abide_dev_utils 0.18.7 → 0.18.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 226ee5e1daa7ab9c380ef27ead4fb4add6c0310754fa530aecb6b26f54e9d528
-  data.tar.gz: dbefb5167d0ae7ca8ddf4c19d038d3f7878b3f3e38c98967ac5c78fa3a426010
+  metadata.gz: 2cb0e7cb6db8088427a363ca729869313ff57f0ebcdec8540682701fa2931215
+  data.tar.gz: c0e17b9d42924997146bf6b222ca39cab6ce6799b4d0bee4d0bd94186b0da307
 SHA512:
-  metadata.gz: b52cd754ac430a9beb40cd28ba8998263c0339479e66c8b57b54af016b51e523b6982478ceb1b1f8a05d42dda8efe7a516e4822a3ac83e967acadb71f010c30f
-  data.tar.gz: 5544a26186d04c0880e0d6851fca02cfb52c2e284201bdad6670251e6f8aa9788f8d70656903ced8abb582c675d26e9afd1bbea331a5f98f338f9a27204ec87a
+  metadata.gz: 7a7eea4740d5d5a5c7429d8b6b474fe144f6e768117e9f00eed7d87ad76f9a8cfd8cde76ab9ca5e97ac224f99131872db21922036a1321d14d4eee2dab99665e
+  data.tar.gz: d1ffabdb664b9d431d2e0ed65c5d32442829359f8bcb2c866b6c3f89a8e44a224631bc40b85f90ff6ce31646fa22b68254f606f6d7e5394a43520a062ec328cc

data/.gitignore

@@ -9,5 +9,6 @@
 /tmp/
 w10_20h2.xml
 w10_2004.xml
+.env
 # rspec failure tracking
-.rspec_status
+.rspec_status

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    abide_dev_utils (0.18.7)
+    abide_dev_utils (0.18.8)
       cmdparse (~> 3.0)
       facterdb (~> 4.1.0)
       google-cloud-storage (~> 1.34)

data/lib/abide_dev_utils/sce/benchmark.rb

@@ -222,7 +222,7 @@ module AbideDevUtils
       def filtered_profiles_levels(prof: nil, lvl: nil)
         return profiles_levels if (prof.nil? || prof.empty?) && (lvl.nil? || lvl.empty?)
         if prof && lvl && !prof.empty? && !lvl.empty?
-          return profiles_levels_by_profile(prof).concat(profiles_levels_by_level(lvl))
+          return profiles_levels_by_profile(prof) & profiles_levels_by_level(lvl)
         end
         return profiles_levels_by_profile(prof) unless prof&.empty?
 

data/lib/abide_dev_utils/sce/generate/reference.rb

@@ -78,6 +78,7 @@ module AbideDevUtils
           end
 
           def generate(doc_title = 'Reference')
+            default_profile_for_sce_linux!
             @strings = Strings.new(opts: @opts)
             md.add_title(doc_title)
             benchmarks.each do |benchmark|
@@ -121,6 +122,13 @@ module AbideDevUtils
           private
 
           attr_reader :benchmarks, :md
+
+          def default_profile_for_sce_linux!
+            return unless @module_name.split('-').last == 'sce_linux'
+            return unless @opts[:select_profile].nil? || @opts[:select_profile].empty?
+
+            @opts[:select_profile] = ['server']
+          end
         end
 
         class ConfigExampleError < StandardError; end

data/lib/abide_dev_utils/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module AbideDevUtils
-  VERSION = "0.18.7"
+  VERSION = "0.18.8"
 end

