From 3632115c2f2fb38c998b94ee09cbcff91bf987de Mon Sep 17 00:00:00 2001 From: Dan Brodjieski Date: Tue, 16 Jun 2026 08:38:39 -0400 Subject: [PATCH] chore: update workflows --- .github/ISSUE_TEMPLATE/.bug_report.md.swp | Bin 0 -> 12288 bytes .github/ISSUE_TEMPLATE/bug_report.md | 50 +++ .github/ISSUE_TEMPLATE/feature-proposal.md | 40 +++ .github/cspell/cspell.json | 26 ++ .github/cspell/project-names.txt | 21 ++ .github/cspell/project-words.txt | 340 +++++++++++++++++++++ .github/workflows/build_documentation.yml | 53 ++++ .github/workflows/container-publish.yml | 83 +++++ src/mscp/data/includes/mscp-data.yaml | 2 +- 9 files changed, 614 insertions(+), 1 deletion(-) create mode 100644 .github/ISSUE_TEMPLATE/.bug_report.md.swp create mode 100644 .github/ISSUE_TEMPLATE/bug_report.md create mode 100644 .github/ISSUE_TEMPLATE/feature-proposal.md create mode 100644 .github/cspell/cspell.json create mode 100644 .github/cspell/project-names.txt create mode 100644 .github/cspell/project-words.txt create mode 100644 .github/workflows/build_documentation.yml create mode 100644 .github/workflows/container-publish.yml diff --git a/.github/ISSUE_TEMPLATE/.bug_report.md.swp b/.github/ISSUE_TEMPLATE/.bug_report.md.swp new file mode 100644 index 0000000000000000000000000000000000000000..a461c1395e075da96a7d25f8d563c77a724291f6 GIT binary patch literal 12288 zcmeI2y>A>v7>CCxfdGPvRIkqx=UBGSaU=)^ff6u@C5#U)38g)|``+!~-JR8Z__81p zsQDu5&AS@{4qnr#FS&Ada9z0@J{goU z)pp-<>Wy;EV11%oj^Ulr=+^fB&F$Uc8&_{`4-!AwH(YDu*30a)O!56_AR2hsz8EZzJSC1q1JOV<5Di2F(Lgj14MYRcz?n7R>IHER-JP3tIRC=GFnc}! ze`W>5#-f2}AR34UqJd~28i)p>foLEahz6p8|A7IC-_n17M2MdsMYH(*fByad&nJZV z4SWZV!MEUR@D=zHd;vZOAA)<}$H#^E0elaR!F})v_!u}~!4>d4xB#93f1elPFYqh) z1ssF>;4|eYh78D6ij1n z+Ud2?cv)T)VrglKhT6{FR(IIqco$0VzUw0E_4T|}MYMqW!(+{N1l!Hv7K0DIl6 zkU!`2@MH+X1s}=EQK2W6)~GI6S|$(LYLh}^2`wKS99#_TpvDsQr>I$@B zDeG2AOUm^v7WfIu(P&dqLTT_e$dgn>zeTcv3Q z5>H0hsT>!SKv726rj)HE)O@vuHyWuzK@9E6bQZLm{_hE>1UFyrjp#NTtFRz=OS~%P zE$!88q*K*|Mh#jm>8P8Cg*Wt+G)@!F7^I?v%%|Z@!HTt>v4bv$4E$kDL#hn7ZexFE z1&tinVOt)oMa+>eOKH@5T^#gGT&3EhRf9IsQHnh)nt6zJb|b{v+S<$F8skLZ9Kd9# zS5n2(u9Q_O ze%hvlkVrbInC%wz`=ZU*J$1?z+zz%$w&+zv2p41U3DF^I&P9#uC#X02h(#q!EV%}& J-JIY}`~$`4tZD!N literal 0 HcmV?d00001 diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md new file mode 100644 index 00000000..5a9d01c3 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -0,0 +1,50 @@ +--- +name: Bug report +about: Create a report to help us improve +title: '' +labels: '' +assignees: '' + +--- + + + +### Summary + +(Summarize the bug encountered concisely) + +### Steps to reproduce + +(How one can reproduce the issue - this is very important) + +### Operating System version + +(macOS Version and build) + +### Intel or Apple Silicon + +(Intel based process or Apple Silicon Mac) + +### What is the current *bug* behavior? + +(What actually happens) + +### What is the expected *correct* behavior? + +(What you should see instead) + +### Relevant logs and/or screenshots + +(Paste any relevant logs - please use code blocks (```) to format console output, logs, and code as it's tough to read otherwise.) + +### Output of checks + +(Paste any output that occurs with the bug) + +### Possible fixes + +(If you can, link to the line of code that might be responsible for the problem) diff --git a/.github/ISSUE_TEMPLATE/feature-proposal.md b/.github/ISSUE_TEMPLATE/feature-proposal.md new file mode 100644 index 00000000..cbf0922e --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature-proposal.md @@ -0,0 +1,40 @@ +--- +name: Feature Proposal +about: Suggest an idea for this project +title: '' +labels: '' +assignees: '' + +--- + +### Problem to solve + + + +### Intended users + + + +### Further details + + + +### Proposal + + + +### Documentation + + + +### Testing + + + +### What does success look like, and how can we measure that? + + + +### Links / references + + diff --git a/.github/cspell/cspell.json b/.github/cspell/cspell.json new file mode 100644 index 00000000..ea6e4a38 --- /dev/null +++ b/.github/cspell/cspell.json @@ -0,0 +1,26 @@ +{ + "version": "0.2", + "language": "en", + "allowCompoundWords": true, + "dictionaries": ["project-words", "project-names"], + "words": [], + "ignoreWords": [], + "ignorePaths": [ + "**/build/**", + "**/scripts/**", + "**/*.css", + "**/config/locales/**" + ], + "dictionaryDefinitions":[ + { + "name": "project-words", + "path": "./project-words.txt", + "addWords": true + }, + { + "name": "project-names", + "path": "./project-names.txt", + "addWords": true + } + ], +} \ No newline at end of file diff --git a/.github/cspell/project-names.txt b/.github/cspell/project-names.txt new file mode 100644 index 00000000..5bd80cae --- /dev/null +++ b/.github/cspell/project-names.txt @@ -0,0 +1,21 @@ +Brodjieski +CNSS +Colvin +DISA +Ekkehard +Elyse +Escobar +Gapinski +Gendler +Glemza +Golbig +Heiserman +Jamf +Kegerreis +LANL +Mahlman +Piñeyro +Stamerjohann +Jordy +Witteman +Zentral diff --git a/.github/cspell/project-words.txt b/.github/cspell/project-words.txt new file mode 100644 index 00000000..8f4a6410 --- /dev/null +++ b/.github/cspell/project-words.txt @@ -0,0 +1,340 @@ +addressbook +adminhostinfo +adoc +adoc +ahlt +AIOS +airprint +alacarte +allowi +amfi +Anyof +apachectl +apfs +APFS +apos +APPL +appleid +applepay +applicationaccess +appstore +asciidoctor +aslmanager +auditd +AUDITD +auditreduce +authorizationdb +autologin +autologoff +autologout +blankbd +blankcd +blankdvd +bluray +bootout +byoad +caldav +carddav +CCID +ccis +CERTDOMAIN +certificatetransparency +channeltimeout +chgrp +cisv +clientalivecountmax +clientaliveinterval +cmmc +cnssi +cnssi +collab +COMSEC +conferenceroomdisplay +configarray +configfiles +configurationprofile +configurator +contentfilter +controlcenter +coreservices +cref +csrutil +cupsctl +declarationtype +deidentification +desktopservices +destroyfvkeyonstandby +disa +diskmanagement +diskutil +displaysleep +docsub +doctitle +docver +dontAllowFDEDisable +drwx +drwxr +dseditgroup +dslocal +dvdram +ecdh +elif +ENDCONFIG +energysaver +esac +esim +EXEMPTGROUP +exfiltration +facetime +familycontrols +fdesetup +filevault +fips +FIPS +firmwarepasswd +FISMA +FPKI +garageband +genmoji +Genmoji +getaccountpolicies +getline +getnetworktimeserver +GPOS +gsub +harddisk +hibernatemode +highstandbythreshold +hmac +Hostbased +iacontrols +ibeacon +idprefix +idseparator +ifdef +ifndef +IMAP +IMAPS +ioreg +ISSO +kbdinteractiveauthentication +kcminit +labl +libexec +libraryvalidation +listallnetworkservices +locationd +locationmenu +Lockdown +logingracetime +loginitems +loginwindow +Loginwindow +loginwindowtext +lpadmin +lpstat +macsec +mcxloginscripts +mcxrefresh +mdmclient +minfree +Mirroing +mobileconfig +mobiledevice +motionapp +mscp +multifactor +Multifactor +networksetup +networkusagerules +newsyslog +nfsd +nistp +nofooter +nologin +nonlocal +noout +notenforcegroup +notificationsettings +notitle +nsmap +ntlm +nvram +OCSP +opendirectory +OPORDs +opticid +osascript +OSCP +osxserver +OTAPKI +passwordauthentication +passwordpolicy +pathlist +pdflogo +PEAP +permitrootlogin +persourcepenalties +pfctl +pgrep +pkcs +pkcs +PKINIT +plutil +pmset +powernap +ppid +PPPC +praudit +Preboot +Prefs +privs +psso +PSSO +pwpolicy +pydantic +pyyaml +reauthentication +Remediator +rootok +rstrip +rtfd +ruser +sandboxing +scap +scep +screencapture +screensharing +sectnums +serveralivecountmax +serveraliveinterval +setaccountpolicies +setallowsigned +setallowsignedapp +setglobalstate +setloggingopt +setnetworkserviceenabled +setpasswd +setpolicy +setremoteappleevents +setremotelogin +shareddefaults +shareddeviceconfiguration +sharingd +shellcommand +SHOWFULLNAME +SIPRNET +siri +Siri +smartcard +Smartcard +smartcards +Smartcards +SMIME +sntp +socketfilterfw +softwareupdate +spctl +spoofable +SSDP +standbydelayhigh +standbydelaylow +startupdisk +stig +stylesdir +subscribedcalendar +sysadminctl +syscall +SYSCALL +syspolicy +systemmigration +systempolicy +systempreferences +systemsettings +systemsetup +Systemsetup +systemuiserver +textutil +tftpd +themesdir +timemachine +toclevels +touchid +touristd +tvremote +UAMDM +uiagent +ulify +universalaccess +unusedconnectiontimeout +uucp +UUCP +uwtmp +venv +visionos +vulndiscussion +waivable +webcontent +womp +wvous +xattrname +xccdf +XCCDF +xlwt +xprotect +Xprotect +xrefstyle +xsan +YARA +Informatiebeveiliging +Maatregelenset +Nederlandse +nlmapgov +NLMAPGOV +Overheid +Sonoma +Sicherheit +Informationstechnik +OLED +WLAN +BKMG +chflags +chlk +cklb +DADMS +datefmt +DBCAC +DFARS +DISN +EUID +GOTS +IATT +IAVM +ICAM +idref +Intune +ISTIG +ITSM +LICEN +lxml +NIPR +nouchg +ocil +openpyxl +quotify +rgba +shdy +stigid +stigs +STIGS +sysprefs +uchg +VALUEONDEMAND +vared +xccdfrules +xtrace +ylabel +zipf +zparseopts +numpy +yaspin diff --git a/.github/workflows/build_documentation.yml b/.github/workflows/build_documentation.yml new file mode 100644 index 00000000..292785ec --- /dev/null +++ b/.github/workflows/build_documentation.yml @@ -0,0 +1,53 @@ +name: Build documentation site to nist-pages + +on: + push: + branches: ["nist-pages-docs"] + workflow_dispatch: + +permissions: + contents: write + pages: write + id-token: write + +concurrency: + group: "pages" + cancel-in-progress: false + +env: + BUILD_PATH: "." + SITE_PATH: "https://pages.nist.gov/" + BASE_PATH: "/macos_security" + +jobs: + build: + name: Build + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + - name: Setup PNPM + uses: pnpm/action-setup@v2 + with: + version: 8 + - name: Setup Node + uses: actions/setup-node@v4 + with: + node-version: "20" + cache: pnpm + cache-dependency-path: ${{ env.BUILD_PATH }}/pnpm-lock.yaml + - name: Install dependencies + run: pnpm install + working-directory: ${{ env.BUILD_PATH }} + - name: Build with Astro + run: | + pnpm astro build \ + --site "${{ env.SITE_PATH }}" \ + --base "${{ env.BASE_PATH }}" + working-directory: ${{ env.BUILD_PATH }} + - name: Upload to nist-pages + uses: peaceiris/actions-gh-pages@v3 + with: + github_token: ${{ secrets.GITHUB_TOKEN }} + publish_dir: ${{ env.BUILD_PATH }}/dist + publish_branch: nist-pages diff --git a/.github/workflows/container-publish.yml b/.github/workflows/container-publish.yml new file mode 100644 index 00000000..666aec09 --- /dev/null +++ b/.github/workflows/container-publish.yml @@ -0,0 +1,83 @@ +name: Build and Publish Container + +on: + workflow_dispatch: + +env: + REGISTRY: ghcr.io + IMAGE_NAME: ${{ github.repository_owner }}/mscp_2.0 + +jobs: + build-and-push: + runs-on: ubuntu-latest + + permissions: + contents: read + packages: write + id-token: write # required for cosign keyless signing via OIDC + attestations: write + + steps: + - name: Checkout repository + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + ref: dev_2.0 + + - name: Set up QEMU + uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 + + - name: Log in to GitHub Container Registry + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Extract Docker metadata + id: meta + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + tags: | + type=raw,value=dev_2.0 + type=sha,prefix=sha-,format=short + type=raw,value=latest + + - name: Build and push Docker image + id: build-push + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 + with: + context: . + platforms: linux/amd64,linux/arm64 + push: true + no-cache: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + cache-from: type=gha + cache-to: type=gha,mode=max + + - name: Install cosign + uses: sigstore/cosign-installer@f713795cb21599bc4e5c4b58cbad1da852d7eeb9 # v3 + + - name: Sign image with cosign (keyless via GitHub OIDC) + env: + DIGEST: ${{ steps.build-push.outputs.digest }} + TAGS: ${{ steps.meta.outputs.tags }} + COSIGN_REGISTRY_USERNAME: ${{ github.actor }} + COSIGN_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }} + run: | + images="" + for tag in ${TAGS}; do + images+="${tag}@${DIGEST} " + done + cosign sign --yes ${images} + + - name: Generate SBOM attestation + uses: actions/attest-build-provenance@92c65d2898f1f53cfdc910b962cecff86e7f8fcc # v1 + with: + subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + subject-digest: ${{ steps.build-push.outputs.digest }} + push-to-registry: true diff --git a/src/mscp/data/includes/mscp-data.yaml b/src/mscp/data/includes/mscp-data.yaml index b9d554a8..33a80213 100644 --- a/src/mscp/data/includes/mscp-data.yaml +++ b/src/mscp/data/includes/mscp-data.yaml @@ -1,6 +1,6 @@ --- mscp: - version: '2.1' + version: '2.0' build: 22 build_date: '2026-06-11' release_date: '2026-12-12'