API

scitex-security — unified security scanning for the SciTeX ecosystem.

As of 0.2.0, scitex-security is the unified package that owns the multi-tool security-audit orchestrator (bandit / shellcheck / pip-audit) in addition to its original GitHub-alerts checker (Dependabot, secret scanning, code scanning). The audit orchestrator was absorbed from scitex-audit 0.2.0 per ADR-0002 (scitex-dev #142); future scitex-audit releases are deprecated thin re-export shims of this package.

Usage:

# Multi-tool security sweep (Python + shell + deps + GitHub):
from scitex_security import audit

results = audit(".")
results = audit(".", checks=["python", "shell"])

# GitHub alerts directly:
from scitex_security import check_github_alerts

alerts = check_github_alerts()
if alerts:
    print(f"Found {len(alerts)} security alerts!")

scitex_security.audit(path='.', checks=None, output_file=None)[source]

Run security audit across multiple tools.

Parameters:

path (str) – Directory to scan. Defaults to current directory.
checks (list[str] | None) – Which checks to run. Options: “python”, “shell”, “deps”, “github”. None means run all available checks.
output_file (str | None) – If given, write JSON report to this path.

Returns:

Keys are check names, values have {status, findings, summary}.

Return type:

dict

exception scitex_security.GitHubSecurityError[source]: Raised when GitHub security operations fail.

scitex_security.check_github_alerts(repo=None, *, auth_check=None, secrets_fn=None, dependabot_fn=None, code_scanning_fn=None)[source]

Check all GitHub security alerts.

Parameters:

repo (Optional[str]) – Repository in format ‘owner/repo’. If None, uses current repo.
auth_check (Optional[Callable[[], bool]]) – check_gh_auth-shaped callable. Override in tests.
secrets_fn (Optional[Callable]) – get_secret_alerts-shaped callable. Override in tests.
dependabot_fn (Optional[Callable]) – get_dependabot_alerts-shaped callable. Override in tests.
code_scanning_fn (Optional[Callable]) – get_code_scanning_alerts-shaped callable. Override in tests.

Returns:

‘secrets’, ‘dependabot’, ‘code_scanning’

Return type:

Dictionary with keys

Raises:

GitHubSecurityError – If GitHub CLI is not installed or not authenticated

scitex_security.format_alerts_report(alerts)[source]

Format alerts into a readable text report.

Parameters:: alerts (Dict[str, List[Dict]]) – Dictionary of alerts from check_github_alerts()
Return type:: str
Returns:: Formatted text report

scitex_security.get_latest_alerts_file(security_dir=None)[source]

Get path to the latest security alerts file.

Parameters:: security_dir (Optional[Path]) – Directory containing security files. Defaults to the ~/.scitex/security/runtime/ (or project-scope equivalent when inside a git repo, or $SCITEX_SECURITY_DIR).
Return type:: Optional[Path]
Returns:: Path to latest file, or None if not found

scitex_security.save_alerts_to_file(alerts, output_dir=None, create_symlink=True)[source]

Save alerts to a timestamped file.

Parameters:

alerts (Dict[str, List[Dict]]) – Dictionary of alerts from check_github_alerts()
output_dir (Optional[Path]) – Directory to save file. Defaults to the ~/.scitex/security/runtime/ (or project-scope equivalent when inside a git repo, or $SCITEX_SECURITY_DIR).
create_symlink (bool) – If True, create ‘security-latest.txt’ symlink

Return type:

Path

Returns:

Path to saved file