docs: regenerate FRAMEWORK-COVERAGE.md (unblock failing coverage-update workflow)#201
Open
ethanolivertroy wants to merge 5 commits into
Open
docs: regenerate FRAMEWORK-COVERAGE.md (unblock failing coverage-update workflow)#201ethanolivertroy wants to merge 5 commits into
ethanolivertroy wants to merge 5 commits into
Conversation
📝 WalkthroughWalkthroughThis PR regenerates docs/FRAMEWORK-COVERAGE.md auto-generated content, updating the last-generated timestamp, overall coverage summary counts, and regional (Americas, APAC, EMEA, Global) framework tables with added, removed, and replaced framework rows. ChangesFramework Coverage Documentation Update
Estimated code review effort: 1 (Trivial) | ~5 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
PR Summary by QodoDocs: regenerate FRAMEWORK-COVERAGE.md (unblock coverage-update workflow)
AI Description
Diagram
High-Level Assessment
Files changed (1)
|
… docs link The support.claude.com article 14680729 (Use Claude Cowork with third-party platforms) was removed and now returns 404, which fails the lychee link-check workflow on main and on any PR that touches README.md or docs/CLAUDE-COWORK.md. Replace all three references with the live official guide at https://claude.com/docs/cowork/3p/overview. Co-authored-by: Ethan Troy <ethanolivertroy@users.noreply.github.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/FRAMEWORK-COVERAGE.md`:
- Line 103: The framework ID in the coverage table is misspelled and should
match the existing americas-* naming pattern. Update the entry for the OSFI
self-assessment row in FRAMEWORK-COVERAGE so the identifier uses the correct
spelling in the table and remains consistent with other crosswalk IDs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: ee64a002-3afc-45be-ada8-734e42897e0f
📒 Files selected for processing (1)
docs/FRAMEWORK-COVERAGE.md
Code Review by Qodo
Context used✅ Compliance rules (platform):
17 rules 1. Coverage totals mismatch
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Greptile SummaryThis PR delivers the auto-generated
Confidence Score: 5/5Safe to merge — all changes are documentation updates, dead-link fixes, and SCF ID correctness fixes with no logic-bearing code changes beyond the CSA CCM alias addition in scf-client.js. The documentation is auto-generated and its arithmetic has been independently verified (28 shipped plugins, regional totals 69+22+46+84=221, matches summary). The two SCF ID fixes resolve exactly the issues flagged in the previous review. The scf-client.js change is a straightforward alias addition that makes CSA CCM lookups work rather than returning an error; the alias points to the same ID used by the shipped /csa-ccm: plugin. No runtime paths are affected beyond that one lookup correction. No files require special attention. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Weekly workflow\ngenerate-coverage.js] -->|fetches| B[SCF API\ngrcengclub.github.io/scf-api]
B -->|249 frameworks| C[scan plugin.json\nscf_framework_id per plugin]
C -->|match on canonical ID| D{ID in SCF catalog?}
D -->|yes| E[Shipped plugins table\n28 frameworks]
D -->|no - old bug| F[Plugin invisible to generator\nappears in both shipped + not-started]
E --> G[FRAMEWORK-COVERAGE.md\nregenerated]
G -->|PR creation blocked\nActions setting disabled| H[Manual cherry-pick\nthis PR]
subgraph Fixes in this PR
I[US-HIPAA-Security\n→ usa-federal-law-hipaa-security-rule-2013]
J[emea-gbr-ce-2021\n→ emea-gbr-cyber-essentials-requirements-3-3]
K[csa-ccm removed from\nFRAMEWORKS_WITHOUT_SCF_CROSSWALK\n+ added to FRAMEWORK_ALIASES]
end
I --> D
J --> D
K -->|fixes alias lookup| L[gap-assessment csa-ccm\nnow resolves correctly]
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
A[Weekly workflow\ngenerate-coverage.js] -->|fetches| B[SCF API\ngrcengclub.github.io/scf-api]
B -->|249 frameworks| C[scan plugin.json\nscf_framework_id per plugin]
C -->|match on canonical ID| D{ID in SCF catalog?}
D -->|yes| E[Shipped plugins table\n28 frameworks]
D -->|no - old bug| F[Plugin invisible to generator\nappears in both shipped + not-started]
E --> G[FRAMEWORK-COVERAGE.md\nregenerated]
G -->|PR creation blocked\nActions setting disabled| H[Manual cherry-pick\nthis PR]
subgraph Fixes in this PR
I[US-HIPAA-Security\n→ usa-federal-law-hipaa-security-rule-2013]
J[emea-gbr-ce-2021\n→ emea-gbr-cyber-essentials-requirements-3-3]
K[csa-ccm removed from\nFRAMEWORKS_WITHOUT_SCF_CROSSWALK\n+ added to FRAMEWORK_ALIASES]
end
I --> D
J --> D
K -->|fixes alias lookup| L[gap-assessment csa-ccm\nnow resolves correctly]
Reviews (2): Last reviewed commit: "docs: regenerate FRAMEWORK-COVERAGE.md w..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
…cyber-essentials-plus - us-hipaa-security declared 'US-HIPAA-Security', which does not exist in the SCF crosswalk index; the canonical ID is usa-federal-law-hipaa-security-rule-2013 (136 SCF -> 87 framework controls per the 2026.1 crosswalk). - cyber-essentials-plus declared 'emea-gbr-ce-2021'; the crosswalk publishes emea-gbr-cyber-essentials-requirements-3-3. Because generate-coverage.js and gap-assessment join plugins to SCF frameworks by exact framework_id, both plugins were invisible to the crosswalk: coverage counted them as shipped but left their SCF entries in the 'Not started' lists (summary said 221 crosswalk-only while the regional sections summed to 223). Updates plugin.json metadata plus all command/skill/README references to the old IDs. Co-authored-by: Ethan Troy <ethanolivertroy@users.noreply.github.com>
…f refusing
FRAMEWORKS_WITHOUT_SCF_CROSSWALK claimed CSA CCM v4 was absent from the
crosswalk index, but SCF 2026.1 publishes it as general-csa-cmm-4-1-0
(291 SCF -> 207 framework controls), and the csa-ccm plugin already
declares that ID in its framework_metadata. Remove the stale refusal and
add csa-ccm/ccm aliases so resolve() and gap-assessment reach the real
crosswalk.
