Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Report CEs that resolve without a title (orphaned or under-confined fragments, unlinted dotfiles)

Abierto
  • ¿Algo no está bien?
#102 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
55/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
ruby
Área
tooling

Línea de trabajo

Start by reading check_ce, merged_data_lint, validate, and the ComplianceEngine::Data/ModuleLoader loading path. Run the supplied four-file reproduction, including the dotfile, and compare lint results with platform-specific CE resolution. Done means dotfiles are checked and missing CE titles are reported both in merged data and under each confine, with the surviving fragment identified where relevant.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

needs-attention

Summary

scelint passes compliance data in which a CE resolves with no title for some set of facts. Nothing in the data is malformed; the problem only shows once fragments are merged and confined. Consumers that list CEs per platform then show these CEs as blank rows. scelint 0.6.1 (--strict) reports No errors for both cases below.

There are two ways data gets into this state. Both happen in practice:

  1. Under-confined fragment. A CE's titled fragment (usually from the benchmark file) carries a confine, but a sibling fragment for the same CE (a notes entry, say) does not. On the CE's own platform the two merge and the title is present. On every other platform the confined fragment is filtered out, only the bare notes fragment is left, and the CE appears on platforms it doesn't belong to, with no title.
  2. Orphaned fragment. A SIMP_nomap (or notes) entry names a CE that no other file defines. For example, it was written against an older benchmark version whose rule has since been removed. That fragment is the CE's only definition, so the CE exists but has no title.

Why scelint misses it today

  • check_ce only validates title when one is present (check_title(...) unless value['title'].nil?). That applies to each file and to the merged data pass. A missing title is never reported.
  • merged_data_lint runs once, unconfined. With no facts set, every fragment merges, so case 1 looks fine: the benchmark fragment supplies the title. The defect only shows under the per-confine facts that validate already enumerates (confines), and validate checks only profile Hiera data there, not CEs.
  • Dotfiles are never linted. ComplianceEngine::Data.new(path) goes through ModuleLoader, which defaults to load_dotfiles: false. So files like SIMP/compliance_profiles/.nomap-<benchmark>.yaml are skipped entirely. Zip-based environment loading does include dotfiles, so a consumer that loads a module from a zip sees data that scelint never checked. Case 2 above lived in exactly such a file.

Reproduction

A minimal module (metadata.json omitted for brevity; any valid one works):

SIMP/compliance_profiles/benchmark.yaml

---
version: 2.0.0
profiles:
  example:profile:
    title: Example profile
    ces:
      example:ce:one: true
    confine:
      os.name:
      - windows
      os.release.major:
      - '11'
ce:
  example:ce:one:
    title: Rule one has a title
    confine:
      os.name:
      - windows
      os.release.major:
      - '11'

SIMP/compliance_profiles/checks.yaml

---
version: 2.0.0
checks:
  example:check1:
    type: puppet-class-parameter
    settings:
      parameter: example::param
      value: true
    remediation:
      risk:
      - level: 21
    ces:
    - example:ce:one
    confine:
      os.name:
      - windows
      os.release.major:
      - '11'

SIMP/compliance_profiles/notes.yaml (case 1: no confine)

---
version: 2.0.0
ce:
  example:ce:one:
    notes:
    - An explanatory note.

SIMP/compliance_profiles/.nomap.yaml (case 2: CE defined nowhere else)

---
version: 2.0.0
ce:
  example:ce:retired:
    controls:
      SIMP_nomap: true
    confine:
      os.name:
      - windows
      os.release.major:
      - '11'

scelint 0.6.1 with compliance_engine 1.1.0:

$ scelint --strict .
Checked 3 files.  No errors.

It checks 3 files: .nomap.yaml isn't loaded. Loading all four files (dotfile included) and resolving CEs per platform:

facts CEs present CEs with no title
os.name: windows, os.release.major: '11' example:ce:one, example:ce:retired example:ce:retired
os.name: windows, os.release.major: '10' example:ce:one example:ce:one
os.name: RedHat, os.release.major: '9' example:ce:one example:ce:one

Proposed checks

  1. Lint dotfiles. Load module data with dotfiles included (or add an opt-in flag), so scelint checks what zip-based consumers load.
  2. Missing title in merged data. In merged_data_lint, report a CE whose merged data has no title. This catches case 2.
  3. Missing title per confine. For each entry in confines, set data.facts and report any CE that is present (non-empty merged data) but has no title. Name the fragment(s) that survived confinement, since that is where the missing confine belongs. This catches case 1, which is invisible unconfined.

Checks 2 and 3 fit as warnings, so --strict makes them fatal, consistent with the existing options.

🤖 Drafted by Claude.

Lenguaje dominante
Ruby
Estrellas
0
Forks
3
Merge medio
2 d 15 h
PR fusionados (30 d)
2

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de simp/rubygem-simp-scelint

Todos los issues de simp/rubygem-simp-scelint

Issues similares

Más issues de Ruby

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.