feat!: migrate baseline tooling and content to Gemara v1#494
feat!: migrate baseline tooling and content to Gemara v1#494
Conversation
BREAKING CHANGE: baseline content now uses Gemara v1 schema format. Control family files use `groups`, `group` refs, and `guidelines` (renamed from `guideline-mappings`). Applicability values use `maturity-x` IDs. Framework metadata moves from `frameworks.yaml` into `metadata.yaml`. Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com> Made-with: Cursor
Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com> Made-with: Cursor
Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
Made-with: Cursor Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
funnelfiasco
left a comment
funnelfiasco
left a comment
There was a problem hiding this comment.
Looks generally good. I'm going to add a few comments in the main thread and put this on the agenda for next week's meeting.
Is this just for the validation? Are there other use cases for this output (e.g. would it be useful to anyone if we published a YAML file for releases?) |
Co-authored-by: Ben Cotton <bcotton@funnelfiasco.com> Signed-off-by: Jennifer Power <jpower@redhat.com>
The catalog YAML would likely be useful as a release artifact as well so it could be referenced/imported by other Gemara artifacts (i.e. EvaluationLog(s)). |
2 participants
Summary
gemaraproj/go-gemaraSDK and Gemara v1 schemagemaraCLI subcommand to export the assembled baseline as a single GemaraControlCatalogYAML validated with CUE in a new CI workflow to verify v1 schema conformance.Field Changes
title/descriptionper filegroupsarray withid, controls reference viagroupguideline-mappingsguidelinesMaturity Level 1maturity-1retired dropped in favor of stateframeworks.yaml(separate file)metadata.yamlCI Changes
cue-validate.yamlworkflow for CUE validation when PRs are submittedgo-version-file: cmd/go.modinstead of a hardcoded version to support the bump to Go 1.25 (needed by SDK)