data/specifications/CEM-6541.md

@@ -0,0 +1,111 @@
+## Background
+
+The `REFERENCE.md` generated for `sce_linux` on the Forge lists `workstation` profile entries for
+many controls. SCE documentation explicitly states that only the `server` profile is supported;
+`workstation` is neither tested nor supported.
+
+Two bugs in `abide_dev_utils` cause this:
+
+**Bug 1 — `filtered_profiles_levels` uses OR logic instead of AND (`benchmark.rb:225`).**
+When both `--select-profile` (`-p`) and `--select-level` (`-l`) are passed, the method returns
+the *union* of profile-filtered and level-filtered entries:
+
+```ruby
+return profiles_levels_by_profile(prof).concat(profiles_levels_by_level(lvl))
+```
+
+`profiles_levels_by_level` returns every profile at the requested levels — including
+`workstation` — regardless of what was passed via `-p`. So even when running:
+
+```
+bundle exec abide sce generate reference -p server,classified,public,sensitive -l level_1,level_2,...
+```
+
+`workstation` entries at `level_1` and `level_2` are included because they are matched by the
+level filter and then concatenated in.
+
+**Bug 2 — No default profile filter for `sce_linux` when `-p` is omitted (`reference.rb`).**
+When `abide sce generate reference` is run without `-p`, `@opts[:select_profile]` is `nil`.
+`Control#filtered_profiles_levels` treats `nil` as "no filter", returning all profiles including
+`workstation`.
+
+## Change
+
+**File:** `lib/abide_dev_utils/sce/benchmark.rb` (modified)
+
+Change `concat` to array intersection (`&`) in `Control#filtered_profiles_levels` so that when
+both `prof` and `lvl` are given, only entries matching *both* filters are returned:
+
+```ruby
+# before
+return profiles_levels_by_profile(prof).concat(profiles_levels_by_level(lvl))
+
+# after
+return profiles_levels_by_profile(prof) & profiles_levels_by_level(lvl)
+```
+
+**File:** `lib/abide_dev_utils/sce/generate/reference.rb` (modified)
+
+In `MarkdownGenerator#generate`, default `@opts[:select_profile]` to `['server']` for `sce_linux`
+when no profile was explicitly provided. This covers invocations that omit `-p` entirely:
+
+```ruby
+def generate(doc_title = 'Reference')
+  if @module_name.split('-').last == 'sce_linux' &&
+      (@opts[:select_profile].nil? || @opts[:select_profile].empty?)
+    @opts[:select_profile] = ['server']
+  end
+  @strings = Strings.new(opts: @opts)
+  ...
+```
+
+**File:** `spec/abide_dev_utils/sce/benchmark_spec.rb` (modified)
+
+Add a test that verifies `filtered_profiles_levels` with both `prof` and `lvl` excludes profiles
+not in the filter (i.e., does not include `workstation` when only `server` is requested).
+
+**File:** `spec/abide_dev_utils/sce/generate/reference/markdown_generator_spec.rb` (new)
+
+Unit tests for the `MarkdownGenerator` opts-defaulting behavior:
+
+```ruby
+RSpec.describe(AbideDevUtils::Sce::Generate::Reference::MarkdownGenerator) do
+  context 'with puppetlabs-sce_linux and no select_profile' do
+    it 'defaults select_profile to server' do ...
+  end
+  context 'with puppetlabs-sce_linux and explicit select_profile' do
+    it 'does not override select_profile' do ...
+  end
+  context 'with a non-sce_linux module and no select_profile' do
+    it 'does not set a default select_profile' do ...
+  end
+end
+```
+
+**File:** `lib/abide_dev_utils/version.rb` (modified)
+
+Bump version from `0.18.7` to `0.18.8`.
+
+## Functional behavior
+
+After these changes:
+
+- Running with both `-p server,...` and `-l level_1,...` returns only controls that match both
+  filters — `workstation` entries at the requested levels are no longer included.
+- Running without `-p` against `sce_linux` defaults the profile filter to `['server']`, so
+  `workstation` entries are excluded in that case too.
+- Passing `-p server,workstation` explicitly still includes `workstation` (escape hatch preserved).
+
+## Non-goals
+
+- Removing `workstation` profile data from the `sce_linux` mapping YAML files.
+- Applying the `sce_linux` default profile to `sce_windows` (separate ticket if needed).
+
+## Acceptance criteria
+
+- [ ] Running `bundle exec abide sce generate reference -p server,classified,public,sensitive -l level_1,level_2,mac-1,mac-2,mac-3` against `sce_linux` produces a REFERENCE.md with no `workstation` entries.
+- [ ] Running `bundle exec abide sce generate reference` against `sce_linux` without `-p` produces a REFERENCE.md with no `workstation` entries.
+- [ ] Running with `-p server,workstation` still includes `workstation` entries (escape hatch not broken).
+- [ ] `bundle exec rspec spec/abide_dev_utils/sce/benchmark_spec.rb` passes including the new `filtered_profiles_levels` intersection test.
+- [ ] `bundle exec rspec spec/abide_dev_utils/sce/generate/reference/markdown_generator_spec.rb` passes with all three unit tests.
+- [ ] `lib/abide_dev_utils/version.rb` reads `VERSION = "0.18.8"`.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: abide_dev_utils
 version: !ruby/object:Gem::Version
-  version: 0.18.7
+  version: 0.18.8
 platform: ruby
 authors:
 - abide-team
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-06-03 00:00:00.000000000 Z
+date: 2026-06-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri
@@ -468,6 +468,7 @@ files:
 - lib/abide_dev_utils/xccdf/parser/objects/numbered_object.rb
 - lib/abide_dev_utils/xccdf/utils.rb
 - new_diff.rb
+- specifications/CEM-6541.md
 - specifications/CEM-6763.md
 homepage: https://github.com/puppetlabs/abide_dev_utils
 licenses:
@@ -492,7 +493,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.19
+rubygems_version: 3.5.22
 signing_key:
 specification_version: 4
 summary: Helper utilities for developing compliance Puppet code