* fix: spinner text info for baseline migration
* fix: update CURRENT_USER discovery
change method to use the loginwindow.plist instead of console
* refactor: release string and format
* chore: correct reference to changelog
Issue #718
* refactor: configure logging to catch early CLI issues
* refactor: clarification and inclusion of custom rules
* refactor: correct platform overrides and adjust adoc/md output
* refactor: alias mobileconfig attribute to match yaml
* refactor: admin functions for release and new rule
* chore: lint cleanup and remove markdownlint
* chore(rule): correct validation issues
* chore: adjust spellcheck to main
* chore: correct spelling issues
* chore: update container build process
* chore: trigger container build on push to main
* chore: gate container build on lint and smoke tests
* chore: pin GitHub Actions to commit SHAs and update Node.js to 22 LTS
Pin all unpinned action references to immutable commit SHAs to prevent
supply chain attacks. Upgrade checkout/setup-node from v3 to v4 in
spellcheck workflow and bump Node.js from 20 (deprecated) to 22 LTS
in build_documentation workflow.
* chore: improve GitHub Actions workflow hygiene
- Pin cspell to 10.0.1 instead of @latest
- Add permissions: contents: read to spellcheck, cli-tests, and generate_baselines workflows
- Add concurrency group to generate_baselines to prevent race conditions on rapid pushes
- Add workflow_dispatch to generate_baselines and spellcheck
- Remove dead push-to-main trigger from labeler (labels PRs only)
- Add paths filter to label-sync pull_request_target trigger
- Remove redundant ref from generate_baselines checkout step
- Pin Python to 3.12.1 in cli-tests for consistency
- Remove unnecessary --user flag from pip install in lint workflow
* chore[deps]: update pillow dependency
* chore[rule]: sync enforcement info
issue #592
* chore[rule]: correct CIS ODV
issue #621
* chore[rule]: correct CIS ODV
issue #621
* refactor: filter out incomplete baselines
* feat: add tag mutation API to RuleLibrary
Stores source_file on Macsecurityrule (excluded from serialization) so
RuleLibrary.add_tag/remove_tag can write back to disk after filtering.
Each unique source file is written at most once to avoid redundant I/O
when the library spans multiple platform/version entries for the same rule.
* feat: add add_benchmark/remove_benchmark to RuleLibrary
Unlike tag mutations, benchmark entries are stored per OS version inside
the platforms dict, so both methods group rules by source file and apply
all version mutations to a single canonical object before writing to avoid
clobbering version entries not covered by the first object encountered.
* fix: switch RuleLibrary mutation write path to text-level patching
rule.to_yaml() was designed for custom/derived output and is lossy when
applied to source files — it flattens per-version CCE/STIG dicts and
renames canonical YAML keys (800-53r5 → nist_800_53r5). Replaced all
mutation method write calls with targeted text-level patching helpers
that modify only the specific lines that change, leaving the rest of
each source file untouched.
* chore: update workflow actions
* fix: include multiple mobileconfig payloads if defined in rule
using suggestion from @adrian-ib, changed the mobileconfig info build-out in the manifest to include multiple payloads if they exist
Issue #723
* chore: fix linting and spellcheck findings
* chore: update build action to recent releases
* fix: correct issue with granular profiles and add date
profiles are now generated with a create date in the description
Issue #678
* chore: updates to container build
add entrypoint that will check if latest container and alert the user if a new one is available
move container support files from project root
* chore: adjust to check for container SHA match
* chore: update container update message
* chore: cleanup progress bar messaging
* refactor: custom logo processing in guidance
when a custom logo file is defined at the CLI, it will be copied to the custom/images/ folder for reference in guidance generation.
- Implemented `script.py` for generating compliance scripts with Jinja2 templating and audit plist creation.
- Created `local_report.py` to generate local compliance reports in Excel and HTML formats, including pie chart visualizations.
- Developed `mapping.py` to update security rules with custom controls based on CSV input and generate baseline YAML files.
- Introduced `scap.py` for creating SCAP-compliant XML files, with support for different OS types and export formats.
