docker/metadata-action sets this label from github.sha, which for
workflow_run events is always the default branch's tip, not the
branch that actually triggered the build. entrypoint.sh's update
check reads this label, so dev_27 images always looked stale
against themselves. Override it with the resolved head_sha.
entrypoint.sh always checked ghcr's :latest manifest for a newer
build, so non-main images (e.g. dev_27) incorrectly reported an
update available since their SHA never matches main's latest. Bake
the image's tag in at build time and check against that tag instead.
entrypoint.sh always checked ghcr's :latest manifest for a newer
build, so non-main images (e.g. dev_27) incorrectly reported an
update available since their SHA never matches main's latest. Bake
the image's tag in at build time and check against that tag instead.
Push-triggered workflows use the branch's own copy, not main's, so
this was needed on dev_27 itself for the container-publish lint gate
to find a matching run.
* fix: spinner text info for baseline migration
* fix: update CURRENT_USER discovery
change method to use the loginwindow.plist instead of console
* refactor: release string and format
* chore: correct reference to changelog
Issue #718
* refactor: configure logging to catch early CLI issues
* refactor: clarification and inclusion of custom rules
* refactor: correct platform overrides and adjust adoc/md output
* refactor: alias mobileconfig attribute to match yaml
* refactor: admin functions for release and new rule
* chore: lint cleanup and remove markdownlint
* chore(rule): correct validation issues
* chore: adjust spellcheck to main
* chore: correct spelling issues
* chore: update container build process
* chore: trigger container build on push to main
* chore: gate container build on lint and smoke tests
* chore: pin GitHub Actions to commit SHAs and update Node.js to 22 LTS
Pin all unpinned action references to immutable commit SHAs to prevent
supply chain attacks. Upgrade checkout/setup-node from v3 to v4 in
spellcheck workflow and bump Node.js from 20 (deprecated) to 22 LTS
in build_documentation workflow.
* chore: improve GitHub Actions workflow hygiene
- Pin cspell to 10.0.1 instead of @latest
- Add permissions: contents: read to spellcheck, cli-tests, and generate_baselines workflows
- Add concurrency group to generate_baselines to prevent race conditions on rapid pushes
- Add workflow_dispatch to generate_baselines and spellcheck
- Remove dead push-to-main trigger from labeler (labels PRs only)
- Add paths filter to label-sync pull_request_target trigger
- Remove redundant ref from generate_baselines checkout step
- Pin Python to 3.12.1 in cli-tests for consistency
- Remove unnecessary --user flag from pip install in lint workflow
* chore[deps]: update pillow dependency
* chore[rule]: sync enforcement info
issue #592
* chore[rule]: correct CIS ODV
issue #621
* chore[rule]: correct CIS ODV
issue #621
* refactor: filter out incomplete baselines
* feat: add tag mutation API to RuleLibrary
Stores source_file on Macsecurityrule (excluded from serialization) so
RuleLibrary.add_tag/remove_tag can write back to disk after filtering.
Each unique source file is written at most once to avoid redundant I/O
when the library spans multiple platform/version entries for the same rule.
* feat: add add_benchmark/remove_benchmark to RuleLibrary
Unlike tag mutations, benchmark entries are stored per OS version inside
the platforms dict, so both methods group rules by source file and apply
all version mutations to a single canonical object before writing to avoid
clobbering version entries not covered by the first object encountered.
* fix: switch RuleLibrary mutation write path to text-level patching
rule.to_yaml() was designed for custom/derived output and is lossy when
applied to source files — it flattens per-version CCE/STIG dicts and
renames canonical YAML keys (800-53r5 → nist_800_53r5). Replaced all
mutation method write calls with targeted text-level patching helpers
that modify only the specific lines that change, leaving the rest of
each source file untouched.
* chore: update workflow actions
* fix: include multiple mobileconfig payloads if defined in rule
using suggestion from @adrian-ib, changed the mobileconfig info build-out in the manifest to include multiple payloads if they exist
Issue #723
* chore: fix linting and spellcheck findings
* chore: update build action to recent releases
* fix: correct issue with granular profiles and add date
profiles are now generated with a create date in the description
Issue #678
* chore: updates to container build
add entrypoint that will check if latest container and alert the user if a new one is available
move container support files from project root
* chore: adjust to check for container SHA match
* chore: update container update message
* chore: cleanup progress bar messaging
* refactor: custom logo processing in guidance
when a custom logo file is defined at the CLI, it will be copied to the custom/images/ folder for reference in guidance generation.
