diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml deleted file mode 100644 index 695d77c..0000000 --- a/.github/workflows/dependency-review.yml +++ /dev/null @@ -1,28 +0,0 @@ -# Dependency Review Action -# -# This Action will scan dependency manifest files that change as part of a Pull Request, -# surfacing known-vulnerable versions of the packages declared or updated in the PR. -# Once installed, if the workflow run is marked as required, -# PRs introducing known-vulnerable packages will be blocked from merging. -# -# Source repository: https://github.com/actions/dependency-review-action -name: 'Dependency Review' -on: [pull_request] - -permissions: - contents: read - -jobs: - dependency-review: - runs-on: ubuntu-latest - steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit - disable-telemetry: true - - - name: 'Checkout Repository' - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 - - name: 'Dependency Review' - uses: actions/dependency-review-action@6c5ccdad469c9f8a2996bfecaec55a631a347034 # v3.1.0 diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml deleted file mode 100644 index 3ab1ecc..0000000 --- a/.github/workflows/scorecards.yml +++ /dev/null @@ -1,77 +0,0 @@ -# This workflow uses actions that are not certified by GitHub. They are provided -# by a third-party and are governed by separate terms of service, privacy -# policy, and support documentation. - -name: Scorecard supply-chain security -on: - # For Branch-Protection check. Only the default branch is supported. See - # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection - branch_protection_rule: - # To guarantee Maintained check is occasionally updated. See - # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained - schedule: - - cron: '20 7 * * 2' - push: - branches: ["main"] - -# Declare default permissions as read only. -permissions: read-all - -jobs: - analysis: - name: Scorecard analysis - runs-on: ubuntu-latest - permissions: - # Needed to upload the results to code-scanning dashboard. - security-events: write - # Needed to publish results and get a badge (see publish_results below). - id-token: write - contents: read - actions: read - - steps: - - name: Harden Runner - uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 - with: - egress-policy: audit - disable-telemetry: true - - - name: "Checkout code" - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 - with: - persist-credentials: false - - - name: "Run analysis" - uses: ossf/scorecard-action@08b4669551908b1024bb425080c797723083c031 # v2.2.0 - with: - results_file: results.sarif - results_format: sarif - # (Optional) "write" PAT token. Uncomment the `repo_token` line below if: - # - you want to enable the Branch-Protection check on a *public* repository, or - # - you are installing Scorecards on a *private* repository - # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat. - # repo_token: ${{ secrets.SCORECARD_TOKEN }} - - # Public repositories: - # - Publish results to OpenSSF REST API for easy access by consumers - # - Allows the repository to include the Scorecard badge. - # - See https://github.com/ossf/scorecard-action#publishing-results. - # For private repositories: - # - `publish_results` will always be set to `false`, regardless - # of the value entered here. - publish_results: true - - # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF - # format to the repository Actions tab. - - name: "Upload artifact" - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 - with: - name: SARIF file - path: results.sarif - retention-days: 5 - - # Upload the results to GitHub's code scanning dashboard. - - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8 - with: - sarif_file: results.sarif diff --git a/api/config/appstudio.redhat.com_enterprisecontractpolicies.yaml b/api/config/appstudio.redhat.com_enterprisecontractpolicies.yaml index e243b43..c41b1b7 100644 --- a/api/config/appstudio.redhat.com_enterprisecontractpolicies.yaml +++ b/api/config/appstudio.redhat.com_enterprisecontractpolicies.yaml @@ -85,6 +85,22 @@ spec: items: description: Source defines policies and data that are evaluated together properties: + config: + description: Config specifies which policy rules are included, or excluded, from the provided policy source urls. + properties: + exclude: + description: Exclude is a set of policy exclusions that, in case of failure, do not block the success of the outcome. + items: + type: string + type: array + x-kubernetes-list-type: set + include: + description: Include is a set of policy inclusions that are added to the policy evaluation. These take precedence over policy exclusions. