Add redhat_security policy collection#1766
Open
st3penta wants to merge 1 commit into
Open
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (66)
✅ Files skipped from review due to trivial changes (60)
🚧 Files skipped from review as they are similar to previous changes (5)
📝 WalkthroughWalkthroughThis PR adds ChangesRed Hat security collection rollout
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Tools execution failed with the following error: Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error) Comment |
|
🤖 Finished Review · ✅ Success · Started 1:02 PM UTC · Completed 1:08 PM UTC |
ReviewFindingsLow
Previous runLooks good to me Previous run (2)Looks good to me |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
added
the
ready-for-merge
|
🤖 Review · |
|
🤖 Finished Review · ✅ Success · Started 1:23 PM UTC · Completed 1:28 PM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
added
ready-for-merge
Create a new redhat_security collection containing all rego rules mapped to a Red Hat ProdSec requirement. The mapping source is the conforma-prodsec-mapping.json file from EC-1967. 124 release rules across 33 files get redhat_security added to their collections annotation. Two additional dependency rules (cve_results_found and pipeline_has_tasks) are included to satisfy the conventions-check requirement that dependencies share the same collections. This is additive. It does not modify or replace the existing redhat collection. Ref: https://redhat.atlassian.net/browse/EC-1967 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
🤖 Finished Review · ✅ Success · Started 1:39 PM UTC · Completed 1:53 PM UTC |
fullsend-ai-review
Bot
added
ready-for-merge
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add a
redhat_securitycollection containing the 124 release rules that map toa ProdSec requirement. The mapping comes from the conforma-prodsec internal docs.
The existing
redhatcollection is unchanged. This is purely additive.policy/release/collection/redhat_security/redhat_securityin theircollections:annotationcollections:field now have onemaven_repos_test.regoassertions to match20 non-release rules (pipeline, task, build_task, stepaction) and 2 builtin rules
are in the mapping but not tagged, since collections only apply to release rules.
Ref: EC-1967
Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com