chore: force-sync upstream (main)

.github/workflows/ci.yml

@@ -10,6 +10,32 @@ permissions:
   contents: read
 
 jobs:
-  ci:
-    uses: Ai-road-4-You/enterprise-ci-cd/.github/workflows/ci-python.yml@v1
-    secrets: inherit
+  test:
+    name: Run Tests ${{ matrix.python-version }} on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        python-version: ['3.11', '3.14'] # the one we have in the Codespace + the latest one supported by Python 3.
+      fail-fast: false  # Continue testing other version(s) if one fails
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      with:
+        python-version: ${{ matrix.python-version }}
+        cache: 'pip'
+
+
+    - name: Install Hatch
+      run: pip install --upgrade hatch
+
+    - name: Run static analysis
+      run: |
+        hatch fmt --linter --check
+
+    - name: Run tests
+      run: hatch test --python ${{ matrix.python-version }} --cover --randomize --parallel --retries 2 --retry-delay 1

.github/workflows/publish-to-pypi.yaml

@@ -6,53 +6,69 @@ on:
       - v[0-9]+.[0-9]+.[0-9]+
 
 jobs:
-  publish:
-    name: Build
+  build:
+    name: Build distribution
     runs-on: ubuntu-latest
 
-    # This environment is required as an input to pypa/gh-action-pypi-publish
-    environment:
-      name: pypi
-      url: https://pypi.org/p/seclab-taskflows
-
-    env:
-      GITHUB_REPO: ${{ github.repository }}
 
     permissions:
-      contents: write
-      id-token: write  # For trusted publishing
-      attestations: write  # For artifact attestation
+      contents: read
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         persist-credentials: false
 
     - name: Set up Python
-      uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
-        python-version: "3.13"
+        python-version: "3.14"
 
     - name: Install Hatch
       run: pip install --upgrade hatch
 
     - name: Build the wheel
       run: python3 -m hatch build
 
-    - name: Attest build provenance
-      uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
+    - name: Upload artifacts
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
-        subject-path: ./dist/*
+        name: python-package-distributions
+        path: ./dist/
 
-    - name: Upload artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+  publish:
+    name: Publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+
+    # This environment is required as an input to pypa/gh-action-pypi-publish
+    environment:
+      name: pypi
+      url: https://pypi.org/p/seclab-taskflows
+
+    env:
+      GITHUB_REPO: ${{ github.repository }}
+
+    permissions:
+      contents: write
+      id-token: write  # For trusted publishing
+      attestations: write  # For artifact attestation
+
+    steps:
+    - name: Download distribution artifacts
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: python-package-distributions
-        path: dist/
+        path: ./dist/
+
+    - name: Attest build provenance
+      uses: actions/attest@v4.1.0 # immutable release
+      with:
+        subject-path: ./dist/*
 
     - name: Publish to PyPI
-      uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+      uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
       with:
         verbose: true
 

.github/workflows/publish-to-testpypi.yaml

@@ -1,35 +1,27 @@
-name: Publish to TestPyPI
+name: Publish Pre-Release to TestPyPI
 
 on: workflow_dispatch
 
 jobs:
-  publish:
-    name: Build
+  build:
+    name: Build distribution
     runs-on: ubuntu-latest
-
-    # This environment is required as an input to pypa/gh-action-pypi-publish
-    environment:
-      name: testpypi
-      url: https://test.pypi.org/p/seclab-taskflows
-
-    env:
-      GITHUB_REPO: ${{ github.repository }}
+    outputs:
+      release_name: ${{ steps.create_version_number.outputs.RELEASE_NAME }}
 
     permissions:
-      contents: write
-      id-token: write  # For trusted publishing
-      attestations: write  # For artifact attestation
+      contents: read
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         persist-credentials: false
 
     - name: Set up Python
-      uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
-        python-version: "3.13"
+        python-version: "3.14"
 
     - name: Install Hatch
       run: pip install --upgrade hatch
@@ -52,25 +44,50 @@ jobs:
     - name: Build the wheel
       run: python3 -m hatch build
 
-    - name: Attest build provenance
-      uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
+    - name: Upload artifacts
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
-        subject-path: ./dist/*
+        name: python-package-distributions
+        path: ./dist/
 
