secure-code-agent 0.13.0__tar.gz → 0.13.1__tar.gz

{secure_code_agent-0.13.0/src/secure_code_agent.egg-info → secure_code_agent-0.13.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.13.0
+Version: 0.13.1
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -49,6 +49,8 @@ Dynamic: license-file
 
 # secure-code-agent
 
+![secure-code-agent — a deterministic security gate whose findings become a bounded remediation work order for your AI coding agent](https://raw.githubusercontent.com/marshallguillory86/secure-code-agent/main/docs/brand/sca.png)
+
 > **Deterministic security gate + bounded AI remediation prompts for repos with AI coding agents in the loop.**
 > Anchored to NIST SSDF · OWASP ASVS · OWASP Top 10 · MITRE CWE Top 25 · OpenSSF Scorecard · SARIF 2.1.0.
 
@@ -554,7 +556,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.13.0
+- uses: marshallguillory86/secure-code-agent@v0.13.1
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.13.0 → secure_code_agent-0.13.1}/README.md

@@ -1,5 +1,7 @@
 # secure-code-agent
 
+![secure-code-agent — a deterministic security gate whose findings become a bounded remediation work order for your AI coding agent](https://raw.githubusercontent.com/marshallguillory86/secure-code-agent/main/docs/brand/sca.png)
+
 > **Deterministic security gate + bounded AI remediation prompts for repos with AI coding agents in the loop.**
 > Anchored to NIST SSDF · OWASP ASVS · OWASP Top 10 · MITRE CWE Top 25 · OpenSSF Scorecard · SARIF 2.1.0.
 
@@ -505,7 +507,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.13.0
+- uses: marshallguillory86/secure-code-agent@v0.13.1
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.13.0 → secure_code_agent-0.13.1/src/secure_code_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.13.0
+Version: 0.13.1
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -49,6 +49,8 @@ Dynamic: license-file
 
 # secure-code-agent
 
+![secure-code-agent — a deterministic security gate whose findings become a bounded remediation work order for your AI coding agent](https://raw.githubusercontent.com/marshallguillory86/secure-code-agent/main/docs/brand/sca.png)
+
 > **Deterministic security gate + bounded AI remediation prompts for repos with AI coding agents in the loop.**
 > Anchored to NIST SSDF · OWASP ASVS · OWASP Top 10 · MITRE CWE Top 25 · OpenSSF Scorecard · SARIF 2.1.0.
 
@@ -554,7 +556,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.13.0
+- uses: marshallguillory86/secure-code-agent@v0.13.1
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.13.0 → secure_code_agent-0.13.1}/src/secure_code_audit/__init__.py

@@ -12,4 +12,4 @@
 #:
 #: PyPI is immutable, so 0.4.0 stays wrong. 0.5.0 is the first build whose
 #: artifacts name their own producer correctly.
-__version__ = "0.13.0"
+__version__ = "0.13.1"

{secure_code_agent-0.13.0 → secure_code_agent-0.13.1}/src/secure_code_audit/sarif.py

@@ -13,8 +13,8 @@ from pathlib import Path
 from secure_code_audit import __version__
 from secure_code_audit.findings import Category, Confidence, Finding, Severity
 from secure_code_audit.scanner_status import (
+    COVERING_OUTCOMES,
     CoverageReport,
-    CoverageStatus,
     ScannerExecution,
     ScannerOutcome,
 )
@@ -92,8 +92,20 @@ def emit(
 
 
 def _invocation(coverage: CoverageReport) -> dict:
+    """The run, and what it covered, on two separate axes.
+
+    `executionSuccessful` says whether this tool ran to completion, and a
+    document is only written when it did. It was set from coverage instead,
+    so `maintainability-agent` — every scanner completed, PARTIAL only because
+    nothing in the floor reads shell — uploaded "unsuccessful tool execution,
+    exit code 0" on every run, and GitHub code scanning put a configuration
+    error banner on its Security overview. Coverage stays in
+    `properties.coverageStatus`, and each gap is a notification naming what
+    was not read: `error` for a required scanner that broke the gate,
+    `warning` for a limit of the floor.
+    """
     invocation = {
-        "executionSuccessful": coverage.status is CoverageStatus.COMPLETE,
+        "executionSuccessful": True,
         "properties": {
             "coverageStatus": coverage.status.value,
             "requiredScanners": list(coverage.required),
@@ -108,18 +120,30 @@ def _invocation(coverage: CoverageReport) -> dict:
             ],
         },
     }
-    if coverage.failures:
-        invocation["toolExecutionNotifications"] = [
-            {
-                "level": "error",
-                "message": {"text": failure},
-                "descriptor": {"id": "scanner-coverage"},
-            }
-            for failure in coverage.failures
-        ]
+    notifications = [_coverage_notification("error", failure) for failure in coverage.failures]
+    notifications += [
+        _coverage_notification("warning", f"language not covered: {entry}")
+        for entry in coverage.unread_languages
+    ]
+    notifications += [
+        _coverage_notification(
+            "warning",
+            f"scanner {execution.name!r} did not complete: {execution.outcome.value}"
+            + (f" — {execution.reason}" if execution.reason else ""),
+        )
+        for execution in coverage.executions
+        if execution.name not in coverage.required
+        and execution.outcome not in (*COVERING_OUTCOMES, ScannerOutcome.NOT_APPLICABLE)
+    ]
+    if notifications:
+        invocation["toolExecutionNotifications"] = notifications
     return invocation
 
 
+def _coverage_notification(level: str, text: str) -> dict:
+    return {"level": level, "message": {"text": text}, "descriptor": {"id": "scanner-coverage"}}
+
+
 def _rule(f: Finding) -> dict:
     rule: dict = {
         "id": f.rule_id,