feat(libs): framework II-901 #1939
Conversation
WalkthroughA new YAML file has been introduced that defines a security verification checklist based on the French interministerial instruction II-901/SGDSN/ANSSI. The file includes metadata, references, and a hierarchical structure of security requirements for information systems handling sensitive or restricted information. Each requirement is uniquely identified and categorized, covering a broad range of organizational and technical security controls. The checklist is structured for use in compliance assessments and risk management. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant ChecklistFramework
participant RequirementNode
User->>ChecklistFramework: Load II-901 YAML
ChecklistFramework->>RequirementNode: Parse and organize requirements
User->>ChecklistFramework: Query requirements for assessment
ChecklistFramework->>User: Return structured checklist and requirements
Possibly related PRs
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
backend/library/libraries/ii-901.yaml (2)
20-30: Use block scalars for long multi-line text
Thenameanddescriptionfields rely on escape sequences (\u0153,\xB0) and backslash line continuations, which reduce readability and make maintenance error-prone. Consider switching to YAML block literals (|) to express multi-line French text clearly:name: | II n°901/SGDSN/ANSSI Mise en œuvre d'un SI sensible ou DR - Liste de vérifications description: | L’instruction interministérielle no 901/SGDSN/ANSSI (II 901) du 28 janvier 2015 définit les exigences organisationnelles et techniques applicables aux systèmes d’information amenés à traiter des informations sensibles...
31-453: Review the flat list of requirement nodes for modularity
Allrequirement_nodesare currently depth1; verify this aligns with the intended hierarchical model. As the list is very large, consider splitting into thematic sections or separate YAML files (e.g.,organizational.yml,technical.yml) or grouping by category to enhance maintainability and ease of navigation.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
tools/II-901.xlsxis excluded by!**/*.xlsx
📒 Files selected for processing (1)
backend/library/libraries/ii-901.yaml(1 hunks)
🧰 Additional context used
🪛 YAMLlint (1.35.1)
backend/library/libraries/ii-901.yaml
[error] 1-1: wrong new line character: expected \n
(new-lines)
⏰ Context from checks skipped due to timeout of 90000ms (7)
- GitHub Check: startup-docker-compose-test
- GitHub Check: functional-tests (3.12, chromium)
- GitHub Check: enterprise-startup-docker-compose-test
- GitHub Check: enterprise-startup-functional-test (3.12)
- GitHub Check: enterprise-functional-tests (3.12, chromium)
- GitHub Check: test (3.12)
- GitHub Check: build (3.12)
| urn: urn:intuitem:risk:library:ii-901 | ||
| locale: fr | ||
| ref_id: II-901 | ||
| name: "II n\xB0901/SGDSN/ANSSI Mise en \u0153uvre d'un SI sensible ou DR - Liste de\ | ||
| \ v\xE9rifications" | ||
| description: "L\u2019instruction interminist\xE9rielle no 901/SGDSN/ANSSI (II 901)\ | ||
| \ du 28 janvier 2015 d\xE9finit les exigences organisationnelles et techniques applicables\ | ||
| \ aux syst\xE8mes d\u2019information amen\xE9s \xE0 traiter des informations sensibles,\ | ||
| \ dont celles portant la mention de protection Diffusion Restreinte.\n\nL'II 901\ | ||
| \ s'applique \xE9galement aux syst\xE8mes d'information amen\xE9s \xE0 traiter d'informations\ | ||
| \ classifi\xE9es de l'OTAN de niveau NATO Restricted / Restreint OTAN.\n\nL'II 901\ | ||
| \ s'applique \xE9galement aux syst\xE8mes d'information amen\xE9s \xE0 traiter d'informations\ | ||
| \ classifi\xE9es de l'UE de niveau EU Restricted / Restreint UE.\n\nLe lien du document\ | ||
| \ :\nhttps://cyber.gouv.fr/sites/default/files/2021/09/anssi-guide-recommandations_architectures_systemes_information_sensibles_ou_diffusion_restreinte-liste_verifications-v1.0-1.xlsx" | ||
| copyright: ANSSI | ||
| version: 1 | ||
| publication_date: 2025-05-05 | ||
| provider: ANSSI | ||
| packager: intuitem |
There was a problem hiding this comment.
Normalize line endings to Unix style
The static analysis report indicates wrong new line character: expected \n. This file appears to use Windows-style CRLF endings, which can break YAML parsers in CI. Please convert to LF-only line endings.
You can run:
dos2unix backend/library/libraries/ii-901.yamlor apply this diff:
- \r\n
+ \n🧰 Tools
🪛 YAMLlint (1.35.1)
[error] 1-1: wrong new line character: expected \n
(new-lines)
prise en compte des scores
Prise en compte des scores
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (2)
backend/ii-901.yaml (2)
4-5: Use a block scalar for the multi-linename.
Thenamefield currently uses escaped line breaks within a quoted string. For better readability and maintainability, switch to a YAML block scalar (|or>):name: | II n°901/SGDSN/ANSSI Mise en œuvre d'un SI sensible ou DR - Liste de vérifications
6-14: Simplifydescriptionwith a block scalar.