-    - name: Upload artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+  publish:
+    name: Publish to TestPyPI
+    needs: build
+    runs-on: ubuntu-latest
+
+    # This environment is required as an input to pypa/gh-action-pypi-publish
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/p/seclab-taskflows
+
+    env:
+      GITHUB_REPO: ${{ github.repository }}
+
+    permissions:
+      contents: write
+      id-token: write  # For trusted publishing
+      attestations: write  # For artifact attestation
+
+    steps:
+    - name: Download distribution artifacts
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: python-package-distributions
-        path: dist/
+        path: ./dist/
+
+    - name: Attest build provenance
+      uses: actions/attest@v4.1.0 # immutable release
+      with:
+        subject-path: ./dist/*
 
     - name: Publish to TestPyPI
-      uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+      uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
       with:
         repository-url: https://test.pypi.org/legacy/
         verbose: true
 
     - name: Create GitHub Release
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        RELEASE_NAME: ${{ steps.create_version_number.outputs.RELEASE_NAME }}
+        RELEASE_NAME: ${{ needs.build.outputs.release_name }}
       run: gh release create $RELEASE_NAME dist/* --repo $GITHUB_REPO --prerelease --generate-notes

pyproject.toml

@@ -7,7 +7,7 @@ name = "seclab-taskflows"
 dynamic = ["version"]
 description = 'Example taskflows to use with the the GitHub Security Lab Taskflow Agent Framework (https://github.com/GitHubSecurityLab/seclab-taskflow-agent)'
 readme = "README.md"
-requires-python = ">=3.9"
+requires-python = ">=3.10"
 license = "MIT"
 keywords = []
 authors = [
@@ -16,16 +16,14 @@ authors = [
 classifiers = [
   "Development Status :: 4 - Beta",
   "Programming Language :: Python",
-  "Programming Language :: Python :: 3.8",
-  "Programming Language :: Python :: 3.9",
   "Programming Language :: Python :: 3.10",
   "Programming Language :: Python :: 3.11",
   "Programming Language :: Python :: 3.12",
   "Programming Language :: Python :: Implementation :: CPython",
   "Programming Language :: Python :: Implementation :: PyPy",
 ]
 dependencies = [
-  "seclab-taskflow-agent==0.3.1",
+  "seclab-taskflow-agent==0.4.1",
 ]
 
 [project.urls]

scripts/audit/run_audit.sh

@@ -5,14 +5,19 @@
 set -e
 
 USE_ADVISORY=false
+MODEL_CONFIG_FLAG=""
 
 # Parse flags
-while [[ "$1" == --* ]]; do
+while [[ "$1" == -* ]]; do
   case "$1" in
     --advisory)
       USE_ADVISORY=true
       shift
       ;;
+    -m)
+      MODEL_CONFIG_FLAG="-m $2"
+      shift 2
+      ;;
     *)
       echo "Unknown option: $1"
       exit 1
@@ -21,20 +26,21 @@ while [[ "$1" == --* ]]; do
 done
 
 if [ -z "$1" ]; then 
-  echo "Usage: $0 [--advisory] <repo>"; 
+  echo "Usage: $0 [--advisory] [-m model_config] <repo>"; 
   exit 1; 
 fi
 
-python -m seclab_taskflow_agent -t seclab_taskflows.taskflows.audit.fetch_source_code -g repo="$1"
-python -m seclab_taskflow_agent -t seclab_taskflows.taskflows.audit.identify_applications -g repo="$1"
-python -m seclab_taskflow_agent -t seclab_taskflows.taskflows.audit.gather_web_entry_point_info -g repo="$1"
+python -m seclab_taskflow_agent $MODEL_CONFIG_FLAG -t seclab_taskflows.taskflows.audit.fetch_source_code -g repo="$1"
+python -m seclab_taskflow_agent $MODEL_CONFIG_FLAG -t seclab_taskflows.taskflows.audit.identify_applications -g repo="$1"
+python -m seclab_taskflow_agent $MODEL_CONFIG_FLAG -t seclab_taskflows.taskflows.audit.gather_web_entry_point_info -g repo="$1"
+python -m seclab_taskflow_agent $MODEL_CONFIG_FLAG -t seclab_taskflows.taskflows.audit.gather_security_entry_point_info -g repo="$1"
 
 if [ "$USE_ADVISORY" = true ]; then
-  python -m seclab_taskflow_agent -t seclab_taskflows.taskflows.audit.fetch_security_advisories -g repo="$1"
+  python -m seclab_taskflow_agent $MODEL_CONFIG_FLAG -t seclab_taskflows.taskflows.audit.fetch_security_advisories -g repo="$1"
 fi
 
