Skip to content

Commit ec09319

Browse files
huiwangredhathuiwangredhat
committed
this is a test for sync_oscal_cac workflow
Signed-off-by: Sophia Wang <huiwang@redhat.com>
1 parent 90fa6a9 commit ec09319

File tree

6 files changed

+156
-50
lines changed

6 files changed

+156
-50
lines changed

‎.github/workflows/sync_oscal_cac.yml‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
name: Sync OSCAL content to CAC content
2+
permissions:
3+
contents: write
4+
pull-requests: read
5+
on:
6+
#push:
7+
# branches:
8+
# - master
9+
pull_request:
10+
types: [opened, synchronize, reopened]
11+
12+
jobs:
13+
check-oscal-content-update-sync-to-cac:
14+
runs-on: ubuntu-latest
15+
steps:
16+
# Step 1: Set up Python 3
17+
- name: Set up Python 3
18+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
19+
with:
20+
python-version: '3.9'
21+
# Step 2: Install Git
22+
- name: Install Git
23+
run: sudo apt-get update && sudo apt-get install -y git
24+
# Step 3: Checkout OSCAL repo
25+
- name: Checkout OSCAL repo
26+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
27+
with:
28+
repository: ${{ github.repository }}
29+
path: oscal-content
30+
- name: Get the commit message and PR number
31+
run: |
32+
# cd oscal-content
33+
# # Get the latest commit message
34+
# COMMIT_MSG=$(git log -1 --pretty=%B)
35+
# # Extract the PR number from the commit message (if it's a merge commit)
36+
# PR_NUMBER=$(echo "$COMMIT_MSG" | grep -oP '#\K\d+')
37+
# if [ -n "$PR_NUMBER" ]; then
38+
# echo "Found PR number: $PR_NUMBER"
39+
# echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV
40+
# echo "SKIP=false" >> $GITHUB_ENV
41+
# PR_INFO=$(curl -s "https://api.github.com/repos/${{ github.repository }}/pulls/${PR_NUMBER}")
42+
# # Extract PR title from the response
43+
# PR_TITLE=$(echo "$PR_INFO" | jq -r .title)
44+
# echo "PR Title: $PR_TITLE"
45+
# if [[ "$PR_TITLE" == *"Auto-generated PR from CAC"* ]]; then
46+
# echo "The PR comes from CAC content. The workflow of Sync OSCAL content to CAC will exit."
47+
# echo "Skipping further checks."
48+
# echo "SKIP=true" >> $GITHUB_ENV
49+
# fi
50+
# fi
51+
echo "PR_NUMBER=33" >> $GITHUB_ENV
52+
echo "SKIP=false" >> $GITHUB_ENV
53+
# Step 4: Get the access token for content write permission to CAC content
54+
- name: Get GitHub app token
55+
if: ${{ env.SKIP == 'false' }}
56+
uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
57+
id: app-token
58+
with:
59+
app-id: ${{ secrets.APP_ID }}
60+
private-key: ${{ secrets.PRIVATE_KEY }}
61+
owner: ${{ github.repository_owner }}
62+
repositories: |
63+
content
64+
oscal-content
65+
# Step 6: Dectect the updates of OSCAL content
66+
- name: Detect the changed files of the PR
67+
id: changed-files
68+
run: |
69+
repo=${{ github.repository }}
70+
# Fetch all pages of the files for the pull request
71+
url="repos/$repo/pulls/${{ env.PR_NUMBER }}/files"
72+
response=$(gh api "$url" --paginate)
73+
echo "$response" | jq -r '.[].filename' > filenames.txt
74+
echo "OUTPUT_SIZE=$(stat --printf="%s" filenames.txt)" >> $GITHUB_OUTPUT
75+
env:
76+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
77+
- name: Checkout CAC repo
78+
if: ${{ steps.changed-files.outputs.OUTPUT_SIZE != '0' }}
79+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
80+
with:
81+
repository: ComplianceAsCode/content
82+
path: cac-content
83+
token: ${{ steps.app-token.outputs.token }}
84+
fetch-depth: 0
85+
- name: Checkout complyscribe repo
86+
if: ${{ steps.changed-files.outputs.OUTPUT_SIZE != '0' }}
87+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
88+
with:
89+
repository: complytime/complyscribe
90+
path: complyscribe
91+
- name: Setup trestlebot
92+
if: ${{ steps.changed-files.outputs.OUTPUT_SIZE != '0' }}
93+
run: |
94+
cd complyscribe && python3 -m venv venv && source venv/bin/activate
95+
python3 -m pip install --no-cache-dir "poetry==1.7.1"
96+
poetry install
97+
# Step 8: Sync OSCAL content to CAC content
98+
- name: Sync OSCAL content to CAC content
99+
if: ${{ steps.changed-files.outputs.OUTPUT_SIZE != '0' }}
100+
run: |
101+
pr_number="${{ github.event.pull_request.number }}"
102+
cat filenames.txt
103+
cd complyscribe && source venv/bin/activate
104+
while IFS= read -r line; do
105+
if [[ "$line" == *catalogs* ]]; then
106+
policy_id=$(echo "$line" | cut -f2 -d"/")
107+
echo "sync oscal catalogs according to update of $line"
108+
echo "poetry run complyscribe sync-oscal-content catalog --repo-path ../oscal-content --committer-email "openscap-ci@gmail.com" --committer-name "openscap-ci" --branch "sync_oscal_pr$pr_number" --cac-content-root "$GITHUB_WORKSPACE/cac-content" --cac-policy-id "$policy_id""
109+
elif [[ "$line" == "profiles"* ]]; then
110+
policy_id=$(echo $line | cut -f2 -d"/" | cut -f2 -d"-")
111+
product=$(echo "$line" | cut -f2 -d"/" | cut -f1 -d"-")
112+
echo "sync oscal profiles according to update of $line"
113+
echo "poetry run complyscribe sync-oscal-content profile --repo-path ../oscal-content --committer-email "openscap-ci@gmail.com" --committer-name "openscap-ci" --branch "sync_oscal_pr$pr_number" --cac-content-root "$GITHUB_WORKSPACE/cac-content" --cac-policy-id "$policy_id" --product "$product""
114+
elif [[ "$line" == "component-definitions"* ]]; then
115+
product=$(echo "$line" | cut -f2 -d"/")
116+
profile=$(echo "$line" | cut -f3 -d"/" | cut -f2 -d"-")
117+
echo "sync oscal component-definitions according to update of $line"
118+
echo "poetry run complyscribe sync-oscal-content component-definition --repo-path ../oscal-content --committer-email "openscap-ci@gmail.com" --committer-name "openscap-ci" --branch "sync_oscal_pr$pr_number" --cac-content-root "$GITHUB_WORKSPACE/cac-content" --cac-policy-id "$policy_id" --product "$product" --oscal-profile "$profile""
119+
fi
120+
done < ../filenames.txt
121+
# Step 9: Create PR to CAC content
122+
- name: Create a Pull Request to OSCAL content
123+
if: ${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }}
124+
run: |
125+
cd cac-content
126+
BRANCH_NAME="sync_oscal_pr${{ env.PR_NUMBER }}"
127+
OWNER="ComplianceAsCode"
128+
REPO="content"
129+
if [[ "$(git branch --show-current)" == "$BRANCH_NAME" ]]; then
130+
# Check if the PR exists
131+
PR_EXISTS=$(gh pr list --repo $OWNER/$REPO \
132+
--head $BRANCH_NAME --state open --json id \
133+
| jq length)
134+
# Get commits between main and branch
135+
commits=$(git log master..$BRANCH_NAME --oneline)
136+
# If the PR does not exist and there are commits in the branch,
137+
# then create a PR for this branch.
138+
if [ "$PR_EXISTS" -gt 0 ]; then
139+
echo "PR $BRANCH_NAME already exists. Skipping PR creation."
140+
elif [ -z "$commits" ]; then
141+
echo "No commits between main and $BRANCH_NAME. Skipping PR creation."
142+
else
143+
echo "Creating PR for new branch: $BRANCH_NAME"
144+
gh pr create --repo $OWNER/$REPO \
145+
--title "Auto-generated PR from OSCAL ${{ env.PR_NUMBER }}" \
146+
--head "$BRANCH_NAME" \
147+
--base "master" \
148+
--body "This is an auto-generated PR from OSCAL ${{ env.PR_NUMBER }} updates"
149+
fi
150+
else
151+
echo "No branch $BRANCH_NAME. Skipping PR creation."
152+
fi
153+
env:
154+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
155+
156+

