Commit `b94aafccf9`

b94aafccf922b8730bd7e5bad28d49dc8408b794

parent: 073020727e

Unsigned

cmc <hello@cleberg.net> · 2026-08-09 01:32 UTC

Pin CI actions to SHA, refactor diff/rules complexity, tidy tests

Layout: unified · split

.github/workflows/release.yml +2 −2

	@@ -11,11 +11,11 @@ jobs:
11	steps:	11	steps:
12	- uses: actions/checkout@v5	12	- uses: actions/checkout@v5
13	- name: Install uv	13	- name: Install uv
14	uses: astral-sh/setup-uv@v6	14	uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6
15	- name: Build	15	- name: Build
16	run: uv build	16	run: uv build
17	- name: Check	17	- name: Check
18	run: uvx twine check dist/*	18	run: uvx twine@7.0.0 check dist/*
19	- uses: actions/upload-artifact@v4	19	- uses: actions/upload-artifact@v4
20	with:	20	with:
21	name: dist	21	name: dist

audit_report/diff.py +54 −43

     return out
+def _render_delta_md(delta, category: str) -> list[str]:
+    rule = delta.rule
+    out = [
+        f"### {rule.title}",
+        "",
+        f"- **Rule:** `{rule.id}` · **Severity:** {rule.severity}",
+        f"- **Controls:** {', '.join(rule.controls) or '—'}",
+        f"- **Change:** {_transition(delta)}",
+    ]
+    if delta.new_reason:
+        out.append(f"- **Now:** {delta.new_reason}")
+    if category == REGRESSED and rule.remediation:
+        out.append(f"- **Remediation:** {rule.remediation.strip()}")
+    out.append("")
+    if delta.evidence_added:
+        out.append("**Newly failing rows:**")
+        out.append("")
+        out.extend(_md_table(delta.evidence_added))
+        out.append("")
+    if delta.evidence_removed:
+        out.append("**No longer failing rows:**")
+        out.append("")
+        out.extend(_md_table(delta.evidence_removed))
+        out.append("")
+    return out
 def _render_md(diff: DiffReport) -> str:
     counts = diff.counts
     out: list[str] = []
         out.append(f"## {_CATEGORY_HEADING[category]}")
         out.append("")
         for delta in rows:
-            rule = delta.rule
+            out.extend(_render_delta_md(delta, category))
-            out.append(f"### {rule.title}")
-            out.append("")
-            out.append(f"- **Rule:** `{rule.id}` · **Severity:** {rule.severity}")
-            out.append(f"- **Controls:** {', '.join(rule.controls) or '—'}")
-            out.append(f"- **Change:** {_transition(delta)}")
-            if delta.new_reason:
-                out.append(f"- **Now:** {delta.new_reason}")
-            if category == REGRESSED and rule.remediation:
-                out.append(f"- **Remediation:** {rule.remediation.strip()}")
-            out.append("")
-            if delta.evidence_added:
-                out.append("**Newly failing rows:**")
-                out.append("")
-                out.extend(_md_table(delta.evidence_added))
-                out.append("")
-            if delta.evidence_removed:
-                out.append("**No longer failing rows:**")
-                out.append("")
-                out.extend(_md_table(delta.evidence_removed))
-                out.append("")
     unchanged = diff.counts[UNCHANGED]
     if unchanged:
 )
+def _render_delta_html(delta, category: str) -> str:
+    rule = delta.rule
+    body = [
+        f"<h3>{escape(rule.title)}</h3>",
+        (
+            f"<dl><dt>Rule</dt><dd><code>{escape(rule.id)}</code> · "
+            f"{escape(rule.severity)}</dd>"
+        ),
+        f"<dt>Controls</dt><dd>{escape(', '.join(rule.controls) or '—')}</dd>",
+        f"<dt>Change</dt><dd class='transition'>{escape(_transition(delta))}</dd>",
+    ]
+    if delta.new_reason:
+        body.append(f"<dt>Now</dt><dd>{escape(delta.new_reason)}</dd>")
+    if category == REGRESSED and rule.remediation:
+        body.append(f"<dt>Remediation</dt><dd>{escape(rule.remediation.strip())}</dd>")
+    body.append("</dl>")
+    if delta.evidence_added:
+        body.append(_html_table(delta.evidence_added, "Newly failing rows", "added"))
+    if delta.evidence_removed:
+        body.append(
+            _html_table(delta.evidence_removed, "No longer failing rows", "removed")
+        )
+    return f"<div class='delta {category}'>{''.join(body)}</div>"
 def _render_html(diff: DiffReport) -> str:
     counts = diff.counts
     parts: list[str] = []
             continue
         parts.append(f"<h2>{escape(_CATEGORY_HEADING[category])}</h2>")
         for delta in rows:
-            rule = delta.rule
+            parts.append(_render_delta_html(delta, category))
-            body = [
-                f"<h3>{escape(rule.title)}</h3>",
-                (
-                    f"<dl><dt>Rule</dt><dd><code>{escape(rule.id)}</code> · "
-                    f"{escape(rule.severity)}</dd>"
-                ),
-                f"<dt>Controls</dt><dd>{escape(', '.join(rule.controls) or '—')}</dd>",
-                f"<dt>Change</dt><dd class='transition'>{escape(_transition(delta))}</dd>",
-            ]
-            if delta.new_reason:
-                body.append(f"<dt>Now</dt><dd>{escape(delta.new_reason)}</dd>")
-            if category == REGRESSED and rule.remediation:
-                body.append(f"<dt>Remediation</dt><dd>{escape(rule.remediation.strip())}</dd>")
-            body.append("</dl>")
-            if delta.evidence_added:
-                body.append(_html_table(delta.evidence_added, "Newly failing rows", "added"))
-            if delta.evidence_removed:
-                body.append(
-                    _html_table(delta.evidence_removed, "No longer failing rows", "removed")
-                )
-            parts.append(f"<div class='delta {category}'>{''.join(body)}</div>")
     if counts[UNCHANGED]:
         parts.append(f"<p class='meta'>{counts[UNCHANGED]} rule(s) unchanged.</p>")