-python -m seclab_taskflow_agent -t seclab_taskflows.taskflows.audit.classify_application_local -g repo="$1" -g use_advisory="$USE_ADVISORY"
-python -m seclab_taskflow_agent -t seclab_taskflows.taskflows.audit.audit_issue_local_iter -g repo="$1" -g use_advisory="$USE_ADVISORY"
+python -m seclab_taskflow_agent $MODEL_CONFIG_FLAG -t seclab_taskflows.taskflows.audit.classify_application_local -g repo="$1" -g use_advisory="$USE_ADVISORY"
+python -m seclab_taskflow_agent $MODEL_CONFIG_FLAG -t seclab_taskflows.taskflows.audit.audit_issue_local_iter -g repo="$1" -g use_advisory="$USE_ADVISORY"
 
 set +e
 

src/seclab_taskflows/__about__.py

@@ -1,4 +1,4 @@
 # SPDX-FileCopyrightText: GitHub, Inc.
 # SPDX-License-Identifier: MIT
 
-__version__ = "0.0.4"
+__version__ = "0.1.0"

src/seclab_taskflows/configs/model_config.yaml

@@ -5,11 +5,13 @@ seclab-taskflow-agent:
   version: "1.0"
   filetype: model_config
 models:
-   code_analysis: gpt-5.2
-   general_tasks: gpt-4.1
-   triage: claude-sonnet-4.5
+   code_analysis: gpt-5.4
+   general_tasks: gpt-5.4-mini
+   triage: claude-sonnet-4.6
 model_settings:
   code_analysis:
-    temperature: 1
+    api_type: responses
     reasoning:
-      effort: medium
+      effort: medium
+  general_tasks:
+    api_type: responses

src/seclab_taskflows/configs/model_config_lowercost.yaml

@@ -5,5 +5,10 @@ seclab-taskflow-agent:
   version: "1.0"
   filetype: model_config
 models:
-   code_analysis: gpt-5-mini
-   general_tasks: gpt-5-mini
+   code_analysis: gpt-5.4-mini
+   general_tasks: gpt-5.4-mini
+model_settings:
+  code_analysis:
+    api_type: responses
+  general_tasks:
+    api_type: responses

src/seclab_taskflows/mcp_servers/alert_results_models.py

@@ -23,7 +23,7 @@ class AlertResults(Base):
     language: Mapped[str]
     location: Mapped[str]
     result: Mapped[str] = mapped_column(Text)
-    created: Mapped[Optional[str]]
+    created: Mapped[str | None]
     valid: Mapped[bool] = mapped_column(nullable=False, default=True)
     completed: Mapped[bool] = mapped_column(nullable=False, default=False)
 
@@ -44,8 +44,8 @@ class AlertFlowGraph(Base):
     alert_canonical_id = Column(Integer, ForeignKey("alert_results.canonical_id", ondelete="CASCADE"))
     flow_data: Mapped[str] = mapped_column(Text)
     repo: Mapped[str]
-    prev: Mapped[Optional[str]]
-    next: Mapped[Optional[str]]
+    prev: Mapped[str | None]
+    next: Mapped[str | None]
     started: Mapped[bool] = mapped_column(nullable=False, default=False)
 
     def __repr__(self):

src/seclab_taskflows/mcp_servers/codeql_python/codeql_sqlite_models.py

@@ -18,7 +18,7 @@ class Source(Base):
     source_location: Mapped[str]
     line: Mapped[int]
     source_type: Mapped[str]
-    notes: Mapped[Optional[str]] = mapped_column(Text, nullable=True)
+    notes: Mapped[str | None] = mapped_column(Text, nullable=True)
 
     def __repr__(self):
         return (