Skip to content

Commit 613188b

Browse files
Mab879Mab879
authored
Merge pull request #14685 from ggbecker/nist-800-53-control-split-per-product-infra-only
[Infra Only] Add NIST 800-53 Rev 5 control framework with OSCAL metadata and CIS mappings (Split per product)
2 parents a78ca75 + c1577f8 commit 613188b

165 files changed

Lines changed: 47962 additions & 12 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/cis-nist-sync.yml‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
name: CIS-NIST Control File Sync
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- master
7+
schedule:
8+
# Run every Sunday at 2:00 PM UTC
9+
- cron: '0 14 * * 0'
10+
workflow_dispatch: # Allow manual trigger
11+
12+
jobs:
13+
generate-and-validate:
14+
name: Generate CIS-NIST Control File and Profiles
15+
runs-on: ubuntu-latest
16+
container:
17+
image: fedora:latest
18+
19+
steps:
20+
- name: Install system dependencies
21+
run: |
22+
dnf install -y \
23+
cmake \
24+
make \
25+
ninja-build \
26+
openscap-utils \
27+
python3-pyyaml \
28+
python3-jinja2 \
29+
python3-pip \
30+
git \
31+
gcc \
32+
gcc-c++ \
33+
python3-devel \
34+
libxml2-devel \
35+
libxslt-devel \
36+
python3-setuptools \
37+
libxml2 \
38+
expat \
39+
gh
40+
41+
- name: Checkout repository
42+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
43+
with:
44+
token: ${{ secrets.GITHUB_TOKEN }}
45+
fetch-depth: 0
46+
47+
- name: Configure git
48+
run: |
49+
git config --global user.name "github-actions[bot]"
50+
git config --global user.email "github-actions[bot]@users.noreply.github.com"
51+
git config --global --add safe.directory "$GITHUB_WORKSPACE"
52+
53+
- name: Install Python dependencies
54+
run: |
55+
pip install --upgrade pip
56+
pip install ruamel.yaml PyPDF2
57+
58+
- name: Download OSCAL catalog
59+
run: |
60+
cd utils/nist_sync
61+
python3 download_oscal.py
62+
63+
- name: Run CIS-NIST workflow
64+
id: workflow
65+
run: |
66+
cd utils/nist_sync
67+
echo "Running workflow for products: rhel8 rhel9 rhel10"
68+
./generate_cis_nist_workflow.sh --products "rhel8 rhel9 rhel10"
69+
70+
- name: Verify control files
71+
run: ./utils/nist_sync/ci_sync.sh verify
72+
73+
- name: Render policies and generate HTML tables
74+
run: |
75+
cd build
76+
ninja render-policies
77+
cd ..
78+
mkdir -p artifacts/tables artifacts/rendered-policies
79+
for product in rhel8 rhel9 rhel10; do
80+
SRC="build/$product/rendered-policies/nist_800_53.html"
81+
DEST="artifacts/rendered-policies/nist_800_53-$product.html"
82+
[ -f "$SRC" ] && cp "$SRC" "$DEST"
83+
done
84+
85+
- name: Collect artifacts
86+
run: ./utils/nist_sync/ci_sync.sh collect-artifacts
87+
88+
- name: Upload artifacts
89+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
90+
with:
91+
name: cis-nist-artifacts-${{ github.run_number }}
92+
path: artifacts/
93+
retention-days: 90
94+
95+
- name: Generate summary report
96+
run: ./utils/nist_sync/ci_sync.sh summarize
97+
98+
- name: Check for changes in CIS reference
99+
id: changes
100+
run: ./utils/nist_sync/ci_sync.sh check-changes
101+
102+
- name: Show diff summary
103+
if: steps.changes.outputs.has_changes == 'true'
104+
run: ./utils/nist_sync/ci_sync.sh show-diff
105+
106+
- name: Create Pull Request for scheduled runs
107+
if: >-
108+
(github.event_name == 'schedule' ||
109+
github.event_name == 'workflow_dispatch') &&
110+
steps.changes.outputs.has_changes == 'true'
111+
env:
112+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
113+
GHA_EVENT_NAME: ${{ github.event_name }}
114+
GHA_RUN_ID: ${{ github.run_id }}
115+
GHA_REPOSITORY: ${{ github.repository }}
116+
run: ./utils/nist_sync/ci_sync.sh create-pr
117+
118+
- name: Workflow Summary
119+
if: always()
120+
env:
121+
GHA_EVENT_NAME: ${{ github.event_name }}
122+
GHA_RUN_ID: ${{ github.run_id }}
123+
HAS_CHANGES: ${{ steps.changes.outputs.has_changes }}
124+
run: ./utils/nist_sync/ci_sync.sh workflow-summary