‎catalogs/cis_rhel10/catalog.json‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -2119,21 +2119,6 @@
21192119
"id": "cis_rhel10_4-1",
21202120
"title": "REPLACE_ME",
21212121
"controls": [
2122-
{
2123-
"id": "cis_rhel10_4-1.1",
2124-
"class": "CAC_IMPORT",
2125-
"title": "Ensure Nftables Is Installed (Automated)",
2126-
"props": [
2127-
{
2128-
"name": "label",
2129-
"value": "4.1.1"
2130-
},
2131-
{
2132-
"name": "sort-id",
2133-
"value": "cis_rhel10_4-01.01"
2134-
}
2135-
]
2136-
},
21372122
{
21382123
"id": "cis_rhel10_4-1.2",
21392124
"class": "CAC_IMPORT",

‎catalogs/cis_rhel9/catalog.json‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -29,27 +29,6 @@
2929
}
3030
]
3131
},
32-
{
33-
"id": "enable_authselect",
34-
"title": "REPLACE_ME",
35-
"controls": [
36-
{
37-
"id": "enable_authselect",
38-
"class": "CAC_IMPORT",
39-
"title": "Enable Authselect",
40-
"props": [
41-
{
42-
"name": "label",
43-
"value": "enable_authselect"
44-
},
45-
{
46-
"name": "sort-id",
47-
"value": "enable_authselect"
48-
}
49-
]
50-
}
51-
]
52-
},
5332
{
5433
"id": "cis_rhel9_1",
5534
"title": "REPLACE_ME",

‎component-definitions/rhel10/rhel10-anssi-high/component-definition.json‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -14,18 +14,6 @@
1414
"title": "rhel10",
1515
"description": "Red Hat Enterprise Linux 10",
1616
"props": [
17-
{
18-
"name": "Rule_Id",
19-
"ns": "https://oscal-compass.github.io/compliance-trestle/schemas/oscal/cd",
20-
"value": "kernel_config_strict_kernel_rwx",
21-
"remarks": "rule_set_00"
22-
},
23-
{
24-
"name": "Rule_Description",
25-
"ns": "https://oscal-compass.github.io/compliance-trestle/schemas/oscal/cd",
26-
"value": "Make the kernel text and rodata read-only",
27-
"remarks": "rule_set_00"
28-
},
2917
{
3018
"name": "Parameter_Id_0",
3119
"ns": "https://oscal-compass.github.io/compliance-trestle/schemas/oscal/cd",

‎profiles/rhel8-anssi-high/profile.json‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@
1313
"include-controls": [
1414
{
1515
"with-ids": [
16-
"r1",
1716
"r10",
1817
"r11",
1918
"r12",

‎profiles/rhel9-anssi-enhanced/profile.json‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@
1313
"include-controls": [
1414
{
1515
"with-ids": [
16-
"r1",
1716
"r10",
1817
"r11",
1918
"r12",

0 commit comments

Comments
 (0)