- Pin cspell to 10.0.1 instead of @latest
- Add permissions: contents: read to spellcheck, cli-tests, and generate_baselines workflows
- Add concurrency group to generate_baselines to prevent race conditions on rapid pushes
- Add workflow_dispatch to generate_baselines and spellcheck
- Remove dead push-to-main trigger from labeler (labels PRs only)
- Add paths filter to label-sync pull_request_target trigger
- Remove redundant ref from generate_baselines checkout step
- Pin Python to 3.12.1 in cli-tests for consistency
- Remove unnecessary --user flag from pip install in lint workflow
Pin all unpinned action references to immutable commit SHAs to prevent
supply chain attacks. Upgrade checkout/setup-node from v3 to v4 in
spellcheck workflow and bump Node.js from 20 (deprecated) to 22 LTS
in build_documentation workflow.
* chore: update issue templates
* chore: update issue templates
* refactor: create EnforcementInfo class to support hierarchy
platforms with differing enforcement methods are now correctly captured and generated
* chore: re-add macOS 14 support for initial release
* refactor: split macsecurityrule into references, mobileconfig, and enforcement_info modules
Extracts reference submodels (NistReferences, DisaReferences, CisReferences,
bsiReferences, bzkReferences, hhsReferences, customReferences, References) into
references.py and mobileconfig model + XML rendering utilities into mobileconfig.py.
Consolidates duplicate _create_value_element/_create_static_value_element into a
single create_value_element function. Adds Google-style docstrings throughout and
widens ResultDef fields to accept "$ODV" on all three types.
* refactor: add runtime validation and fix schema issues
- Add @model_validator to ShellCheck, ShellFix, DefaultStateShell enforcing
that either shell or additional_info (or note) must be provided, and that
result is required when shell is present on ShellCheck
- Add OdvHint/OdvValidation models in odv.py and a @field_validator on
Macsecurityrule.odv to catch missing hint fields (e.g. datatype) at runtime
- Wrap Macsecurityrule construction in load_rules with ValidationError handler
so bad rules are logged and skipped rather than crashing the process
- Switch validate_rules to iter_errors so all failures per file are reported,
not just the first; improve error output with field path and fix log message
showing correct rules path; guard against missing id field with .get()
- Fix schema: move if/then/else out of properties in ddmDef, fix
declarationtype typo in conditional, move additionalProperties out of
properties on iOS and visionOS, add sfr to disa references, widen
anyOf constraints on check/fix/default_state to require shell or
additional_info, clean up redundant type+$ref on array entry,
update resultDef boolean to not allow $ODV
* feat: add remove_mscp_apple_release and standardize --version flag
Add mscp admin remove subcommand that removes a platform version from
mscp_data.yaml, all rule YAML files, and the JSON schema — the inverse
of mscp admin update. Also renames --new_version to --version on the
update subcommand for consistency.
* refactor: fix version datatype in removal and add success string to validate
* chore: lint cleanup
* fix: re-added missing imports
* removed fix blob from 26 and 14
* feat: add CLI smoke test workflow and --no-docs flag for guidance
Adds a GitHub Actions workflow that smoke-tests key CLI subcommands
(baseline, guidance, scap, admin validate) on every push/PR to dev_2.0.
Adds --no-docs flag to the guidance subcommand to skip asciidoctor/PDF/HTML
generation, allowing CI to test the guidance pipeline without requiring
the Ruby toolchain.
* refactor: adjust CLI tests
* fix: exit 1 when admin validate finds invalid YAML files
* refactor: rename collect_all_rules, fix -l listing, suppress admin spinner
- Rename Macsecurityrule.collect_all_rules -> collect_platform_rules to
reflect that it filters by a specific OS type and version, not everything
- Fix `baselines -l` to load rules via RuleLibrary.from_rules_dir() so
benchmarks from all platforms (iOS, visionOS) appear in the listing
- Add suppress_spinner flag to logging_config; set it in build_all_baselines
so the spinner is fully suppressed during bulk baseline generation
- Replace the suppressed yaspin object with a _NoOpSpinner shim so that
sp.ok(), sp.fail(), and sp.text assignments are silently swallowed
* perf: avoid repeated collect_platform_rules in admin baselines
Add a preloaded_rules kwarg to generate_baseline so callers can pass
pre-collected rules and skip the collect_platform_rules filesystem walk.
In build_all_baselines, load the full RuleLibrary once and slice it per
platform filtered to args.os_version, matching the original single-call
behavior but without re-reading the rules directory on every iteration.
Fixes duplicate rule_ids that appeared when filtering by platform alone
included rules from multiple OS versions.
Also fixes the absolute import of RuleLibrary introduced by the linter.
* chore[rule]: correct yaml linting
---------
Co-authored-by: Bob Gendler <robert.gendler@nist.gov>
- Implemented `script.py` for generating compliance scripts with Jinja2 templating and audit plist creation.
- Created `local_report.py` to generate local compliance reports in Excel and HTML formats, including pie chart visualizations.
- Developed `mapping.py` to update security rules with custom controls based on CSV input and generate baseline YAML files.
- Introduced `scap.py` for creating SCAP-compliant XML files, with support for different OS types and export formats.
