From 5cfca6907a097df47647fd06a6a6185941142fdf Mon Sep 17 00:00:00 2001 From: Sophia Wang Date: Tue, 24 Jun 2025 13:56:07 +0800 Subject: [PATCH 1/3] add workflow sync-oscal-cac Signed-off-by: Sophia Wang --- .github/workflows/sync-oscal-cac.yml | 159 +++++++++++++++++++++++++++ 1 file changed, 159 insertions(+) create mode 100644 .github/workflows/sync-oscal-cac.yml diff --git a/.github/workflows/sync-oscal-cac.yml b/.github/workflows/sync-oscal-cac.yml new file mode 100644 index 000000000..c97aebf95 --- /dev/null +++ b/.github/workflows/sync-oscal-cac.yml @@ -0,0 +1,159 @@ +name: Sync OSCAL content to CAC content +permissions: + contents: write + pull-requests: read +on: + push: + branches: + - main + +jobs: + sync-oscal-content-update-to-cac: + runs-on: ubuntu-latest + steps: + # Step 1: Set up Python 3 + - name: Set up Python 3 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + with: + python-version: '3.9' + # Step 2: Install Git + - name: Install Git + run: sudo apt-get update && sudo apt-get install -y git + # Step 3: Checkout OSCAL repo + - name: Checkout OSCAL repo + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + repository: ${{ github.repository }} + path: oscal-content + # Step 4: Get the commit message and PR number + - name: Get the commit message and PR number + run: | + cd oscal-content + # Get the latest commit message + COMMIT_MSG=$(git log -1 --pretty=%B) + # Extract the PR number from the commit message (if it's a merge commit) + PR_NUMBER=$(echo "$COMMIT_MSG" | grep -oP '#\K\d+') + if [ -n "$PR_NUMBER" ]; then + echo "Found PR number: $PR_NUMBER" + echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV + echo "SKIP=false" >> $GITHUB_ENV + PR_INFO=$(curl -s "https://api.github.com/repos/${{ github.repository }}/pulls/${PR_NUMBER}") + # Extract PR title from the response + PR_TITLE=$(echo "$PR_INFO" | jq -r .title) + echo "PR Title: $PR_TITLE" + if [[ "$PR_TITLE" == *"Auto-generated PR from CAC"* ]]; then + echo "The PR comes from CAC content. The workflow of Sync OSCAL content to CAC will exit." + echo "Skipping further checks." + echo "SKIP=true" >> $GITHUB_ENV + fi + fi + # Step 5: Get the access token for content write permission to CAC content + - name: Get GitHub app token + if: ${{ env.SKIP == 'false' }} + uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6 + id: app-token + with: + app-id: ${{ secrets.APP_ID }} + private-key: ${{ secrets.PRIVATE_KEY }} + owner: ${{ github.repository_owner }} + repositories: | + content + oscal-content + # Step 6: Dectect the updates of OSCAL content + - name: Detect the changed files of the PR + id: changed-files + run: | + repo=${{ github.repository }} + # Fetch all pages of the files for the pull request + url="repos/$repo/pulls/${{ env.PR_NUMBER }}/files" + response=$(gh api "$url" --paginate) + echo "$response" | jq -r '.[].filename' > filenames.txt + echo "CHANGE_FOUND=false" >> $GITHUB_ENV + if grep -E "catalogs/|profiles/|component-definitions/" filenames.txt ; then + echo "CHANGE_FOUND=true" >> $GITHUB_ENV + fi + cat filenames.txt + env: + GH_TOKEN: ${{ steps.app-token.outputs.token }} + # Step 7: Setup complyscribe + - name: Checkout CAC repo + if: ${{ env.CHANGE_FOUND == 'true' }} + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + repository: ComplianceAsCode/content + path: cac-content + token: ${{ steps.app-token.outputs.token }} + fetch-depth: 0 + - name: Checkout complyscribe repo + if: ${{ env.CHANGE_FOUND == 'true' }} + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + repository: complytime/complyscribe + path: complyscribe + - name: Setup complyscribe + if: ${{ env.CHANGE_FOUND == 'true' }} + run: | + cd complyscribe && python3 -m venv venv && source venv/bin/activate + python3 -m pip