pyproject.toml (1)

87-99: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Keep build.targets consistent with the BUILD_MQT_CORE_MLIR option.

bindings/CMakeLists.txt only defines mqt-core-mlir-bindings when BUILD_MQT_CORE_MLIR is enabled, but this target is now requested unconditionally here. Any source build that flips BUILD_MQT_CORE_MLIR=OFF will still ask scikit-build to build a non-existent target and fail before packaging starts. Either make the target list conditional on the same flag or stop enumerating the MLIR bindings target explicitly.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pyproject.toml` around lines 87 - 99, The build target list is out of sync
with the BUILD_MQT_CORE_MLIR option, because build.targets currently always
includes mqt-core-mlir-bindings even though bindings/CMakeLists.txt only defines
it when that flag is enabled. Update the build.targets configuration to match
the same condition used for BUILD_MQT_CORE_MLIR, either by making the target
list conditional or by removing the explicit mqt-core-mlir-bindings entry so
source builds with the flag disabled do not request a missing target.

.github/workflows/ci.yml (1)

171-190: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Set explicit permissions: on these reusable-workflow jobs.

Right now each caller inherits the repository default GITHUB_TOKEN scope. On private/org repos that can be broader than needed, which is exactly the excessive-permissions warning zizmor is surfacing here. Please declare the minimum permissions on each job before uses: and only widen them if the reusable workflow actually needs more than read access.

Minimal pattern

   python-tests:
+    permissions:
+      contents: read
     uses: munich-quantum-toolkit/workflows/.github/workflows/reusable-python-tests.yml@e7f84f39ce2d3b6c5d1d04526b8f94f98e455143

Also applies to: 202-214, 216-226, 234-254

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 171 - 190, Add explicit minimal
permissions to the reusable-workflow jobs in the CI workflow instead of relying
on inherited repository defaults, since the current `python-tests` job (and the
other cited `uses:` jobs) may be granting excessive `GITHUB_TOKEN` scope. Update
each reusable-workflow caller before its `uses:` line to declare only the
permissions required by the called workflow, widening them only if a specific
job needs more than read access.

Source: Linters/SAST tools

bindings/mlir/register_mlir.cpp (1)

100-120: 🩺 Stability & Availability | 🔴 Critical | ⚡ Quick win

Reject failed parses before returning a null module.

moduleFromMlirFile(), moduleFromQasmString(), and moduleFromQasmFile() can return a null OwningOpRef; compileProgram() later dereferences module.get() in the pipeline path, so invalid input can crash the Python process instead of raising RuntimeError.

Proposed fix

 [[nodiscard]] mlir::OwningOpRef<mlir::ModuleOp>
 moduleFromMlirFile(mlir::MLIRContext* context, const std::string& path) {
@@
   llvm::SourceMgr sourceMgr;
   sourceMgr.AddNewSourceBuffer(std::move(file), llvm::SMLoc());
-  return parseSourceFile<mlir::ModuleOp>(sourceMgr, context);
+  auto module = parseSourceFile<mlir::ModuleOp>(sourceMgr, context);
+  if (!module) {
+    throw std::runtime_error(std::string("Failed to parse MLIR file '") +
+                             path + "'.");
+  }
+  return module;
 }
@@
 moduleFromQasmString(mlir::MLIRContext* context,
                      const std::string& qasmSource) {
-  return mlir::qc::translateQASM3ToQC(qasmSource, context);
+  auto module = mlir::qc::translateQASM3ToQC(qasmSource, context);
+  if (!module) {
+    throw std::runtime_error("Failed to translate OpenQASM source to MLIR.");
+  }
+  return module;
 }
@@
   llvm::SourceMgr sourceMgr;
   sourceMgr.AddNewSourceBuffer(std::move(file), llvm::SMLoc());
-  return mlir::qc::translateQASM3ToQC(sourceMgr, context);
+  auto module = mlir::qc::translateQASM3ToQC(sourceMgr, context);
+  if (!module) {
+    throw std::runtime_error(std::string("Failed to translate OpenQASM file '") +
+                             path + "'.");
+  }
+  return module;
 }

Also applies to: 126-147

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@bindings/mlir/register_mlir.cpp` around lines 100 - 120,
`moduleFromMlirFile()` and the other parse helpers can return a null
`mlir::OwningOpRef`, which later lets `compileProgram()` dereference
`module.get()` and crash. Add an explicit null check immediately after parsing
in `moduleFromMlirString()`, `moduleFromMlirFile()`, `moduleFromQasmString()`,
and `moduleFromQasmFile()`, and throw a `std::runtime_error` with a clear
parse-failure message instead of returning the null module. Make sure the
pipeline path in `compileProgram()` only proceeds with a valid module.