fix: scan full repo in PR workflow (individual file scan lacks SARIF output)

The _analyze_file() code path doesn't support --output-sarif, so scanning
individual changed files caused FileNotFoundError on the triage step.

Changed PR workflow to 'a3 scan .' (full repo) — the workflow still only
triggers when .py files change. Updated README to match.

Bumped to v0.1.16.

Author: GitHub Copilot

README.md

@@ -87,7 +87,7 @@ Upload the SARIF file to GitHub's [Code Scanning](https://docs.github.com/en/cod
 
 A3 ships with GitHub Actions workflows that **continuously scan every push and every PR** using a **two-phase approach**:
 
-1. **Non-LLM static analysis** scans only the changed `.py` files and automatically proves 99% as false positives
+1. **Non-LLM static analysis** scans the repo and automatically proves 99% as false positives
 2. **Agentic LLM triage** investigates the remaining 1% — the LLM reads source files, searches for guard patterns, checks callers and tests, then classifies each finding — zero API keys needed
 
 Every GitHub Actions runner already has a `GITHUB_TOKEN`, which gives access to GitHub Models. That's all the agentic triage needs.
@@ -109,7 +109,7 @@ That's it. Every push to `main`/`master` and every PR that touches Python files
 
 | File | What it does |
 |------|-------------|
-| `.github/workflows/a3-pr-scan.yml` | **On every push & PR:** scans only the changed `.py` files → agentic LLM investigates each finding (reads files, searches patterns, checks callers) → blocks if new bugs found → uploads SARIF |
+| `.github/workflows/a3-pr-scan.yml` | **On every push & PR:** scans the repo → agentic LLM investigates each finding (reads files, searches patterns, checks callers) → blocks if new bugs found → uploads SARIF |
 | `.github/workflows/a3-scheduled-scan.yml` | **Weekly (Monday 6 AM UTC):** full-repo scan → agentic triage → auto-files GitHub Issues for new TPs → updates baseline |
 | `.a3.yml` | Analysis configuration (what to scan, confidence thresholds, etc.) |
 | `.a3-baseline.json` | Known-findings baseline for the ratchet (starts empty) |
@@ -119,7 +119,7 @@ That's it. Every push to `main`/`master` and every PR that touches Python files
 ```
 push to main/master — or — PR opened (touches .py files)
   │
-  ├─ 1. Non-LLM static analysis scans changed files
+  ├─ 1. Non-LLM static analysis scans the repo
   │     • Bytecode analysis + Z3 symbolic execution
   │     • Automatically proves 99% as false positives
   │     • Outputs SARIF with remaining 1% of findings
@@ -155,7 +155,7 @@ When you run `a3 init . --copilot`, it creates `.github/workflows/a3-pr-scan.yml
 
 - name: Run a3
   run: |
-    a3 scan $(cat changed_files.txt | tr '\n' ' ') \
+    a3 scan . \
       --output-sarif a3-results.sarif
 
 - name: Agentic triage                        # ← the magic step

a3_python/ci/templates/a3-pr-scan.yml

@@ -1,10 +1,10 @@
 # ──────────────────────────────────────────────────────────────────────────────
 # a3 — Continuous scan on every code change
 #
-# Triggers on every push / PR that touches Python files.  Scans ONLY the
-# changed files, runs agentic LLM triage (the LLM uses tools to explore
-# callers, tests, guards, and imports before deciding TP/FP), diffs
-# against the committed baseline, and uploads SARIF to Code Scanning.
+# Triggers on every push / PR that touches Python files.  Scans the repo,
+# runs agentic LLM triage (the LLM uses tools to explore callers, tests,
+# guards, and imports before deciding TP/FP), diffs against the committed
+# baseline, and uploads SARIF to Code Scanning.
 #
 # Install:  a3 init . --copilot
 # Docs:     https://github.com/thehalleyyoung/A³
@@ -60,11 +60,11 @@ jobs:
           echo "Changed Python files:"
           cat changed_files.txt
 
-      # ── Run analysis (only changed files) ────────────────────────────
+      # ── Run analysis ────────────────────────────────────────────────
       - name: Run a3
         if: steps.changed.outputs.count != '0'
         run: |
-          a3 scan $(cat changed_files.txt | tr '\n' ' ') \
+          a3 scan . \
             --output-sarif a3-results.sarif
         continue-on-error: true
 

examples.py

@@ -0,0 +1,117 @@
+"""
+Real-world bug examples that a3-python can automatically detect.
+
+Run: a3 scan examples.py --interprocedural
+"""
+
+# Example 1: User Authentication
+def authenticate_user(username, user_database):
+    """
+    Look up user credentials from database.
+    BUG: No validation that user exists.
+    """
+    user_record = user_database.get(username)
+    # BUG: user_record could be None if username not found
+    return user_record['password_hash']  # NULL_PTR
+
+
+# Example 2: Percentage Calculation
+def calculate_completion_rate(completed, total):
+    """
+    Calculate completion percentage.
+    BUG: No check for zero total.
+    """
+    if completed > total:
+        raise ValueError("Invalid: completed > total")
+    # BUG: total could be 0
+    return (completed / total) * 100  # DIV_ZERO
+
+
+# Example 3: Nested Configuration Access
+def get_database_host(config):
+    """
+    Extract database host from config.
+    BUG: No None checks on nested attributes.
+    """
+    # BUG: config or config.database could be None
+    return config.database.host  # NULL_PTR
+
+
+# Example 4: API Response Processing
+def get_first_user_email(api_response):
+    """