Thedescriptionuses embedded\nand escape sequences across lines. Converting it to a block scalar makes the content clearer:description: | L’instruction interministérielle n°901/SGDSN/ANSSI (II 901) du 28 janvier 2015 définit les exigences... (continuer le texte ici sans les séquences d'échappement)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (2)
backend/library/libraries/II-901.xlsxis excluded by!**/*.xlsxtools/II-901.xlsxis excluded by!**/*.xlsx
📒 Files selected for processing (1)
backend/ii-901.yaml(1 hunks)
🧰 Additional context used
🪛 YAMLlint (1.35.1)
backend/ii-901.yaml
[error] 1-1: wrong new line character: expected \n
(new-lines)
⏰ Context from checks skipped due to timeout of 90000ms (3)
- GitHub Check: functional-tests (3.12, chromium)
- GitHub Check: enterprise-functional-tests (3.12, chromium)
- GitHub Check: test (3.12)
| requirement_nodes: | ||
| - urn: urn:intuitem:risk:req_node:igi-901:r1 | ||
| assessable: true | ||
| depth: 1 | ||
| ref_id: R1 | ||
| name: "Trier le patrimoine informationnel par niveau de sensibilit\xE9" | ||
| - urn: urn:intuitem:risk:req_node:igi-901:r2 | ||
| assessable: true | ||
| depth: 1 | ||
| ref_id: R2 | ||
| name: "Identifier les types de SI n\xE9cessaires" |
There was a problem hiding this comment.
Align all requirement_nodes URNs with II-901.
Every requirement_nodes entry uses the prefix req_node:igi-901. To maintain consistency, update them to req_node:ii-901 throughout:
#!/bin/bash
# Convert all req_node URNs from igi-901 to ii-901
sed -i 's/req_node:igi-901/req_node:ii-901/g' backend/ii-901.yaml| @@ -0,0 +1,470 @@ | |||
| urn: urn:intuitem:risk:library:ii-901 | |||
There was a problem hiding this comment.
Fix newline character encoding.
YAMLlint reports an invalid newline character; ensure the file uses Unix-style LF (\n) line endings instead of CRLF to pass the linter.
🧰 Tools
🪛 YAMLlint (1.35.1)
[error] 1-1: wrong new line character: expected \n
(new-lines)
| urn: urn:intuitem:risk:framework:igi-901 | ||
| ref_id: II-901 | ||
| name: "II n\xB0901/SGDSN/ANSSI" | ||
| description: "Ce document reprend les exigences d\xE9finies dans l\u2019instruction\ | ||
| \ g\xE9n\xE9rale interminist\xE9rielle n\xB0 1300/SGDSN/PSE/PSD (IGI 1300) publi\xE9\ | ||
| e par l\u2019arr\xEAt\xE9 du 9 ao\xFBt 2021 portant approbation de l\u2019instruction\ | ||
| \ g\xE9n\xE9rale interminist\xE9rielle n\xB0 1300 sur la protection du secret\ | ||
| \ de la d\xE9fense nationale\n\nLe lien du document :\nhttps://cyber.gouv.fr/sites/default/files/2021/09/anssi-guide-recommandations_architectures_systemes_information_sensibles_ou_diffusion_restreinte-liste_verifications-v1.0-1.xlsx" |
There was a problem hiding this comment.
Correct framework URN and description.
The objects.framework.urn and its following description reference igi-901 and IGI 1300, which appears to be copy-pasted. They must point to the II-901 framework:
- urn: urn:intuitem:risk:framework:igi-901
+ urn: urn:intuitem:risk:framework:ii-901Also update the prose to remove IGI 1300 references and align with the II-901 instruction.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| urn: urn:intuitem:risk:framework:igi-901 | |
| ref_id: II-901 | |
| name: "II n\xB0901/SGDSN/ANSSI" | |
| description: "Ce document reprend les exigences d\xE9finies dans l\u2019instruction\ | |
| \ g\xE9n\xE9rale interminist\xE9rielle n\xB0 1300/SGDSN/PSE/PSD (IGI 1300) publi\xE9\ | |
| e par l\u2019arr\xEAt\xE9 du 9 ao\xFBt 2021 portant approbation de l\u2019instruction\ | |
| \ g\xE9n\xE9rale interminist\xE9rielle n\xB0 1300 sur la protection du secret\ | |
| \ de la d\xE9fense nationale\n\nLe lien du document :\nhttps://cyber.gouv.fr/sites/default/files/2021/09/anssi-guide-recommandations_architectures_systemes_information_sensibles_ou_diffusion_restreinte-liste_verifications-v1.0-1.xlsx" | |
| urn: urn:intuitem:risk:framework:ii-901 | |
| ref_id: II-901 | |
| name: "II n\xB0901/SGDSN/ANSSI" | |
| description: "Ce document reprend les exigences d\xE9finies dans l\u2019instruction\ | |
| \ g\xE9n\xE9rale interminist\xE9rielle n\xB0 1300/SGDSN/PSE/PSD (IGI 1300) publi\xE9\ | |
| e par l\u2019arr\xEAt\xE9 du 9 ao\xFBt 2021 portant approbation de l\u2019instruction\ | |
| \ g\xE9n\xE9rale interminist\xE9rielle n\xB0 1300 sur la protection du secret\ | |
| \ de la d\xE9fense nationale\n\nLe lien du document :\nhttps://cyber.gouv.fr/sites/default/files/2021/09/anssi-guide-recommandations_architectures_systemes_information_sensibles_ou_diffusion_restreinte-liste_verifications-v1.0-1.xlsx" |
|
merci de nouveau @StephDu66 :
|
Summary by CodeRabbit