install --no-cache-dir "poetry==1.7.1" + poetry install + # Step 8: Sync OSCAL content to CAC content + - name: Sync OSCAL content to CAC content + if: ${{ env.CHANGE_FOUND == 'true' }} + run: | + pr_number="${{ github.event.pull_request.number }}" + cat filenames.txt + cd complyscribe && source venv/bin/activate + while IFS= read -r line; do + if [[ "$line" == *catalogs* ]]; then + echo "sync oscal catalogs according to update of $line ..." + policy_id=$(echo "$line" | cut -f2 -d"/") + echo "The policy_id is $policy_id" + poetry run complyscribe sync-oscal-content catalog --repo-path ../oscal-content --committer-email "openscap-ci@gmail.com" --committer-name "openscap-ci" --branch "sync_oscal_pr$pr_number" --cac-content-root "$GITHUB_WORKSPACE/cac-content" --cac-policy-id "$policy_id" + elif [[ "$line" == "profiles"* ]]; then + echo "sync oscal profiles according to update of $line ..." + policy_id=$(echo $line | cut -f2 -d"/" | cut -f2 -d"-") + product=$(echo "$line" | cut -f2 -d"/" | cut -f1 -d"-") + echo "The policy_id is $policy_id, the product is $product" + poetry run complyscribe sync-oscal-content profile --repo-path ../oscal-content --committer-email "openscap-ci@gmail.com" --committer-name "openscap-ci" --branch "sync_oscal_pr$pr_number" --cac-content-root "$GITHUB_WORKSPACE/cac-content" --cac-policy-id "$policy_id" --product "$product" + elif [[ "$line" == "component-definitions"* ]]; then + echo "sync oscal component-definitions according to update of $line ..." + product=$(echo "$line" | cut -f2 -d"/") + profile=$(echo "$line" | cut -f3 -d"/") + echo "The product is $product, the profile is $profile" + poetry run complyscribe sync-oscal-content component-definition --repo-path ../oscal-content --committer-email "openscap-ci@gmail.com" --committer-name "openscap-ci" --branch "sync_oscal_pr$pr_number" --cac-content-root "$GITHUB_WORKSPACE/cac-content" --product "$product" --oscal-profile "$profile" + fi + done < ../filenames.txt + # Step 9: Create PR to CAC content + - name: Create a Pull Request to OSCAL content + if: ${{ env.CHANGE_FOUND == 'true' }} + run: | + cd cac-content + BRANCH_NAME="sync_oscal_pr${{ env.PR_NUMBER }}" + OWNER="ComplianceAsCode" + REPO="content" + if [[ "$(git branch --show-current)" == "$BRANCH_NAME" ]]; then + # Check if the PR exists + PR_EXISTS=$(gh pr list --repo $OWNER/$REPO \ + --head $BRANCH_NAME --state open --json id \ + | jq length) + # Get commits between main and branch + commits=$(git log master..$BRANCH_NAME --oneline) + # If the PR does not exist and there are commits in the branch, + # then create a PR for this branch. + if [ "$PR_EXISTS" -gt 0 ]; then + echo "PR $BRANCH_NAME already exists. Skipping PR creation." + elif [ -z "$commits" ]; then + echo "No commits between main and $BRANCH_NAME. Skipping PR creation." + else + echo "Creating PR for new branch: $BRANCH_NAME" + gh pr create --repo $OWNER/$REPO \ + --title "Auto-generated PR from OSCAL ${{ env.PR_NUMBER }}" \ + --head "$BRANCH_NAME" \ + --base "master" \ + --body "This is an auto-generated PR from OSCAL ${{ env.PR_NUMBER }} updates" + fi + else + echo "No branch $BRANCH_NAME. Skipping PR creation." + fi + env: + GH_TOKEN: ${{ steps.app-token.outputs.token }} From 72159175fc986b0a929a3cbc4df13daf0c067287 Mon Sep 17 00:00:00 2001 From: Sophia Wang Date: Wed, 25 Jun 2025 11:13:03 +0800 Subject: [PATCH 2/3] minor improvement for trigger event and check existing branch Signed-off-by: Sophia Wang --- .github/workflows/sync-oscal-cac.yml | 39 ++++++++++++++++++++++++---- 1 file changed, 34 insertions(+), 5 deletions(-) diff --git a/.github/workflows/sync-oscal-cac.yml b/.github/workflows/sync-oscal-cac.yml index c97aebf95..82f0bfc6f 100644 --- a/.github/workflows/sync-oscal-cac.yml +++ b/.github/workflows/sync-oscal-cac.yml @@ -3,9 +3,16 @@ permissions: contents: write pull-requests: read on: - push: - branches: - - main +# push: +# branches: +# - main + # The sync-oscal-content CLI could change the format of controls and profiles. + # It's hard to review for CAC reviewers. The story CPLYTM-652 could help to + # improve the pain point. To aviod the noise in the early stage, the trigger + # event is changed to workflow_dispatch. + # trigger. + # https://github.com/ComplianceAsCode/content/pull/13617#issuecomment-3000489965 + workflow_dispatch: jobs: sync-oscal-content-update-to-cac: @@ -96,7 +103,29 @@ jobs: cd complyscribe && python3 -m venv venv && source venv/bin/activate python3 -m pip install --no-cache-dir "poetry==1.7.1" poetry install - # Step 8: Sync OSCAL content to CAC content + # Step 8: Check if the CAC content branch exists + - name: Check if the CAC content branch exists + if: ${{ env.CHANGE_FOUND == 'true' }} + run: | + pr_number="${{ github.event.pull_request.number }}" + BRANCH_NAME="sync_oscal_pr$pr_number" + cd cac-content + branches=$(git branch -r | grep 'origin/sync_oscal' | sed 's/origin\///') + exist="false" + for branch in $branches; do + echo $branch + if [[ "$branch" == "$BRANCH_NAME" ]]; then + echo "CAC content branch $BRANCH_NAME exists" + git fetch --all + git checkout -b "sync_oscal_pr$pr_number" origin/sync_oscal_pr$pr_number + exist="true" + break + fi + done + if [[ "$exist" == "false" ]]; then + echo "CAC content branch $BRANCH_NAME doesn't exist" + fi + # Step 9: Sync OSCAL content to CAC content - name: Sync OSCAL content to CAC content if: ${{ env.CHANGE_FOUND == 'true' }} run: | @@ -123,7 +152,7 @@ jobs: poetry run complyscribe sync-oscal-content component-definition --repo-path ../oscal-content --committer-email "openscap-ci@gmail.com" --committer-name "openscap-ci" --branch "sync_oscal_pr$pr_number" --cac-content-root "$GITHUB_WORKSPACE/cac-content" --product "$product" --oscal-profile "$profile" fi done < ../filenames.txt - # Step 9: Create PR to CAC content + # Step 10: Create PR to CAC content - name: Create a Pull Request to OSCAL content if: ${{ env.CHANGE_FOUND == 'true' }} run: | From 6537a725c369fc265a6606970ffe432c7e2d4bbb Mon Sep 17 00:00:00 2001 From: Sophia Wang Date: Thu, 26 Jun 2025 11:52:00 +0800 Subject: [PATCH 3/3] add the oscal pr link to the cac pr comment body Signed-off-by: Sophia Wang --- .github/workflows/sync-oscal-cac.yml | 35 +++++++++++----------------- 1 file changed, 13 insertions(+), 22 deletions(-) diff --git a/.github/workflows/sync-oscal-cac.yml b/.github/workflows/sync-oscal-cac.yml index 82f0bfc6f..89a9bf440 100644 --- a/.github/workflows/sync-oscal-cac.yml +++ b/.github/workflows/sync-oscal-cac.yml @@ -107,29 +107,18 @@ jobs: - name: Check if the CAC content branch exists if: ${{ env.CHANGE_FOUND == 'true' }} run: | - pr_number="${{ github.event.pull_request.number }}" - BRANCH_NAME="sync_oscal_pr$pr_number" + BRANCH_NAME="sync_oscal_pr${{ env.PR_NUMBER }}" cd cac-content - branches=$(git branch -r | grep 'origin/sync_oscal' | sed 's/origin\///') - exist="false" - for branch in $branches; do - echo $branch - if [[ "$branch" == "$BRANCH_NAME" ]]; then - echo "CAC content branch $BRANCH_NAME exists" - git fetch --all - git checkout -b "sync_oscal_pr$pr_number" origin/sync_oscal_pr$pr_number - exist="true" - break - fi - done - if [[ "$exist" == "false" ]]; then + git fetch --all + if git show-ref --verify --quiet refs/remotes/origin/"$BRANCH_NAME"; then + git checkout -b "sync_oscal_pr${{ env.PR_NUMBER }}" origin/sync_oscal_pr${{ env.PR_NUMBER }} + else echo "CAC content branch $BRANCH_NAME doesn't exist" fi # Step 9: Sync OSCAL content to CAC content - name: Sync OSCAL content to CAC content