feat(actions): adds support for rules in YAML format

Removes CSV based rule examples Removes CSV automation for rules Adds action to auto-transform adhoc and when the YAML is edited Adds a concurrency group to make sure branch modifying worflow are not run that the same time Signed-off-by: Jennifer Power <[email protected]>
RedHatProductSecurity · Oct 13, 2023 · d93c683 · d93c683
1 parent 27bed2f
commit d93c683
Show file tree

Hide file tree

Showing 14 changed files with 135 additions and 90 deletions.
diff --git a/.github/workflows/autofix-cd.yml b/.github/workflows/autofix-cd.yml
@@ -8,8 +8,9 @@ on:
         type: string
 
 
+# Using concurrency to ensure any branch-modifying workflows are not run at the same time.
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: sync-${{ inputs.branch }}
   cancel-in-progress: true
 
 jobs:

diff --git a/.github/workflows/linters.yml b/.github/workflows/linters.yml
@@ -4,7 +4,8 @@ name: MegaLinter
 on:
   push:
   pull_request:
-    branches: main
+    branches: 
+    - main
 
 concurrency:
   group: ${{ github.ref }}-${{ github.workflow }}

diff --git a/.github/workflows/manual-transform.yml b/.github/workflows/manual-transform.yml
@@ -0,0 +1,11 @@
+name: Run transform adhoc
+
+on:
+  workflow_dispatch:
+
+jobs:
+  call-transform:
+    uses: ./.github/workflows/transform-rules.yml
+    with:
+      branch: ${{ github.ref_name }}
+    secrets: inherit
diff --git a/.github/workflows/transform-on-push.yml b/.github/workflows/transform-on-push.yml
@@ -0,0 +1,18 @@
+name: Transform Rules On Push
+
+# Only run on pushes to branches other than main. Pushes to main should be
+# a result of a pull request merge. The transform rules operation is not idempotent
+# and the OSCAL JSON will be modified each time it is run.
+on:
+  push:
+    branches-ignore:
+      - main
+    paths:
+      - 'rules/**'
+
+jobs:
+  call-transform:
+    uses: ./.github/workflows/transform-rules.yml
+    with:
+      branch: ${{ github.ref_name }}
+    secrets: inherit
diff --git a/.github/workflows/transform-rules.yml b/.github/workflows/transform-rules.yml
@@ -0,0 +1,42 @@
+name: Transform Rules
+
+on:
+  workflow_call:
+    inputs:
+      branch:
+        required: true
+        type: string
+
+# Using concurrency to ensure any branch-modifying workflows are not run at the same time.
+concurrency:
+  group: sync-${{ inputs.branch }}
+  cancel-in-progress: true
+
+jobs:
+  transform-rules:
+    name: Transform rules content
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Generate app token
+        uses: tibdex/github-app-token@v1
+        id: get_installation_token
+        with: 
+          app_id: ${{ secrets.APP_ID }}
+          private_key: ${{ secrets.PRIVATE_KEY }}
+          permissions: >-
+            {"contents": "write"}
+      - name: Clone
+        uses: actions/checkout@v3
+        with:
+          token: ${{ steps.get_installation_token.outputs.token }}
+      - name: Transform rules
+        id: transform
+        uses: jpower432/trestle-bot/actions/rules-transform@bug/single-rule-failure
+        with:
+          rules_view_path: "rules/"
+          file_pattern: "*.json,rules/*"
+          branch: ${{ inputs.branch }}
+          commit_user_name: "trestle-bot[bot]"
+          commit_user_email: "136850459+trestle-bot[bot]@users.noreply.github.com"
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
@@ -1,13 +1,12 @@
 name: Evaluate component definitions
 on:
   pull_request:
-    types: [ opened, ready_for_review, reopened, synchronize ]
     branches:
       - main
     paths:
       - 'component-definitions/**'
       - 'markdown/components/**'
-      - 'data/**'
+
 jobs:
   test:
     name: Evaluate components
@@ -17,21 +16,20 @@ jobs:
     steps:
       - name: Clone
         uses: actions/checkout@v3
-        with:
-          ref:  ${{ github.head_ref }}
       - name: Check components
         id: check-components
         uses: RedHatProductSecurity/[email protected]
         with:
           markdown_path: "markdown/components"
           oscal_model: "compdef"
           check_only: true
-      - name: CSV sanity check 
-        run: make check-csv
 
+  # Only autofix if the test job fails and the PR is from the same repo
   call-autofix:
     needs: [test]
-    if: ${{ always() && contains(needs.*.result, 'failure') }}
+    if: |
+      always() && contains(needs.*.result, 'failure')
+      && github.event.pull_request.base.repo.url == github.event.pull_request.head.repo.url
     uses: ./.github/workflows/autofix-cd.yml
     with:
       branch: ${{ github.head_ref }}

diff --git a/.gitignore b/.gitignore
@@ -161,3 +161,6 @@ cython_debug/
 
 ## Trestle Specifc
 .trestle/cache/
+
+
+.vscode/
diff --git a/Makefile b/Makefile
@@ -18,19 +18,6 @@ update-subtree:
 ## Component Definition Custom tasks
 ############################################################################
 
