Skip to content

Commit 6f4ddee

Browse files
huiwangredhathuiwangredhat
authored
Merge pull request #34 from ComplianceAsCode/sync-oscal-cac
add workflow sync-oscal-cac
2 parents 90fa6a9 + 6537a72 commit 6f4ddee

1 file changed

Lines changed: 179 additions & 0 deletions

File tree

‎.github/workflows/sync-oscal-cac.yml‎

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
name: Sync OSCAL content to CAC content
2+
permissions:
3+
contents: write
4+
pull-requests: read
5+
on:
6+
# push:
7+
# branches:
8+
# - main
9+
# The sync-oscal-content CLI could change the format of controls and profiles.
10+
# It's hard to review for CAC reviewers. The story CPLYTM-652 could help to
11+
# improve the pain point. To aviod the noise in the early stage, the trigger
12+
# event is changed to workflow_dispatch.
13+
# trigger.
14+
# https://github.com/ComplianceAsCode/content/pull/13617#issuecomment-3000489965
15+
workflow_dispatch:
16+
17+
jobs:
18+
sync-oscal-content-update-to-cac:
19+
runs-on: ubuntu-latest
20+
steps:
21+
# Step 1: Set up Python 3
22+
- name: Set up Python 3
23+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
24+
with:
25+
python-version: '3.9'
26+
# Step 2: Install Git
27+
- name: Install Git
28+
run: sudo apt-get update && sudo apt-get install -y git
29+
# Step 3: Checkout OSCAL repo
30+
- name: Checkout OSCAL repo
31+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
32+
with:
33+
repository: ${{ github.repository }}
34+
path: oscal-content
35+
# Step 4: Get the commit message and PR number
36+
- name: Get the commit message and PR number
37+
run: |
38+
cd oscal-content
39+
# Get the latest commit message
40+
COMMIT_MSG=$(git log -1 --pretty=%B)
41+
# Extract the PR number from the commit message (if it's a merge commit)
42+
PR_NUMBER=$(echo "$COMMIT_MSG" | grep -oP '#\K\d+')
43+
if [ -n "$PR_NUMBER" ]; then
44+
echo "Found PR number: $PR_NUMBER"
45+
echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV
46+
echo "SKIP=false" >> $GITHUB_ENV
47+
PR_INFO=$(curl -s "https://api.github.com/repos/${{ github.repository }}/pulls/${PR_NUMBER}")
48+
# Extract PR title from the response
49+
PR_TITLE=$(echo "$PR_INFO" | jq -r .title)
50+
echo "PR Title: $PR_TITLE"
51+
if [[ "$PR_TITLE" == *"Auto-generated PR from CAC"* ]]; then
52+
echo "The PR comes from CAC content. The workflow of Sync OSCAL content to CAC will exit."
53+
echo "Skipping further checks."
54+
echo "SKIP=true" >> $GITHUB_ENV
55+
fi
56+
fi
57+
# Step 5: Get the access token for content write permission to CAC content
58+
- name: Get GitHub app token
59+
if: ${{ env.SKIP == 'false' }}
60+
uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
61+
id: app-token
62+
with:
63+
app-id: ${{ secrets.APP_ID }}
64+
private-key: ${{ secrets.PRIVATE_KEY }}
65+
owner: ${{ github.repository_owner }}
66+
repositories: |
67+
content
68+
oscal-content
69+
# Step 6: Dectect the updates of OSCAL content
70+
- name: Detect the changed files of the PR
71+
id: changed-files
72+
run: |
73+
repo=${{ github.repository }}
74+
# Fetch all pages of the files for the pull request
75+
url="repos/$repo/pulls/${{ env.PR_NUMBER }}/files"
76+
response=$(gh api "$url" --paginate)
77+
echo "$response" | jq -r '.[].filename' > filenames.txt
78+
echo "CHANGE_FOUND=false" >> $GITHUB_ENV
79+
if grep -E "catalogs/|profiles/|component-definitions/" filenames.txt ; then
80+
echo "CHANGE_FOUND=true" >> $GITHUB_ENV
81+
fi
82+
cat filenames.txt
83+
env:
84+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
85+
# Step 7: Setup complyscribe
86+
- name: Checkout CAC repo
87+
if: ${{ env.CHANGE_FOUND == 'true' }}
88+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
89+
with:
90+
repository: ComplianceAsCode/content
91+
path: cac-content
92+
token: ${{ steps.app-token.outputs.token }}
93+
fetch-depth: 0
94+
- name: Checkout complyscribe repo
95+
if: ${{ env.CHANGE_FOUND == 'true' }}
96+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
97+
with:
98+
repository: complytime/complyscribe
99+
path: complyscribe
100+
- name: Setup complyscribe
101+
if: ${{ env.CHANGE_FOUND == 'true' }}
102+
run: |
103+