if: ${{ env.CHANGE_FOUND == 'true' }} run: | - pr_number="${{ github.event.pull_request.number }}" cat filenames.txt cd complyscribe && source venv/bin/activate while IFS= read -r line; do @@ -137,29 +126,30 @@ jobs: echo "sync oscal catalogs according to update of $line ..." policy_id=$(echo "$line" | cut -f2 -d"/") echo "The policy_id is $policy_id" - poetry run complyscribe sync-oscal-content catalog --repo-path ../oscal-content --committer-email "openscap-ci@gmail.com" --committer-name "openscap-ci" --branch "sync_oscal_pr$pr_number" --cac-content-root "$GITHUB_WORKSPACE/cac-content" --cac-policy-id "$policy_id" + poetry run complyscribe sync-oscal-content catalog --repo-path ../oscal-content --committer-email "openscap-ci@gmail.com" --committer-name "openscap-ci" --branch "sync_oscal_pr${{ env.PR_NUMBER }}" --cac-content-root "$GITHUB_WORKSPACE/cac-content" --cac-policy-id "$policy_id" elif [[ "$line" == "profiles"* ]]; then echo "sync oscal profiles according to update of $line ..." policy_id=$(echo $line | cut -f2 -d"/" | cut -f2 -d"-") product=$(echo "$line" | cut -f2 -d"/" | cut -f1 -d"-") echo "The policy_id is $policy_id, the product is $product" - poetry run complyscribe sync-oscal-content profile --repo-path ../oscal-content --committer-email "openscap-ci@gmail.com" --committer-name "openscap-ci" --branch "sync_oscal_pr$pr_number" --cac-content-root "$GITHUB_WORKSPACE/cac-content" --cac-policy-id "$policy_id" --product "$product" + poetry run complyscribe sync-oscal-content profile --repo-path ../oscal-content --committer-email "openscap-ci@gmail.com" --committer-name "openscap-ci" --branch "sync_oscal_pr${{ env.PR_NUMBER }}" --cac-content-root "$GITHUB_WORKSPACE/cac-content" --cac-policy-id "$policy_id" --product "$product" elif [[ "$line" == "component-definitions"* ]]; then echo "sync oscal component-definitions according to update of $line ..." product=$(echo "$line" | cut -f2 -d"/") profile=$(echo "$line" | cut -f3 -d"/") echo "The product is $product, the profile is $profile" - poetry run complyscribe sync-oscal-content component-definition --repo-path ../oscal-content --committer-email "openscap-ci@gmail.com" --committer-name "openscap-ci" --branch "sync_oscal_pr$pr_number" --cac-content-root "$GITHUB_WORKSPACE/cac-content" --product "$product" --oscal-profile "$profile" + poetry run complyscribe sync-oscal-content component-definition --repo-path ../oscal-content --committer-email "openscap-ci@gmail.com" --committer-name "openscap-ci" --branch "sync_oscal_pr${{ env.PR_NUMBER }}" --cac-content-root "$GITHUB_WORKSPACE/cac-content" --product "$product" --oscal-profile "$profile" fi done < ../filenames.txt - # Step 10: Create PR to CAC content - - name: Create a Pull Request to OSCAL content + # Step 10: Create PR in CAC content + - name: Create a Pull Request in CAC content if: ${{ env.CHANGE_FOUND == 'true' }} run: | cd cac-content BRANCH_NAME="sync_oscal_pr${{ env.PR_NUMBER }}" OWNER="ComplianceAsCode" REPO="content" + OSCAL_PR_URL="https://github.com/$OWNER/oscal-content/pull/${{ env.PR_NUMBER }}" if [[ "$(git branch --show-current)" == "$BRANCH_NAME" ]]; then # Check if the PR exists PR_EXISTS=$(gh pr list --repo $OWNER/$REPO \ @@ -175,11 +165,12 @@ jobs: echo "No commits between main and $BRANCH_NAME. Skipping PR creation." else echo "Creating PR for new branch: $BRANCH_NAME" + PR_BODY="This is an auto-generated PR from OSCAL PR [${{ env.PR_NUMBER }}]("$OSCAL_PR_URL")" gh pr create --repo $OWNER/$REPO \ --title "Auto-generated PR from OSCAL ${{ env.PR_NUMBER }}" \ --head "$BRANCH_NAME" \ --base "master" \ - --body "This is an auto-generated PR from OSCAL ${{ env.PR_NUMBER }} updates" + --body "${PR_BODY}" fi else echo "No branch $BRANCH_NAME. Skipping PR creation."