # review date that passes while nobody pushes has to fail on its own.
+  schedule:
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  # Reading the alerts the other workflows uploaded.
+  security-events: read
+
+jobs:
+  posture:
+    name: Security Posture
+    runs-on: ubuntu-26.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.11"
+
+      # The gate reads what the scanners published, so it has to run after they
+      # have spoken about *this* commit. On 5fa1774 it did not: it read the alerts
+      # while CodeQL was still analysing, reported the finding that commit had
+      # just fixed, and failed a build whose product was clean.
+      #
+      # Waiting on the runs of this SHA rather than sleeping a fixed time: the
+      # analyses take what they take, and a sleep is either too short or wasted.
+      # A timeout says so and checks nothing, because "the scanners did not
+      # finish" is not "there is nothing wrong".
+      - name: Wait for this commit's analyses
+        id: wait
+        env:
+          GH_TOKEN: ${{ github.token }}
+          UPLOADERS: CodeQL,Snyk,Docker Scout CVE Scan,Trivy Security Scan
+        run: |
+          # The counting is done in Python and not in `--jq`: gh's own jq takes a
+          # filter and not `--arg`, so the commit and the names would have to be
+          # pasted into the expression.
+          deadline=$(( SECONDS + 1200 ))
+          while [ "$SECONDS" -lt "$deadline" ]; do
+            gh run list --limit 40 --json name,status,headSha > runs.json
+            pending=$(python - <<'COUNT'
+          import json, os
+          wanted = set(os.environ["UPLOADERS"].split(","))
+          sha = os.environ["GITHUB_SHA"]
+          runs = json.load(open("runs.json", encoding="utf-8"))
+          print(sum(1 for r in runs
+                    if r["headSha"] == sha and r["name"] in wanted
+                    and r["status"] != "completed"))
+          COUNT
+          )
+            if [ "$pending" = "0" ]; then
+              echo "ready=true" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+            echo "waiting for $pending analysis run(s) of $GITHUB_SHA"
+            sleep 30
+          done
+          echo "ready=false" >> "$GITHUB_OUTPUT"
+
+      - name: Report that the analyses did not finish
+        if: ${{ steps.wait.outputs.ready == 'false' }}
+        run: |
+          echo "::notice title=Posture not evaluated::The scanners of this commit did not finish within twenty minutes, so their alerts describe an earlier commit. Nothing was checked — and that is not the same as nothing being wrong."
+
+      # A fork pull request gets a token that cannot read code scanning alerts,
+      # and an empty list would read as a clean product. The job says so and
+      # stops instead of passing on no information.
+      - name: Collect the open alerts
+        if: ${{ steps.wait.outputs.ready == 'true' }}
+        id: alerts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if gh api "repos/${GITHUB_REPOSITORY}/code-scanning/alerts?state=open&per_page=100" \
+               > alerts.json 2>api-error.txt; then
+            echo "count=$(python -c 'import json;print(len(json.load(open("alerts.json"))))')" >> "$GITHUB_OUTPUT"
+          else
+            echo "readable=false" >> "$GITHUB_OUTPUT"
+            cat api-error.txt
+          fi
+          # The closed ones tell a finding that went quiet apart from an entry
+          # that never described anything. A scanner that drops a finding for one
+          # run must not fail the build — Docker Scout did exactly that to
+          # CVE-2026-82560 on 2026-09-29 and had already changed its mind back
+          # once. Best effort: without this file the tool falls back to the
+          # stricter reading, which is the safe direction.
+          gh api "repos/${GITHUB_REPOSITORY}/code-scanning/alerts?state=closed&per_page=100" \
+            > closed.json 2>/dev/null || echo "[]" > closed.json
+
+      - name: Report that the alerts could not be read
+        if: ${{ steps.alerts.outputs.readable == 'false' }}
+        run: |
+          echo "::notice title=Posture not evaluated::This run cannot read code scanning alerts (a fork pull request, or the feature is off). Nothing was checked — and that is not the same as nothing being wrong."
+
+      - name: Every blocking alert is explained, and every exception is in date
+        if: ${{ steps.wait.outputs.ready == 'true' && steps.alerts.outputs.readable != 'false' }}
+        run: python tools/security_exceptions.py alerts.json closed.json