+    Get email of first user from API response.
+    BUG: Assumes response has users and they have emails.
+    """
+    users = api_response['users']
+    first_user = users[0]  # BOUNDS: users could be empty
+    return first_user['email']  # NULL_PTR: first_user could be None
+
+
+# Example 5: Report Generation
+def get_latest_transaction(transactions):
+    """
+    Get the most recent transaction.
+    BUG: No check if transactions list is empty.
+    """
+    sorted_txns = sorted(transactions, key=lambda t: t.date, reverse=True)
+    # BUG: sorted_txns could be empty
+    latest = sorted_txns[0]  # BOUNDS
+    return latest.amount
+
+
+# Example 6: Score Averaging
+def calculate_average_score(scores):
+    """
+    Calculate average across all scores.
+    BUG: Doesn't handle empty input.
+    """
+    total = sum(scores.values())
+    count = len(scores)
+    # BUG: count could be 0
+    return total / count  # DIV_ZERO
+
+
+# Example 7: CSV Parsing
+def extract_email_from_csv(csv_line):
+    """
+    Parse email from third column of CSV.
+    BUG: Assumes CSV has at least 3 columns.
+    """
+    fields = csv_line.split(',')
+    # BUG: fields might have < 3 elements
+    return fields[2].strip()  # BOUNDS
+
+
+# Example 8: Investment Return
+def calculate_roi(profit, cost):
+    """
+    Calculate return on investment percentage.
+    BUG: No validation of cost.
+    """
+    # BUG: cost could be 0
+    return (profit / cost) * 100  # DIV_ZERO
+
+
+# Example 9: Product Pricing
+def get_product_total_price(inventory, product_id):
+    """
+    Calculate total price including tax.
+    BUG: Doesn't validate product exists.
+    """
+    product = inventory.lookup(product_id)
+    # BUG: product could be None
+    price = product.base_price  # NULL_PTR
+    tax = product.tax_rate
+    return price * (1 + tax)
+
+
+# Example 10: Cache Retrieval
+def get_from_cache(cache, key):
+    """
+    Retrieve value from cache.
+    BUG: Doesn't validate cache entry.
+    """
+    entry = cache.get(key)
+    # BUG: entry could be None
+    return entry.data  # NULL_PTR

examples_safe.py

@@ -0,0 +1,128 @@
+"""
+Safe versions with proper validation.
+
+Run: a3 scan examples_safe.py --interprocedural
+"""
+
+# Example 1: User Authentication (SAFE)
+def authenticate_user(username, user_database):
+    """
+    Look up user credentials with validation.
+    SAFE: Checks if user exists.
+    """
+    user_record = user_database.get(username)
+    if user_record is not None:
+        return user_record['password_hash']
+    return None
+
+
+# Example 2: Percentage Calculation (SAFE)
+def calculate_completion_rate(completed, total):
+    """
+    Calculate completion percentage safely.
+    SAFE: Checks for zero before division.
+    """
+    if completed > total:
+        raise ValueError("Invalid: completed > total")
+    if total != 0:
+        return (completed / total) * 100
+    return 0.0
+
+
+# Example 3: Nested Configuration Access (SAFE)
+def get_database_host(config):
+    """
+    Extract database host with validation.
+    SAFE: Checks nested attributes.
+    """
+    if config is not None and config.database is not None:
+        return config.database.host
+    return "localhost"
+
+
+# Example 4: API Response Processing (SAFE)
+def get_first_user_email(api_response):
+    """
+    Get first user email with validation.
+    SAFE: Checks array bounds and None values.
+    """
+    users = api_response.get('users', [])
+    if len(users) > 0:
+        first_user = users[0]
+        if first_user is not None:
+            return first_user.get('email')
+    return None
+
+
+# Example 5: Report Generation (SAFE)
+def get_latest_transaction(transactions):
+    """
+    Get most recent transaction safely.
+    SAFE: Checks if list is empty.
+    """
+    sorted_txns = sorted(transactions, key=lambda t: t.date, reverse=True)
+    if len(sorted_txns) > 0:
+        return sorted_txns[0].amount
+    return 0.0
+
+
+# Example 6: Score Averaging (SAFE)
+def calculate_average_score(scores):
+    """
+    Calculate average with empty check.
+    SAFE: Validates count before division.
+    """
+    total = sum(scores.values())
+    count = len(scores)
+    if count > 0:
+        return total / count
+    return 0.0
+
+
+# Example 7: CSV Parsing (SAFE)
+def extract_email_from_csv(csv_line):
+    """
+    Parse email with column validation.
+    SAFE: Checks field count.
+    """
+    fields = csv_line.split(',')
+    if len(fields) >= 3:
+        return fields[2].strip()
+    return None
+
+
+# Example 8: Investment Return (SAFE)
+def calculate_roi(profit, cost):
+    """
+    Calculate ROI with validation.
+    SAFE: Checks for zero cost.
+    """
+    if cost != 0:
+        return (profit / cost) * 100
+    return 0.0
+
+
+# Example 9: Product Pricing (SAFE)
+def get_product_total_price(inventory, product_id):
+    """
+    Calculate price with validation.
+    SAFE: Checks product exists.
+    """
+    product = inventory.lookup(product_id)
+    if product is not None:
+        price = product.base_price
+        tax = product.tax_rate
+        return price * (1 + tax)
+    return 0.0
+
+
+# Example 10: Cache Retrieval (SAFE)
+def get_from_cache(cache, key):
+    """
+    Retrieve from cache safely.
+    SAFE: Validates entry exists.
+    """
+    entry = cache.get(key)
+    if entry is not None:
+        return entry.data
+    return None