ComplianceAsCode / content

Security automation content in SCAP, Bash, Ansible, and other formats
https://complianceascode.readthedocs.io/en/latest/
Other
2.22k stars 698 forks source link

Stop SCAP content validation if not necessary #12523

Closed jan-cerny closed 1 month ago

jan-cerny commented 1 month ago

The SCAP content validation is very time consuming. The CTest test cases that perform the validation takes the most time of the CI runs. However, the likelihood of catching a serious problem by these tests is low. If anybody modifies an OVAL, they most likely try to run it in OpenSCAP or in Automatus tests and these tests would fail because of invalid OVAL.

We will introduce a new CMake option SSG_SCAP_VALIDATION_ENABLED. If this option is enable, CTest tests will contain validation of built SCAP content. The default behavior of the system doesn't change, the option is set to TRUE by default therefore the validation will be still turned on by default.

Then, we set this option to OFF in select GitHub Actions CI jobs which will stop executing SCAP content validation in these jobs.

The time of "Gate / Build, Test on Fedora Latest (Container) (pull_request)" reduced from 41 min to 26 min with this change.

github-actions[bot] commented 1 month ago

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment Open in Gitpod

Oracle Linux 8 Environment Open in Gitpod

codeclimate[bot] commented 1 month ago

Code Climate has analyzed commit f2d5488c and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 61.0% (0.0% change).

View more on Code Climate.