typst (PDF) and Python (HTML/Markdown) are now the only guidance engines
and the default with no flags. Delete the Gemfile, the output_format==adoc
branch (bundle exec asciidoctor[-pdf]), the adoc/ template tree, the
asciidoctor-pdf themes, and the --pdf-engine/--html-engine flags.
Canonical outputs unchanged for users: <baseline>_<lang>.pdf (typst) and
.html (Python); the intermediate is now .typ instead of .adoc. typst (the
'typst' Python package) is required for the PDF -- a missing package is a
hard error with a 'uv sync' hint (covered by a test). Keep asciidoctor.css
/ -dark.css, now inlined by the Python HTML backend. Also drop the unused
renovate config.
Render guidance HTML in pure Python (Jinja) instead of asciidoctor,
reusing the bundled asciidoctor.css inlined into a self-contained file.
The html/ template tree reuses AsciiDoctor class names so the existing CSS
styles it (cover page, numbered TOC, rules, references, admonitions).
Also harden asciidoc_to_typst to escape unbalanced */_/[/] (from regexes,
shell examples, and AsciiDoc artifacts) so every baseline compiles.
Bring the typst PDF to parity with the AsciiDoctor output: chapter
numbering (1. Foreword ... 6.2 <rule>), continuously flowing rules,
NOTE/IMPORTANT/WARNING callout boxes, a cover page, and front-matter
footer suppression with a page-counter reset. Add tests/ (the project's
first test dir) covering the asciidoc_to_typst converter plus a typst
compile-guard integration test via the typst package; wire pytest
pythonpath to src.
* fix: spinner text info for baseline migration
* fix: update CURRENT_USER discovery
change method to use the loginwindow.plist instead of console
* refactor: release string and format
* chore: correct reference to changelog
Issue #718
* refactor: configure logging to catch early CLI issues
* refactor: clarification and inclusion of custom rules
* refactor: correct platform overrides and adjust adoc/md output
* refactor: alias mobileconfig attribute to match yaml
* refactor: admin functions for release and new rule
* chore: lint cleanup and remove markdownlint
* chore(rule): correct validation issues
* chore: adjust spellcheck to main
* chore: correct spelling issues
* chore: update container build process
* chore: trigger container build on push to main
* chore: gate container build on lint and smoke tests
* chore: pin GitHub Actions to commit SHAs and update Node.js to 22 LTS
Pin all unpinned action references to immutable commit SHAs to prevent
supply chain attacks. Upgrade checkout/setup-node from v3 to v4 in
spellcheck workflow and bump Node.js from 20 (deprecated) to 22 LTS
in build_documentation workflow.
* chore: improve GitHub Actions workflow hygiene
- Pin cspell to 10.0.1 instead of @latest
- Add permissions: contents: read to spellcheck, cli-tests, and generate_baselines workflows
- Add concurrency group to generate_baselines to prevent race conditions on rapid pushes
- Add workflow_dispatch to generate_baselines and spellcheck
- Remove dead push-to-main trigger from labeler (labels PRs only)
- Add paths filter to label-sync pull_request_target trigger
- Remove redundant ref from generate_baselines checkout step
- Pin Python to 3.12.1 in cli-tests for consistency
- Remove unnecessary --user flag from pip install in lint workflow
* chore[deps]: update pillow dependency
* chore[rule]: sync enforcement info
issue #592
* chore[rule]: correct CIS ODV
issue #621
* chore[rule]: correct CIS ODV
issue #621
* refactor: filter out incomplete baselines
* feat: add tag mutation API to RuleLibrary
Stores source_file on Macsecurityrule (excluded from serialization) so
RuleLibrary.add_tag/remove_tag can write back to disk after filtering.
Each unique source file is written at most once to avoid redundant I/O
when the library spans multiple platform/version entries for the same rule.
* feat: add add_benchmark/remove_benchmark to RuleLibrary
Unlike tag mutations, benchmark entries are stored per OS version inside
the platforms dict, so both methods group rules by source file and apply
all version mutations to a single canonical object before writing to avoid
clobbering version entries not covered by the first object encountered.
* fix: switch RuleLibrary mutation write path to text-level patching
rule.to_yaml() was designed for custom/derived output and is lossy when
applied to source files — it flattens per-version CCE/STIG dicts and
renames canonical YAML keys (800-53r5 → nist_800_53r5). Replaced all
mutation method write calls with targeted text-level patching helpers
that modify only the specific lines that change, leaving the rest of
each source file untouched.
* chore: update workflow actions
* fix: include multiple mobileconfig payloads if defined in rule
using suggestion from @adrian-ib, changed the mobileconfig info build-out in the manifest to include multiple payloads if they exist
Issue #723
* chore: fix linting and spellcheck findings
* chore: update build action to recent releases
* fix: correct issue with granular profiles and add date
profiles are now generated with a create date in the description
Issue #678
* chore: updates to container build
add entrypoint that will check if latest container and alert the user if a new one is available
move container support files from project root
* chore: adjust to check for container SHA match
* chore: update container update message
* chore: cleanup progress bar messaging
* refactor: custom logo processing in guidance
when a custom logo file is defined at the CLI, it will be copied to the custom/images/ folder for reference in guidance generation.
* feat: add --markdown-tree paginated output for static site generators
Adds mscp guidance --markdown-tree <baseline> (also included in --all),
which renders a baseline as a directory tree ready to drop into any
CommonMark-based static site generator: Docusaurus, Starlight, MkDocs,
VitePress, and similar.
Output shape:
build/<baseline>/markdown_tree/
index.md # overview: foreword, scope, authors
02-<section-slug>/
index.md # section description
01-<rule-slug>.md # one page per rule
...
Files are NN- prefixed for stable ordering (no sidebar config needed).
index.md follows the category-index convention recognised by Docusaurus
and Starlight. Frontmatter is minimal (title only) so it works across
generators without modification.
Content reuses markdown/rule.md.jinja via a markdown_tree context flag,
selecting heading-based Check/Remediation sections and a GFM pipe table
for references. The single-file --markdown output path is unchanged.
Manual-rule notes use > **Note:** blockquotes that render everywhere.
Tests: 41 pytest tests covering mdx_escape, create_slug,
render_references_md, _frontmatter, and an integration test against a
real baseline asserting NN- ordering, balanced fences, no raw braces
outside fenced blocks, and valid frontmatter. Validated: 104/104
(cis_lvl1) and 168/168 (disa_stig) pages compile under @mdx-js/mdx v3.
Note: --markdown-tree has no short flag to avoid collision with
-m/--markdown.
* fix: resolve flake8 findings flagged by dev_2.0 CI
The concatenated __all__ entry "PLATFORM_MAPvalidate_yaml_file" made
pyflakes miss both names as exports, so it reported their imports as
unused (F401). Splitting it fixes both. Also import CONFIG_PATH so its
existing __all__ entry resolves, drop unused BaseModel/config imports,
and clean blank-line whitespace in scap.py.
* chore: add pre-commit config mirroring CI linters
