scitex-security 0.2.0

Unified security scanning for the SciTeX ecosystem: bandit + shellcheck + pip-audit + GitHub alerts (Dependabot, secret scanning, code scanning) in one orchestrator

scitex-security

GitHub security-alert utilities — Dependabot, secret scanning, code scanning. Pure stdlib + `gh` subprocess, zero scitex.* runtime deps.

Full Documentation · uv pip install scitex-security[all]

---

Installation

pip install scitex-security

Architecture

src/scitex_security/
├── __init__.py     # public re-exports
├── github.py       # GitHub alert collection (Dependabot / secret / code scanning)
├── cli.py          # `scitex-security check` / `show-latest`
├── __main__.py     # python -m scitex_security
└── _skills.py      # bundled agent skills

Runtime flow:
  scitex-security check <owner/repo>
        │
        ▼
  github.check_github_alerts()
        │ subprocess
        ▼
  gh api repos/<owner>/<repo>/{dependabot,secret-scanning,code-scanning}/alerts
        │
        ▼
  format_alerts_report() → save_alerts_to_file(.scitex/security/runtime/)

scitex-security shells out to gh (GitHub CLI) and never touches your tokens directly — GH_TOKEN / GITHUB_TOKEN are read by the gh subprocess from the environment, not from this package.

2 Interfaces

Python API (primary)

from scitex_security import (
    check_github_alerts,
    save_alerts_to_file,
    format_alerts_report,
    GitHubSecurityError,
)

alerts = check_github_alerts(repo="ywatanabe1989/myrepo")
print(format_alerts_report(alerts))
save_alerts_to_file(alerts, output_dir=".scitex/security/runtime")

CLI

scitex-security check ywatanabe1989/myrepo
scitex-security show-latest --security-dir ~/.scitex/security/runtime

Demo

flowchart LR
    user["scitex-security check\nywatanabe1989/myrepo"] --> api["check_github_alerts()"]
    env["GH_TOKEN /\nGITHUB_TOKEN"] -.-> gh["gh CLI subprocess"]
    api --> gh
    gh --> dep["Dependabot alerts"]
    gh --> sec["secret-scanning alerts"]
    gh --> code["code-scanning alerts"]
    dep --> report["format_alerts_report()"]
    sec --> report
    code --> report
    report --> stdout[("terminal report")]
    report --> save["save_alerts_to_file()"]
    save --> json[(".scitex/security/runtime/<ts>.txt")]

Quick Start

See the Python API block above for the minimal end-to-end example.

Environment Variables

Variable	Purpose	Default
SCITEX_SECURITY_CONFIG	Path to a YAML config file (overrides ~/.scitex/security/config.yaml).	unset
SCITEX_SECURITY_DIR	Override the alerts output directory (overrides project/user scope).	unset (uses <project>/.scitex/security/runtime/ or ~/.scitex/security/runtime/)
SCITEX_DIR	Relocate the user-scope root (e.g. /mnt/fast-ssd/scitex).	~/.scitex
GH_TOKEN / GITHUB_TOKEN	Auth token used by the underlying gh CLI subprocess.	unset

Config precedence: explicit path → $SCITEX_SECURITY_CONFIG → ~/.scitex/security/config.yaml → built-in defaults. Alert output precedence: --output-dir / --security-dir → $SCITEX_SECURITY_DIR → project scope → user scope (respects $SCITEX_DIR).

Status

Standalone fork of scitex.security. Pure stdlib + gh CLI subprocess — zero scitex.* runtime deps. Umbrella scitex.security import path is preserved via a sys.modules-alias bridge.

Part of SciTeX

scitex-security is part of SciTeX. Install via the umbrella with pip install scitex[security] to use as scitex.security (Python) or scitex security ... (CLI).

Four Freedoms for Research

0. The freedom to run your research anywhere — your machine, your terms.
1. The freedom to study how every step works — from raw data to final manuscript.
2. The freedom to redistribute your workflows, not just your papers.
3. The freedom to modify any module and share improvements with the community.

AGPL-3.0 — because we believe research infrastructure deserves the same freedoms as the software it runs on.

License

AGPL-3.0-only (see LICENSE).

---