Filter updated control files

[huiwangredhat]

The feature is trying to filter the updated control files.
The aim is to sync the control file updates to the OSCAL catalog via trestlebot tool. The sync-cac-content catalog input is the CaC content control file. So if there are any updates of the control file in CaC content, it will trigger the sync to update the OSCAL catalog.

How to test:
python content_test_filtering.py pr --base 4266a65aa118d6840c05d33d40a1612ad10bbf1c --remote_repo https://github.com/ComplianceAsCode/content --verbose --rule --profile --output json 13176

[marcusburghardt]

Do you think that would be helpful to save the output for other changes, in profiles and maybe rules? If so, we could create a generic function to save files.

[huiwangredhat]

Yeap. Sounds good. Updated. All the updates will be saved to output.json
python content_test_filtering.py pr --base 4266a65aa118d6840c05d33d40a1612ad10bbf1c --remote_repo https://github.com/ComplianceAsCode/content --verbose --rule --profile --output json 13176 > output.json

[marcusburghardt]

@matusmarhefka and @comps , could you also take a look on this PR, please?

[comps]

I have no knowledge of this codebase, hopefully @matusmarhefka has some.

[matusmarhefka]

I think it would be cleaner to add a separate option for filtering control files, e.g. --control (similar as with --rule or --profile). Because in GH Actions under CaC/content (for example https://github.com/ComplianceAsCode/content/blob/master/.github/workflows/automatus.yaml) we run CTF only with --rule option and so the Actions expect that only changes in rules will be printed on the output. With the current changes, even if there are no rule changes and just some control files changed, the output will be non-empty:

python3 content_test_filtering.py pr --base 4266a65aa118d6840c05d33d40a1612ad10bbf1c --remote_repo https://github.com/ComplianceAsCode/content --rule --output  json 13176
{"controls": ["cis_rhel10.yml", "ospp.yml", "SRG-OS-000080-GPOS-00048.yml"]}

I looked at the mentioned automatus Actions code in CaC/content and it will most likely not cause an issue, but still I would prefer to have a separate option --control for control files and only print them if the option is passed to the script.

[huiwangredhat]

Thanks for your feedback. I will add the option "--control".