Auditor workflow

Updated Jul 27, 2026

Scheduled audits run via .github/workflows/auditor.yml every day at 05:00 UTC. Results land in GitHub's Code Scanning dashboard because the workflow uploads the generated Static Analysis Results Interchange Format (SARIF) file using the GitHub github/codeql-action/upload-sarif action.
Trigger the workflow manually with Run workflow to inspect a specific revision. Provide snapshot_path (for example, tests/fixtures/auditor/snapshot.json) to replay a recorded API response and set upload_sarif to false when only a local artefact is required.
Run the same workflow locally with act:

  CONCORDAT_RUN_ACT_TESTS=1 pytest tests/workflows/test_auditor_workflow.py -k auditor

The test reads tests/fixtures/workflows/auditor-workflow-dispatch.json, downloads workflow artefacts under a temporary directory, and asserts that the SARIF log structure is valid.