From b07dcb0ed9c53e34a8194aca1d0d91726b3e5233 Mon Sep 17 00:00:00 2001 From: Jennifer Power Date: Thu, 12 Oct 2023 12:23:16 -0400 Subject: [PATCH] feat: adds support for rules in YAML format Removes CSV based rule examples Removes CSV automation for rules Add action to auto-transform when the YAML is edited Signed-off-by: Jennifer Power --- .github/workflows/transform-rules.yml | 20 ++++++++++++++++++++ .github/workflows/validate.yml | 4 +--- Makefile | 13 ------------- data/example.config | 7 ------- data/example.csv | 3 --- rules/example/Example/rule_1.yml | 17 +++++++++++++++++ scripts/csv_sanity_check.sh | 27 --------------------------- scripts/get_config_updates.sh | 22 ---------------------- 8 files changed, 38 insertions(+), 75 deletions(-) create mode 100644 .github/workflows/transform-rules.yml delete mode 100644 data/example.config delete mode 100644 data/example.csv create mode 100644 rules/example/Example/rule_1.yml delete mode 100644 scripts/csv_sanity_check.sh delete mode 100644 scripts/get_config_updates.sh diff --git a/.github/workflows/transform-rules.yml b/.github/workflows/transform-rules.yml new file mode 100644 index 0000000..b8103c9 --- /dev/null +++ b/.github/workflows/transform-rules.yml @@ -0,0 +1,20 @@ +name: Transform Rules +on: + push: + paths: + - 'rules/**' + +jobs: + transform-rules: + name: Transform rules content + runs-on: ubuntu-latest + permissions: + contents: write + steps: + - uses: actions/checkout@v3 + - name: Transform rules + id: transform + uses: jpower432/trestle-bot/actions/rules-transform@bug/single-rule-failure + with: + rules_view_path: "rules/" + file_pattern: "*.json,rules/*" \ No newline at end of file diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index b6692b9..3c0737b 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -7,7 +7,7 @@ on: paths: - 'component-definitions/**' - 'markdown/components/**' - - 'data/**' + jobs: test: name: Evaluate components @@ -26,8 +26,6 @@ jobs: markdown_path: "markdown/components" oscal_model: "compdef" check_only: true - - name: CSV sanity check - run: make check-csv call-autofix: needs: [test] diff --git a/Makefile b/Makefile index f7faf0e..00a8f35 100644 --- a/Makefile +++ b/Makefile @@ -18,19 +18,6 @@ update-subtree: ## Component Definition Custom tasks ############################################################################ -# $1 - config path -define update-cd -echo $(1) -trestle task csv-to-oscal-cd -c $(1); -endef - -update-cds: - @source $(SCRIPTS_DIR)/trestle.sh && $(foreach f,$(CONFIGS),$(call update-cd,$(f))) -.PHONY: update-cd - -check-csv: - @bash scripts/csv_sanity_check.sh - trestlebot-install: @python3 -m pip install --upgrade pip setuptools && python3 -m pip install -r requirements.txt .PHONY: trestlebot-install \ No newline at end of file diff --git a/data/example.config b/data/example.config deleted file mode 100644 index 6279eca..0000000 --- a/data/example.config +++ /dev/null @@ -1,7 +0,0 @@ -[task.csv-to-oscal-cd] - -title = Component definition for Example -version = 1.0 -csv-file = data/example.csv -output-dir = component-definitions/example -output-overwrite = true \ No newline at end of file diff --git a/data/example.csv b/data/example.csv deleted file mode 100644 index b2b5ac7..0000000 --- a/data/example.csv +++ /dev/null @@ -1,3 +0,0 @@ -$$Component_Title,$$Component_Description,$$Component_Type,$$Rule_Id,$$Rule_Description,$Parameter_Id,$Parameter_Description,$Parameter_Value_Alternatives,$Parameter_Value_Default,$$Profile_Source,$$Profile_Description,$$Control_Id_List,Check_Id,Check_Description,$$Namespace -A human readable name for the component.,A description of the component including information about its function.,A category describing the purpose of the component. ALLOWED VALUES interconnection:software:hardware:service:physical:process-procedure:plan:guidance:standard:validation,A textual label that uniquely identifies a policy (desired state) that can be used to reference