cisagov / log4j-affected-db

A community sourced list of log4j-affected software
Creative Commons Zero v1.0 Universal
1.12k stars 281 forks source link

Migrate to using YAML files to store product information #433

Closed mcdonnnj closed 2 years ago

mcdonnnj commented 2 years ago

🗣 Description

This pull request is a re-run of #412 with the issues raised (hopefully) resolved. It converts the existing SOFTWARE-LIST.md Markdown file into individual YAML files grouped by vendor. When a push is made to the develop branch the update_software_list.yml GitHub Actions workflow will run and update the comprehensive data/cisagov.yml file from the separate source YAML files and then generate an updated SOFTWARE-LIST.md.

This pull request is in concert with the documentation changes in #425.

💭 Motivation and context

Using a machine readable file with stricter formatting requirements to store this information should reduce human error and also make it easier for third parties to ingest our data. Using separate YAML files will ensure that pull requests using the GitHub Web UI is a viable option for less technical contributors.

This new method is reliant on the changes introduced in v1.1.0 of our Python library related to this effort.

🧪 Testing

Automated tests pass. Functionality testing was made in this branch of a testing repository.

✅ Pre-approval checklist