Repository navigation
fix(catalog): hold every control a served manifest can name - #27
Closed
antonbabenko wants to merge 2 commits into
Closed
antonbabenko wants to merge 2 commits into
antonbabenko wants to merge 2 commits into
Conversation
…exiting 2 A served manifest newer than the embedded catalog can delegate a control id the catalog does not hold. delegation_unresolved put that id in ctf.controlIds, the runner's emit check refused it, and report exited 2. The finding now names the id in its message, carries no control id, and the report completes.
The embedded catalog held 294 controls; served manifests name controls beyond them, such as vpc_security_group_remote_administration_ipv4. Regenerate it from the current control catalog (703 controls, version 2026.11.1), refreshing clause text, and re-record the SARIF goldens. module_source now lists on a raw-resource finding only the controls the suggested module enforces, since the catalog places further controls on some covered types. The fixture-manifest guard also checks the not-applicable list and the post_init fixtures.
Member
Author
|
Superseded by a smaller change; closing. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
ctfkit reportexited 2 on modules the compliance.tf registry serves today:The embedded catalog held 294 controls, and served manifests name more.
delegation_unresolvedcopied the manifest's control id intoctf.controlIds.ValidateForthen refused it at the emit boundary, and the whole run failed.Changes
2026.11.1), and clause text on the existing entries is refreshed. Existing resource-type placements do not change, apart fromes_domain_error_logging_enabled, which moves toaws_opensearch_domain. Merged ids that the rule pack still references are kept.delegation_unresolvedwarning names the id in its message, carries noctf.controlIds, and the report completes.ValidateForstays strict for analyzer bugs.ModuleRef.Controlsalready documents. The larger catalog places more controls on some covered types (for examples3_bucket_enforces_sslonaws_s3_bucket). Without this filter, those findings would claim the module closes controls it does not.TestEveryFixtureManifestControlIDResolvesnow also checksbuild.controls_not_applicableand the post_init fixtures. A fixture re-record from the live registry fails while the catalog lags the served manifests.Tests
TestReportToleratesAControlTheCatalogLacks(end to end) andTestDelegationUnresolvedToleratesAControlTheCatalogLacks: both fail with the exit-2 error before the fix.TestRawResourceCarriesOnlyTheModulesControls: fails before the module_source change.make check,go test -race ./..., golangci-lint v2.15.0 (0 issues),make vulncheckandprek run --all-filespass.