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object data: description: List of go-getter style policy data source urls items: diff --git a/api/v1alpha1/enterprisecontractpolicy_types.go b/api/v1alpha1/enterprisecontractpolicy_types.go index 38d44b6..1641806 100644 --- a/api/v1alpha1/enterprisecontractpolicy_types.go +++ b/api/v1alpha1/enterprisecontractpolicy_types.go @@ -61,9 +61,29 @@ type Source struct { // +optional // +kubebuilder:validation:Type:=object RuleData *extv1.JSON `json:"ruleData,omitempty"` + // Config specifies which policy rules are included, or excluded, from the + // provided policy source urls. + // +optional + // +kubebuilder:validation:Type:=object + Config *SourceConfig `json:"config,omitempty"` +} + +// SourceConfig specifies config options for a policy source. +type SourceConfig struct { + // Exclude is a set of policy exclusions that, in case of failure, do not block + // the success of the outcome. + // +optional + // +listType:=set + Exclude []string `json:"exclude,omitempty"` + // Include is a set of policy inclusions that are added to the policy evaluation. + // These take precedence over policy exclusions. + // +optional + // +listType:=set + Include []string `json:"include,omitempty"` } -// EnterpriseContractPolicyConfiguration configuration of modifications to policy evaluation +// EnterpriseContractPolicyConfiguration configuration of modifications to policy evaluation. +// DEPRECATED: Use the config for a policy source instead. type EnterpriseContractPolicyConfiguration struct { // Exclude set of policy exclusions that, in case of failure, do not block // the success of the outcome. diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go index cd7cd4d..e9afd48 100644 --- a/api/v1alpha1/zz_generated.deepcopy.go +++ b/api/v1alpha1/zz_generated.deepcopy.go @@ -194,6 +194,11 @@ func (in *Source) DeepCopyInto(out *Source) { *out = new(v1.JSON) (*in).DeepCopyInto(*out) } + if in.Config != nil { + in, out := &in.Config, &out.Config + *out = new(SourceConfig) + (*in).DeepCopyInto(*out) + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Source. @@ -205,3 +210,28 @@ func (in *Source) DeepCopy() *Source { in.DeepCopyInto(out) return out } + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *SourceConfig) DeepCopyInto(out *SourceConfig) { + *out = *in + if in.Exclude != nil { + in, out := &in.Exclude, &out.Exclude + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.Include != nil { + in, out := &in.Include, &out.Include + *out = make([]string, len(*in)) + copy(*out, *in) + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SourceConfig. +func (in *SourceConfig) DeepCopy() *SourceConfig { + if in == nil { + return nil + } + out := new(SourceConfig) + in.DeepCopyInto(out) + return out +} diff --git a/config/crd/bases/appstudio.redhat.com_enterprisecontractpolicies.yaml b/config/crd/bases/appstudio.redhat.com_enterprisecontractpolicies.yaml index e243b43..c41b1b7 100644 --- a/config/crd/bases/appstudio.redhat.com_enterprisecontractpolicies.yaml +++ b/config/crd/bases/appstudio.redhat.com_enterprisecontractpolicies.yaml @@ -85,6 +85,22 @@ spec: items: description: Source defines policies and data that are evaluated together properties: + config: + description: Config specifies which policy rules are included, or excluded, from the provided policy source urls. + properties: + exclude: + description: Exclude is a set of policy exclusions that, in case of failure, do not block the success of the outcome. + items: + type: string + type: array + x-kubernetes-list-type: set + include: + description: Include is a set of policy inclusions that are added to the policy evaluation. These take precedence over policy exclusions. + items: + type: string + type: array + x-kubernetes-list-type: set + type: object data: description: List of go-getter style policy data source urls items: diff --git a/docs/modules/ROOT/pages/reference.adoc b/docs/modules/ROOT/pages/reference.adoc index f582091..73e37b8 100644 --- a/docs/modules/ROOT/pages/reference.adoc +++ b/docs/modules/ROOT/pages/reference.adoc @@ -44,7 +44,7 @@ Appears In: xref:{anchor_prefix}-github-com-enterprise-contract-enterprise-contr [id="{anchor_prefix}-github-com-enterprise-contract-enterprise-contract-controller-api-v1alpha1-enterprisecontractpolicyconfiguration"] === EnterpriseContractPolicyConfiguration -EnterpriseContractPolicyConfiguration configuration of modifications to policy evaluation +EnterpriseContractPolicyConfiguration configuration of modifications to policy evaluation. DEPRECATED: Use the config for a policy source instead. [quote] Appears In: xref:{anchor_prefix}-github-com-enterprise-contract-enterprise-contract-controller-api-v1alpha1-enterprisecontractpolicyspec[$$EnterpriseContractPolicySpec$$] @@ -133,6 +133,23 @@ Appears In: xref:{anchor_prefix}-github-com-enterprise-contract-enterprise-contr | *`policy`* __string array__ | List of go-getter style policy source urls | *`data`* __string array__ | List of go-getter style policy data source urls | *`ruleData`* __JSON__ | Arbitrary rule data that will be visible to policy rules +| *`config`* __xref:{anchor_prefix}-github-com-enterprise-contract-enterprise-contract-controller-api-v1alpha1-sourceconfig[$$SourceConfig$$]__ | Config specifies which policy rules are included, or excluded, from the provided policy source urls. +|=== + + +[id="{anchor_prefix}-github-com-enterprise-contract-enterprise-contract-controller-api-v1alpha1-sourceconfig"] +=== SourceConfig + +SourceConfig specifies config options for a policy source. + +[quote] +Appears In: xref:{anchor_prefix}-github-com-enterprise-contract-enterprise-contract-controller-api-v1alpha1-source[$$Source$$] + +[cols="25a,75a", options="header"] +|=== +| Field | Description +| *`exclude`* __string array__ | Exclude is a set of policy exclusions that, in case of failure, do not block the success of the outcome. +| *`include`* __string array__ | Include is a set of policy inclusions that are added to the policy evaluation. These take precedence over policy exclusions. |===