‎.github/workflows/gh-pages.yaml‎

Lines changed: 21 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
name: Github Pages
22
on:
33
push:
4-
branches: [ 'master' ]
4+
branches: ['master']
55
pull_request:
6-
branches: [ 'master', 'oscal-update-*' ]
6+
branches: ['master', 'oscal-update-*']
77
merge_group:
8-
branches: [ 'master' ]
8+
branches: ['master']
99
concurrency:
1010
group: ${{ github.workflow }}-${{ github.event.number || github.run_id }}
1111
cancel-in-progress: true
@@ -19,13 +19,17 @@ jobs:
1919
PAGES_DIR: __pages
2020
steps:
2121
- name: Install Deps
22-
run: dnf install -y cmake git ninja-build openscap-utils python3-pyyaml python3-jinja2 python3-pytest ansible-lint libxslt python3-pip rsync python3-lxml python3-setuptools
22+
run: |
23+
dnf install -y \
24+
cmake git ninja-build openscap-utils python3-pyyaml \
25+
python3-jinja2 python3-pytest ansible-lint libxslt \
26+
python3-pip rsync python3-lxml python3-setuptools
2327
- name: Install deps python
2428
run: pip3 install json2html prometheus_client
2529
- name: Checkout
2630
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2731
with:
28-
persist-credentials: false
32+
persist-credentials: false
2933
- name: Build
3034
run: cmake .. -G Ninja -DCMAKE_BUILD_TYPE=Debug
3135
working-directory: ./build
@@ -38,8 +42,14 @@ jobs:
3842
- name: Render Policies (Using control files)
3943
run: ninja render-policies -j$(nproc)
4044
working-directory: ./build
45+
- name: Generate NIST 800-53 Control Viewer
46+
run: ninja nist-viewer
47+
working-directory: ./build
4148
- name: Generate Prometheus Metrics
42-
run: utils/controleval_metrics.py prometheus -p fedora ocp4 rhcos4 rhel10 rhel9 rhel8 sle12 sle15 -f ./build/policies_metrics
49+
run: |
50+
utils/controleval_metrics.py prometheus \
51+
-p fedora ocp4 rhcos4 rhel10 rhel9 rhel8 sle12 sle15 \
52+
-f ./build/policies_metrics
4353
env:
4454
PYTHONPATH: ${{ github.workspace }}
4555
- name: Generate HTML pages
@@ -51,8 +61,11 @@ jobs:
5161
run:
5262
git config --global --add safe.directory "$GITHUB_WORKSPACE"
5363
- name: Deploy
54-
if: ${{ github.event_name == 'push' && github.repository == 'ComplianceAsCode/content' && github.ref == 'refs/heads/master' }}
55-
uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0
64+
if: >-
65+
${{ github.event_name == 'push' &&
66+
github.repository == 'ComplianceAsCode/content' &&
67+
github.ref == 'refs/heads/master' }}
68+
uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f
5669
with:
5770
branch: main # The branch the action should deploy to.
5871
folder: ${{ env.PAGES_DIR }} # The folder the action should deploy.

‎CMakeLists.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -379,6 +379,9 @@ add_custom_target(html-profile-stats)
379379

380380
add_custom_target(render-policies)
381381

382+
# NIST 800-53 Control Viewer with Gap Analysis
383+
ssg_generate_nist_viewer()
384+
382385
ssg_build_man_page()
383386

384387
if(SSG_PRODUCT_AL2023)

‎cmake/SSGCommon.cmake‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -668,6 +668,26 @@ macro(ssg_render_policies_for_product PRODUCT)
668668
)
669669
endmacro()
670670

671+
macro(ssg_generate_nist_viewer)
672+
# Generate NIST 800-53 control viewer with gap analysis
673+
# This generates for all RHEL products at once
674+
set(NIST_PRODUCTS rhel8 rhel9 rhel10)
675+
add_custom_command(
676+
OUTPUT "${CMAKE_BINARY_DIR}/nist-controls-viewer/nist-controls-viewer.html"
677+
COMMAND ${CMAKE_COMMAND} -E make_directory "${CMAKE_BINARY_DIR}/nist-controls-viewer"
678+
COMMAND env "PYTHONPATH=$ENV{PYTHONPATH}" "${Python_EXECUTABLE}" "${CMAKE_SOURCE_DIR}/utils/nist_sync/generate_nist_viewer.py"
679+
--products ${NIST_PRODUCTS}
680+
--output-dir "${CMAKE_BINARY_DIR}/nist-controls-viewer"
681+
--repo-root "${CMAKE_SOURCE_DIR}"
682+
COMMAND ${CMAKE_COMMAND} -E touch "${CMAKE_BINARY_DIR}/nist-controls-viewer/nist-controls-viewer.html"
683+
COMMENT "[nist-viewer] generating NIST 800-53 control viewer with gap analysis"
684+
)
685+
686+
add_custom_target(nist-viewer
687+
DEPENDS "${CMAKE_BINARY_DIR}/nist-controls-viewer/nist-controls-viewer.html"
688+
)
689+
endmacro()
690+
671691
macro(ssg_make_all_tables PRODUCT)
672692
add_custom_command(
673693
OUTPUT "${CMAKE_BINARY_DIR}/tables/tables-${PRODUCT}-all.html"

0 commit comments

Comments
 (0)