cd complyscribe && python3 -m venv venv && source venv/bin/activate
104+
python3 -m pip install --no-cache-dir "poetry==1.7.1"
105+
poetry install
106+
# Step 8: Check if the CAC content branch exists
107+
- name: Check if the CAC content branch exists
108+
if: ${{ env.CHANGE_FOUND == 'true' }}
109+
run: |
110+
BRANCH_NAME="sync_oscal_pr${{ env.PR_NUMBER }}"
111+
cd cac-content
112+
git fetch --all
113+
if git show-ref --verify --quiet refs/remotes/origin/"$BRANCH_NAME"; then
114+
git checkout -b "sync_oscal_pr${{ env.PR_NUMBER }}" origin/sync_oscal_pr${{ env.PR_NUMBER }}
115+
else
116+
echo "CAC content branch $BRANCH_NAME doesn't exist"
117+
fi
118+
# Step 9: Sync OSCAL content to CAC content
119+
- name: Sync OSCAL content to CAC content
120+
if: ${{ env.CHANGE_FOUND == 'true' }}
121+
run: |
122+
cat filenames.txt
123+
cd complyscribe && source venv/bin/activate
124+
while IFS= read -r line; do
125+
if [[ "$line" == *catalogs* ]]; then
126+
echo "sync oscal catalogs according to update of $line ..."
127+
policy_id=$(echo "$line" | cut -f2 -d"/")
128+
echo "The policy_id is $policy_id"
129+
poetry run complyscribe sync-oscal-content catalog --repo-path ../oscal-content --committer-email "openscap-ci@gmail.com" --committer-name "openscap-ci" --branch "sync_oscal_pr${{ env.PR_NUMBER }}" --cac-content-root "$GITHUB_WORKSPACE/cac-content" --cac-policy-id "$policy_id"
130+
elif [[ "$line" == "profiles"* ]]; then
131+
echo "sync oscal profiles according to update of $line ..."
132+
policy_id=$(echo $line | cut -f2 -d"/" | cut -f2 -d"-")
133+
product=$(echo "$line" | cut -f2 -d"/" | cut -f1 -d"-")
134+
echo "The policy_id is $policy_id, the product is $product"
135+
poetry run complyscribe sync-oscal-content profile --repo-path ../oscal-content --committer-email "openscap-ci@gmail.com" --committer-name "openscap-ci" --branch "sync_oscal_pr${{ env.PR_NUMBER }}" --cac-content-root "$GITHUB_WORKSPACE/cac-content" --cac-policy-id "$policy_id" --product "$product"
136+
elif [[ "$line" == "component-definitions"* ]]; then
137+
echo "sync oscal component-definitions according to update of $line ..."
138+
product=$(echo "$line" | cut -f2 -d"/")
139+
profile=$(echo "$line" | cut -f3 -d"/")
140+
echo "The product is $product, the profile is $profile"
141+
poetry run complyscribe sync-oscal-content component-definition --repo-path ../oscal-content --committer-email "openscap-ci@gmail.com" --committer-name "openscap-ci" --branch "sync_oscal_pr${{ env.PR_NUMBER }}" --cac-content-root "$GITHUB_WORKSPACE/cac-content" --product "$product" --oscal-profile "$profile"
142+
fi
143+
done < ../filenames.txt
144+
# Step 10: Create PR in CAC content
145+
- name: Create a Pull Request in CAC content
146+
if: ${{ env.CHANGE_FOUND == 'true' }}
147+
run: |
148+
cd cac-content
149+
BRANCH_NAME="sync_oscal_pr${{ env.PR_NUMBER }}"
150+
OWNER="ComplianceAsCode"
151+
REPO="content"
152+
OSCAL_PR_URL="https://github.com/$OWNER/oscal-content/pull/${{ env.PR_NUMBER }}"
153+
if [[ "$(git branch --show-current)" == "$BRANCH_NAME" ]]; then
154+
# Check if the PR exists
155+
PR_EXISTS=$(gh pr list --repo $OWNER/$REPO \
156+
--head $BRANCH_NAME --state open --json id \
157+
| jq length)
158+
# Get commits between main and branch
159+
commits=$(git log master..$BRANCH_NAME --oneline)
160+
# If the PR does not exist and there are commits in the branch,
161+
# then create a PR for this branch.
162+
if [ "$PR_EXISTS" -gt 0 ]; then
163+
echo "PR $BRANCH_NAME already exists. Skipping PR creation."
164+
elif [ -z "$commits" ]; then
165+
echo "No commits between main and $BRANCH_NAME. Skipping PR creation."
166+
else
167+
echo "Creating PR for new branch: $BRANCH_NAME"
168+
PR_BODY="This is an auto-generated PR from OSCAL PR [${{ env.PR_NUMBER }}]("$OSCAL_PR_URL")"
169+
gh pr create --repo $OWNER/$REPO \
170+
--title "Auto-generated PR from OSCAL ${{ env.PR_NUMBER }}" \
171+
--head "$BRANCH_NAME" \
172+
--base "master" \
173+
--body "${PR_BODY}"
174+
fi
175+
else
176+
echo "No branch $BRANCH_NAME. Skipping PR creation."
177+
fi
178+
env:
179+
GH_TOKEN: ${{ steps.app-token.outputs.token }}

0 commit comments

Comments
 (0)