Feat: Report zizmor findings at any severity

[ModeSevenIndustrialSolutions]

Feat: Report zizmor findings at any severity

Companion to .github#133, which moves the organisation scan pipeline's zizmor floor from low to informational. This makes the report count what that pipeline now publishes.

Why

The zizmor category cut at Severity.LOW, on the documented assumption that informational findings never reached the SARIF — which the low floor guaranteed. That guarantee is going away.

The gap was not theoretical: a scan of python-workflows produced 14 template-injection findings that the floor discarded, while the report showed "Zizmor Static Analysis: ✅ 110 Clean" across the estate.

Change

-        fail_severity=Severity.LOW,
+        fail_severity=Severity.INFORMATIONAL,

Plus the three stale comments (in categories.py and severity.py) that justified the old cutoff.

Why note still maps to LOW

zizmor emits both Low and Informational findings at SARIF level note. The raw SARIF distinguishes them via a zizmor/severity property, but the code-scanning alerts API this tool consumes exposes only rule.severity — the SARIF level — so the two are genuinely indistinguishable here.

Rather than guess, note keeps mapping to LOW (erring towards over- rather than under-stating), and the INFORMATIONAL cutoff makes the ambiguity moot for reporting: both tiers surface either way.

The cutoff also closes a real gap at SARIF level none, which normalises to INFORMATIONAL and previously passed silently regardless of the floor.

Scope

Only the zizmor category changes. aislop keeps its LOW cutoff and the global default stays MEDIUM — the scan pipeline change is zizmor-only, so lowering aislop would alter its posture with no corresponding publisher change.

Tests

Added TestCategoryFailSeverity, pinning both the zizmor cutoff and the unchanged global default. Nothing previously asserted the zizmor default — only config overrides were covered — so this change would have passed the suite silently. It now can't regress unnoticed.

• uv run pytest — 405 passed (403 before, +2)
• pre-commit — ruff, ruff-format, mypy, basedpyright, reuse, codespell all pass

Note for operators

Anyone running the released CLI (v0.8.0) before this ships can get the same behaviour today via config:

{ "report": { "categories": { "zizmor": { "fail_severity": "informational" } } } }

That override becomes redundant once this merges, but stays harmless.

[Copilot]

Pull request overview

This PR updates the Zizmor reporting category to treat findings at any severity as reportable failures by lowering its default fail_severity floor to Severity.INFORMATIONAL, aligning the report’s behavior with the organisation scan pipeline now publishing informational-level Zizmor results.

Changes:

• Lower Zizmor’s default fail_severity cutoff from LOW to INFORMATIONAL so informational findings are no longer folded into “clean”.
• Update/refresh the inline documentation in severity.py and categories.py to reflect the new pipeline floor and the SARIF note ambiguity.
• Add tests that pin the Zizmor default cutoff and assert the global default remains MEDIUM.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
tests/test_severity.py	Adds regression tests locking down Zizmor’s cutoff at INFORMATIONAL and the global default at MEDIUM; updates SARIF note mapping rationale comments.
src/github_security_report/severity.py	Updates documentation explaining why SARIF note continues to map to LOW despite informational findings now being present.
src/github_security_report/categories.py	Lowers Zizmor category fail_severity to INFORMATIONAL and updates comments to match the new reporting posture.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[zxiiro]

🤖 Auto-approved by agent: reviewed reporting-logic change for security and CI/CD impact, found low risk. Lowers the zizmor category's fail-severity floor to INFORMATIONAL to match the org's --min-severity informational scan pipeline (since zizmor's SARIF encoder can't distinguish Low from Informational at the 'note' level); well-tested, no permissions/secrets/network changes.