it elsewhere in this or other documents.,A description of the policy (desired state) including information about its purpose and scope.,A textual label that uniquely identifies the parameter associated with that policy (desired state) or controls implemented by the policy (desired state).,A description of the parameter including the purpose and use of the parameter.,ONLY for the policy (desired state) parameters: A value or set of values the parameter can take. The catalog parameters values are defined in the catalog. ,"A value recommended by Compliance Team in this profile for the parameter of the control or policy (desired state). If a CIS-benchmark exists, the default default could be the CIS-benchmark recommended value.",A URL reference to the source catalog or profile for which this component is implementing controls for. A profile designates a selection and configuration of controls from one or more catalogs.,A description of the profile.,A list of textual labels that uniquely identify the controls or statements that the component implements.,A textual label that uniquely identifies a check of the policy (desired state) that can be used to reference it elsewhere in this or other documents.,A description of the check of the policy (desired state) including the method (interview or examine or test) and procedure details.,"A namespace qualifying the property name. This allows different organizations to associate distinct semantics with the same name. Used in conjunction with ""class"" as the ontology concept. " -Example,Example Application,service,Test-rule_001,Ensure all of the services are running these tests,,,,,profiles/fedramp_rev5_high/profile.json,FedRAMP REV5 High Baseline,ac-1,,,http://ibm.github.io/compliance-trestle/schemas/oscal/cd diff --git a/rules/example/Example/rule_1.yml b/rules/example/Example/rule_1.yml new file mode 100644 index 0000000..50b6de5 --- /dev/null +++ b/rules/example/Example/rule_1.yml @@ -0,0 +1,17 @@ +x-trestle-rule-info: + name: Test-rule_001 + description: Ensure all of the services are running these tests + parameter: + name: prm_1 + description: prm_1 description + alternative-values: {'default': '5%', '5pc': '5%', '10pc': '10%', '15pc': '15%', '20pc': '20%'} + default-value: '5%' + profile: + description: FedRAMP REV5 High Baseline + href: profiles/fedramp_rev5_high/profile.json + include-controls: + - id: ac-1 +x-trestle-component-info: + name: Example + description: Example Application + type: service \ No newline at end of file diff --git a/scripts/csv_sanity_check.sh b/scripts/csv_sanity_check.sh deleted file mode 100644 index bd18678..0000000 --- a/scripts/csv_sanity_check.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!/bin/bash - -CHANGES=$(git diff-tree --no-commit-id --name-only -r HEAD) - -json_changed=false -csv_changed=false - -json1=$"^component-definitions/" -json2=$"\.json$" - -csv1=$"^data/" -csv2=$"\.csv$" - -for val in "${CHANGES[@]}" ; do - if [[ $val =~ $json1 && $val =~ $json2 ]]; then - json_changed=true - fi - - if [[ $val =~ $csv1 && $val =~ $csv2 ]]; then - csv_changed=true - fi -done - -if [[ $csv_changed == true && $json_changed == false ]]; then - echo "CSV file(s) were changed, but no changes to JSON detected. Run make update-cds." - exit 1 -fi \ No newline at end of file diff --git a/scripts/get_config_updates.sh b/scripts/get_config_updates.sh deleted file mode 100644 index 4ca14d3..0000000 --- a/scripts/get_config_updates.sh +++ /dev/null @@ -1,22 +0,0 @@ -#!/bin/bash - -CHANGES=$(git diff-tree --no-commit-id --name-only -r HEAD) - -csv1=$"^data/" -csv2=$"\.csv$" - -# Define the new file extension -new_extension=".config" - -declare -a changed_csvs - -for val in "${CHANGES[@]}" ; do - if [[ $val =~ $csv1 && $val =~ $csv2 ]]; then - file_name_without_ext="${val%.*}" - new_file_name="$file_name_without_ext$new_extension" - changed_csvs+=("$new_file_name") - fi -done - - -echo "${changed_csvs[@]}" \ No newline at end of file