audit_report/rules.py +29 −22

	@@ -71,19 +71,19 @@ def _as_number(value: str) -> float \| None:
71	return None	71	return None
72		72
73		73
74	def match(condition: dict, row: dict[str, str]) -> bool:	74	def _compare_numeric(op: str, raw: str, value) -> bool:
75	"""Return True if condition holds for row.	75	left, right = _as_number(raw), _as_number(str(value))
76		76	if left is None or right is None:
77	Raises ``ValueError`` on a malformed condition so ruleset bugs surface	77	return False
78	loudly rather than silently evaluating to False.	78	return {
79	"""	79	"gt": left > right,
80	if "all" in condition:	80	"gte": left >= right,
81	return all(match(c, row) for c in condition["all"])	81	"lt": left < right,
82	if "any" in condition:	82	"lte": left <= right,
83	return any(match(c, row) for c in condition["any"])	83	}[op]
84	if "not" in condition:	84
85	return not match(condition["not"], row)	85
86		86	def _match_leaf(condition: dict, row: dict[str, str]) -> bool:
87	column = condition.get("column")	87	column = condition.get("column")
88	op = condition.get("op")	88	op = condition.get("op")
89	if column is None or op is None:	89	if column is None or op is None:
	@@ -109,19 +109,26 @@ def match(condition: dict, row: dict[str, str]) -> bool:
109	choices = {str(v).strip().lower() for v in (value or [])}	109	choices = {str(v).strip().lower() for v in (value or [])}
110	return (norm in choices) if op == "in" else (norm not in choices)	110	return (norm in choices) if op == "in" else (norm not in choices)
111	if op in ("gt", "gte", "lt", "lte"):	111	if op in ("gt", "gte", "lt", "lte"):
112	left, right = _as_number(raw), _as_number(str(value))	112	return _compare_numeric(op, raw, value)
113	if left is None or right is None:
114	return False
115	return {
116	"gt": left > right,
117	"gte": left >= right,
118	"lt": left < right,
119	"lte": left <= right,
120	}[op]
121		113
122	raise ValueError(f"unknown operator: {op!r}")	114	raise ValueError(f"unknown operator: {op!r}")
123		115
124		116
		117	def match(condition: dict, row: dict[str, str]) -> bool:
		118	"""Return True if condition holds for row.
		119
		120	Raises ``ValueError`` on a malformed condition so ruleset bugs surface
		121	loudly rather than silently evaluating to False.
		122	"""
		123	if "all" in condition:
		124	return all(match(c, row) for c in condition["all"])
		125	if "any" in condition:
		126	return any(match(c, row) for c in condition["any"])
		127	if "not" in condition:
		128	return not match(condition["not"], row)
		129	return _match_leaf(condition, row)
		130
		131
125	def load_ruleset(path: str \| Path) -> Ruleset:	132	def load_ruleset(path: str \| Path) -> Ruleset:
126	"""Parse a ruleset YAML file into a :class:`Ruleset`, validating each rule."""	133	"""Parse a ruleset YAML file into a :class:`Ruleset`, validating each rule."""
127	text = Path(path).read_text(encoding="utf-8")	134	text = Path(path).read_text(encoding="utf-8")

tests/test_diff.py +2 −1

	@@ -67,7 +67,8 @@ def test_diff_render_markdown():
67	def test_diff_render_html_self_contained():	67	def test_diff_render_html_self_contained():
68	html = diff.render(_build(), "html")	68	html = diff.render(_build(), "html")
69	assert html.startswith("<!doctype html>")	69	assert html.startswith("<!doctype html>")
70	assert "http://" not in html and "https://" not in html	70	assert "http://" not in html
		71	assert "https://" not in html
71	assert "Evidence Drift" in html	72	assert "Evidence Drift" in html
72		73
73		74

tests/test_reporters.py +4 −2

     assert html.startswith("<!doctype html>")
     assert "<style>" in html
     # No external resource references.
-    assert "http://" not in html and "https://" not in html
+    assert "http://" not in html
+    assert "https://" not in html
     assert "src=" not in html
 def test_unknown_format_raises():
+    report = _report()
     with pytest.raises(ValueError, match="unknown format"):
-        reporters.render(_report(), "pdf")
+        reporters.render(report, "pdf")
 def test_cli_writes_files_and_exit_code(tmp_path):

tests/test_trend.py +2 −1

	@@ -83,7 +83,8 @@ def test_trend_render_markdown():
83	def test_trend_render_html_self_contained():	83	def test_trend_render_html_self_contained():
84	html = trend.render(_build(), "html")	84	html = trend.render(_build(), "html")
85	assert html.startswith("<!doctype html>")	85	assert html.startswith("<!doctype html>")
86	assert "http://" not in html and "https://" not in html	86	assert "http://" not in html
		87	assert "https://" not in html
87	assert "class='trend'" in html	88	assert "class='trend'" in html
88		89
89		90

Commit b94aafccf9

Commit `b94aafccf9`