Verified: resolveFrameworkId('csa-ccm') -> general-csa-cmm-4-1-0 and
resolve('csa-ccm','A&A-01') -> GOV-02, GOV-03 against cached 2026.1 data.
Co-authored-by: Ethan Troy <ethanolivertroy@users.noreply.github.com>
Regenerated with generate-coverage.js against SCF 2026.1 (cache seeded from the scf-api repo since the pages endpoint is unreachable from this environment). Crosswalk-only total (221) now matches the sum of the regional sections (69+22+46+84), resolving the 223-vs-221 skew flagged in review. Co-authored-by: Ethan Troy <ethanolivertroy@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The weekly
Update framework coverageworkflow has been failing for three consecutive runs withGitHub Actions is not permitted to create or approve pull requests— the regeneration succeeds butpeter-evans/create-pull-requestcannot open the PR because the org/repo Actions setting "Allow GitHub Actions to create and approve pull requests" is disabled.This PR brings
docs/FRAMEWORK-COVERAGE.mdup to date (last generated 2026-04-18 → 2026-07-05): 15 → 28 frameworks with dedicated plugins, adding the 13 plugins shipped since April (NIS2, NIST CSF 2.0, CCPA, HIPAA Security, NERC CIP, SOX, CPS 234, Cyber Essentials Plus, DPDPA, APPI, MAS TRM, FADP, FINRA).Review feedback on the initial regeneration surfaced three real metadata bugs, all fixed here:
us-hipaa-securitydeclared a non-existent SCF ID (US-HIPAA-Security). Corrected to the canonicalusa-federal-law-hipaa-security-rule-2013(136 SCF → 87 framework controls), including all command/skill references.cyber-essentials-plusdeclaredemea-gbr-ce-2021, which the crosswalk doesn't publish. Corrected toemea-gbr-cyber-essentials-requirements-3-3, including all command/skill/README references.scf-client.jsstill claimed CSA CCM has no SCF crosswalk and refused to resolve it, while thecsa-ccmplugin already declaresgeneral-csa-cmm-4-1-0(which SCF 2026.1 publishes). Removed the stale refusal and addedcsa-ccm/ccmaliases. Verified:resolve('csa-ccm', 'A&A-01')→GOV-02, GOV-03.Because coverage joins plugins to SCF frameworks by exact
framework_id, bugs 1–2 caused the count skew reviewers flagged (summary said 221 crosswalk-only while the regional sections summed to 223). After the fixes the regenerated doc is internally consistent: 221 = 69 + 22 + 46 + 84.It also carries the same dead-link fix as #200 (the removed
support.claude.comCowork article → liveclaude.com/docs/cowork/3p/overview), because the lychee link check scans the whole repo on every PR and fails without it. The commit is identical in both PRs; whichever merges first, the other squash-merges cleanly on top.Not changed:
amaericas-can-osfi-self-assessment(CodeRabbit's typo flag) is the framework_id the SCF API actually publishes — the doc must mirror it orgap-assessmentlookups break.regionFromFrameworkId()already special-cases theamaericas-prefix. The real fix belongs upstream inGRCEngClub/scf-api/ SCF source data.Type of change
Schema impact
schemas/finding.schema.jsonchangedTest plan
node plugins/grc-engineer/scripts/generate-coverage.js --offlineagainst SCF 2026.1 data (cache seeded from theGRCEngClub/scf-apirepo, since the pages endpoint is unreachable under this environment's restricted egress).npm run test:contract,npm run test:plugin-manifests,npm run test:grc-diagrams,npm run test:contract:findings,npm run test:wiz-inspector— all pass.csa-ccmresolution end-to-end against cached crosswalk data.CHANGELOG
Notes for reviewers
To let the coverage bot open these PRs itself going forward, enable Settings → Actions → General → Allow GitHub Actions to create and approve pull requests on the repo (or org). Once that's enabled, the stranded
bot/regenerate-coveragebranch can be deleted and this manual relay won't be needed again.Summary by CodeRabbit