Closed mildas closed 2 months ago
Will this build regular playbooks in addition to per-rule ones? ... Is there some build time penalty?
Yes, regular profile playbooks are still there. They are built by default. Regarding build time penalty, there is some. During my testing it was few seconds (~10s). Not a big deal.
Does this change work with tests that use "fat" playbooks (ie. /hardening/*/ansible) when used with CONTEST_CONTENT ? .. Notice that once content is built (as detected by content_is_built(), it is not rebuilt, not even for a different test.
No. All profile playbooks are still the same on the same place with or without --playbook-per-rule
option.
Only changes are in iter_playbooks()
. But the function is used only in /static-checks/ansible/syntax-check
, so /hardening/
s are fine.
Testing passed, with the exception of /hardening/image-builder
, which I had to re-run manually after 4 errored runs, but it passed on a 5th run, so presumably not a regression caused by this PR.
Per-rule playbooks, used by console dot are in different package and located in different path than profile playbooks shipped by scap-security-guide. For built content: Profile playbooks
Rule playbooks (there are profile directories, but
all
should contain all rules from datastream):RPM: scap-security-guide
scap-security-guide-rule-playbooks
Previous approach
_find_playbooks(root).rglob('*')
worked for RPM - it traversed all/usr/share/scap-security-guide/ansible/
directories and searched for.yml
. However, it was not efficient as it checked syntax for same playbook multiple times (for each profile directory where a playbook was). It didn't work for built content thus even if we would have built it in productization, the playbooks would not be yield byiter_playbooks
. Newly implemented option--playbook-per-rule
builds per-rule playbooks via./build_product
and no need forcmake
- https://github.com/ComplianceAsCode/content/pull/12105