-# $1 - config path
-define update-cd
-echo $(1)
-trestle task csv-to-oscal-cd -c $(1);
-endef
-
-update-cds:
-	@source $(SCRIPTS_DIR)/trestle.sh && $(foreach f,$(CONFIGS),$(call update-cd,$(f)))
-.PHONY: update-cd
-
-check-csv:
-	@bash scripts/csv_sanity_check.sh
-
 trestlebot-install:
 	@python3 -m pip install --upgrade pip setuptools && python3 -m pip install -r requirements.txt
 .PHONY: trestlebot-install
diff --git a/component-definitions/example/component-definition.json b/component-definitions/example/component-definition.json
@@ -1,46 +1,72 @@
 {
   "component-definition": {
-    "uuid": "3f0a6f01-e123-4c9e-8d17-267a831d4471",
+    "uuid": "86378b1f-7ba6-4cac-bdd4-3b52b13f5132",
     "metadata": {
-      "title": "Component definition for Example",
-      "last-modified": "2023-05-08T21:56:09.855332+00:00",
+      "title": "Component definition for example",
+      "last-modified": "2023-10-13T14:07:08.049847+00:00",
       "version": "1.0",
       "oscal-version": "1.0.4"
     },
     "components": [
       {
-        "uuid": "49e7cc5c-395a-4ea9-a8dd-dc678515ae7b",
+        "uuid": "5752e82b-8d71-4d35-898c-e8aa5c474ed7",
         "type": "service",
         "title": "Example",
         "description": "Example Application",
         "props": [
           {
             "name": "Rule_Id",
-            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd",
+            "ns": "https://ibm.github.io/compliance-trestle/schemas/oscal",
             "value": "Test-rule_001",
             "remarks": "rule_set_0"
           },
           {
             "name": "Rule_Description",
-            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd",
+            "ns": "https://ibm.github.io/compliance-trestle/schemas/oscal",
             "value": "Ensure all of the services are running these tests",
             "remarks": "rule_set_0"
+          },
+          {
+            "name": "Parameter_Id",
+            "ns": "https://ibm.github.io/compliance-trestle/schemas/oscal",
+            "value": "prm_1",
+            "remarks": "rule_set_0"
+          },
+          {
+            "name": "Parameter_Description",
+            "ns": "https://ibm.github.io/compliance-trestle/schemas/oscal",
+            "value": "prm_1 description",
+            "remarks": "rule_set_0"
+          },
+          {
+            "name": "Parameter_Value_Alternatives",
+            "ns": "https://ibm.github.io/compliance-trestle/schemas/oscal",
+            "value": "{'default': '5%', '5pc': '5%', '10pc': '10%', '15pc': '15%', '20pc': '20%'}",
+            "remarks": "rule_set_0"
           }
         ],
         "control-implementations": [
           {
-            "uuid": "66666ab1-f02c-4bb2-a64b-0f90f73910a5",
+            "uuid": "95f1cd02-e507-44b7-9ef7-22c5b4c557ad",
             "source": "profiles/fedramp_rev5_high/profile.json",
             "description": "FedRAMP REV5 High Baseline",
+            "set-parameters": [
+              {
+                "param-id": "prm_1",
+                "values": [
+                  "5%"
+                ]
+              }
+            ],
             "implemented-requirements": [
               {
-                "uuid": "cae26ab2-9172-450d-9525-351195bc5879",
+                "uuid": "ae9abfdf-ac4a-4dcb-bf53-ca91e3b86971",
                 "control-id": "ac-1",
                 "description": "",
                 "props": [
                   {
                     "name": "Rule_Id",
-                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd",
+                    "ns": "https://ibm.github.io/compliance-trestle/schemas/oscal",
                     "value": "Test-rule_001"
                   },
                   {

diff --git a/data/example.config b/data/example.config
diff --git a/data/example.csv b/data/example.csv
diff --git a/rules/example/Example/rule_1.yml b/rules/example/Example/rule_1.yml
@@ -0,0 +1,17 @@
+x-trestle-rule-info:
+  name: Test-rule_001
+  description: Ensure all of the services are running these tests
+  parameter:
+    name: prm_1
+    description: prm_1 description
+    alternative-values: {'default': '5%', '5pc': '5%', '10pc': '10%', '15pc': '15%', '20pc': '20%'}
+    default-value: '5%'
+  profile:
+    description: FedRAMP REV5 High Baseline
+    href: profiles/fedramp_rev5_high/profile.json
+    include-controls:
+      - id: ac-1
+x-trestle-component-info:
+  name: Example
+  description: Example Application
+  type: service
diff --git a/scripts/csv_sanity_check.sh b/scripts/csv_sanity_check.sh
diff --git a/scripts/get_config_updates.sh b/scripts/get_config_updates.sh
Original file line number	Diff line number	Diff line change
Expand Up		@@ -161,3 +161,6 @@ cython_debug/

		## Trestle Specifc
		.trestle/cache/


		.vscode/