Fix conventions-check and add collection dependency validation#1677
Merged
st3penta merged 3 commits intoconforma:mainfrom Mar 18, 2026
Merged
Fix conventions-check and add collection dependency validation#1677st3penta merged 3 commits intoconforma:mainfrom
st3penta merged 3 commits intoconforma:mainfrom
Conversation
Introduces a new validation check to ensure that when a policy rule depends on another rule, the dependency is present in all the same collections as the dependent rule. This prevents runtime cases where a rule executes but its dependencies are not evaluated. misleading the user The check validates that dependency collections are a superset of dependent rule collections. For example, if rule A is in collections [minimal, redhat, slsa3] and depends on rule B, then rule B must also be in all three collections. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> Ref: https://issues.redhat.com/browse/EC-1671
Codecov Report✅ All modified and coverable lines are covered by tests.
... and 4 files with indirect coverage changes 🚀 New features to boost your workflow:
|
simonbaird
reviewed
Mar 5, 2026
simonbaird
reviewed
Mar 5, 2026
simonbaird
previously approved these changes
Mar 5, 2026
The conventions-check validation has been broken since PR 1198 when package names were flattened from policy.release.* to their current flat structure. The validation was filtering for namespaces starting with "data.policy" which no longer exist. This updates the policy_rule_files function to filter by file path instead of namespace prefix, and removes hardcoded "data.policy.release" assumptions throughout the validation rules. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> Ref: conforma#1198 Ref: https://issues.redhat.com/browse/EC-1671
Adds missing collection annotations to policy rules to satisfy the dependency collection validation introduced in the previous commit. These changes ensure that when dependent rules run in these collections, their dependencies are also evaluated. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> Ref: https://issues.redhat.com/browse/EC-1671
Member
|
Sorry for the wait. |
simonbaird
added a commit
to simonbaird/conforma-policy
that referenced
this pull request
Mar 19, 2026
IIUC there are no test tasks in build pipeline for Konflux rpm builds, and similarly no CVE scan tasks. These rules have been harmlessly doing nothing, but when the `test.test_data_found` and `cve.cve_results_found` checks were added in PR conforma#1677 violations started being produced. This change removes those two, but also removes the other related checks. Ref: https://redhat.atlassian.net/browse/EC-1708
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In order to fix collection dependency violations, missing collections were added to four rules:
Fix conventions-check validation
Fixes the
conventions-checktarget in the Makefile, which has been silently failing since #1198, when package names were flattened.Add collection dependency validation
Introduces a new validation check to ensure that when a policy rule depends on another rule, the dependency is present in all the same collections as the dependent rule. This prevents runtime cases where a rule executes but its dependencies are not evaluated, misleading the user.
Example: if rule A is in
[minimal, redhat, slsa3]and depends on rule B, then rule B must be in all three collectionsFix existing collection dependency violations
Adds missing collection annotations discovered by the new validation
Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com
Ref: https://issues.redhat.com/browse/EC-1671