scelint 0.6.0 → 0.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cbcb49e907f0804f22a550c9507f56a6849ba26f2ba67f1893df0d41a289ea43
-  data.tar.gz: f4c83fa4d9e8cea6dec15625475904e7cf84f05b69de57657ad2a06b70fff5eb
+  metadata.gz: 6b16cbfa48415fa9683d44daf2788ade982a90ab980ed6c5149139f2d17d8c78
+  data.tar.gz: 78bb451017798298bac2460b9e2ab20761f0d1757b8d40d39880943baa4cdbc5
 SHA512:
-  metadata.gz: 2661057050cc3819c58818bb726a429d5e47260c2505bd08c6a084c494b24b0a359bc8a2cfa7618ef8012f71899e54ce8ef0dbb5c68d02ad74958de16edde55a
-  data.tar.gz: e2362ae54fc4107861bd76244699386489b50efefebf09211bb38b7ff44d7fd7dc4ef3df4a77a49ce25a34cecd10e4598862a841bd7a322ef408008b02ee6643
+  metadata.gz: 661faabd127dde36f197f2bac4fad65daea62994d53d63a0df412408909d39e3c9b50de55f3a18977268f1f7a69ad1475da7e78711316c3261e3624381f02235
+  data.tar.gz: c260920fb4aa2ac12e45e7ed77c7ead6f2d2a4ce51eee488f85ffac52e081ec59f5c4f6d2f25be96bf2665b76b62a9972e4ced9f8715e69eb9a04e1d28f4a848

data/.github/workflows/add_new_issue_to_triage_project.yml

@@ -1,6 +1,5 @@
-# Add new issues to triage project board (https://github.com/orgs/simp/projects/11)
+# Add newly opened issues and pull requests to the Org Triage board
 # ------------------------------------------------------------------------------
-#
 #             NOTICE: **This file is maintained with puppetsync**
 #
 # This file is updated automatically as part of a puppet module baseline.
@@ -8,19 +7,35 @@
 # The next baseline sync will overwrite any local changes to this file!
 #
 # ==============================================================================
-# This pipeline uses the following GitHub Action Secrets:
 #
-#   GitHub Secret variable               Notes
-#   -------------------------------      ---------------------------------------
-#   AUTO_TRIAGE_TOKEN                    Token with appropriate permissions
+# Board: https://github.com/orgs/simp/projects/11
 #
-# ------------------------------------------------------------------------------
+# Intake is filtered (simp/puppetsync#97): automated traffic never needs a
+# human to triage it, and letting it in buried the items that do.
+#
+#   * Renovate (and Dependabot, pre-emptively) are matched by actor.
+#   * puppetsync's own sync PRs are matched by the `[puppetsync]` title prefix.
+#     That prefix is a CONVENTION set by the `commit_message` in each sync
+#     config, not something enforced -- a config that drops it would silently
+#     start adding sync PRs to the board again.
+#
+# PRs in general are deliberately NOT filtered: drive-by PRs from outside
+# contributors are exactly what the board must catch.
+#
+# This workflow does not check out any code, which is what makes its use of
+# `pull_request_target` safe. Keep it that way.
 #
+# Labelling (`community` for outside contributions, `needs-attention` for
+# stalled items) is NOT done here: the event payload's `author_association`
+# reports private org members as CONTRIBUTOR, so a per-repo step would mislabel
+# most of the team. It lives in the scheduled org job
+# simp/gha-workflows/.github/workflows/org_reconcile_board_status.yml, which
+# resolves membership from the org member list (simp/puppetsync#98, #99).
 #
 ---
 name: Add new issues to triage project
 
-'on':
+on:
   issues:
     types:
       - opened
@@ -33,8 +48,16 @@ jobs:
   add-to-project:
     name: Add issue to project
     runs-on: ubuntu-latest
+    # `github.event.pull_request` is null on `issues` events, so the title test
+    # is guarded by event_name rather than relying on startsWith(null, ...)
+    # evaluating false.
+    if: >-
+      github.actor != 'renovate[bot]' &&
+      github.actor != 'dependabot[bot]' &&
+      !(github.event_name == 'pull_request_target' &&
+        startsWith(github.event.pull_request.title, '[puppetsync]'))
     steps:
-      - uses: actions/add-to-project@v1.0.2
+      - uses: actions/add-to-project@v2
         with:
           project-url: https://github.com/orgs/simp/projects/11
           github-token: ${{ secrets.AUTO_TRIAGE_TOKEN }}

data/.github/workflows/pr_tests.yml

@@ -13,11 +13,11 @@ jobs:
     name: 'Ruby Style'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: "Install Ruby"
         uses: ruby/setup-ruby@v1
         with:
-          ruby-version: 4.0.1
+          ruby-version: 4.0.9
           bundler-cache: true
       - run: bundle exec rake rubocop
 
@@ -33,7 +33,7 @@ jobs:
           - '4.0'  # Latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:
@@ -41,3 +41,21 @@ jobs:
           bundler-cache: true
       - name: Spec tests
         run: bundle exec rake spec
+
+  # The one check for branch protection to require: GitHub only blocks a
+  # merge on checks listed by name, and this job fails unless every job it
+  # needs succeeded. Add any new job in this workflow to `needs:`.
+  all-checks:
+    name: 'All checks'
+    if: always()
+    needs:
+      - ruby-style
+      - spec-tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Fail unless every needed job succeeded'
+        env:
+          NEEDS: ${{ toJSON(needs) }}
+        run: |
+          jq -r 'to_entries[] | "\(.key): \(.value.result)"' <<< "$NEEDS"
+          jq -e 'all(.[]; .result == "success")' <<< "$NEEDS" > /dev/null

data/.github/workflows/tag_deploy_rubygem.yml

@@ -63,7 +63,7 @@ jobs:
     steps:
       - name: "Assert '${{ github.ref }}' is a tag"
         run: '[[ "$GITHUB_REF" =~ ^refs/tags/ ]] || { echo "::error ::GITHUB_REF is not a tag: ${GITHUB_REF}"; exit 1 ; }'
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.ref }}
           clean: true
@@ -92,7 +92,7 @@ jobs:
           echo "release_command=$GEM_RELEASE_COMMAND" | tee -a "$GITHUB_OUTPUT"
       - uses: ruby/setup-ruby@v1
         with:
-          ruby-version: 4.0.1
+          ruby-version: 4.0.9
           bundler-cache: true
       - name: Test build the package
         run: "${{ steps.commands.outputs.build_command }}"
@@ -117,7 +117,7 @@ jobs:
       tag: ${{ steps.tag-check.outputs.tag }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.ref }}
           clean: true
@@ -181,13 +181,13 @@ jobs:
       PKG_DIR: ${{ needs.releng-checks.outputs.pkg_dir }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.ref }}
           clean: true
       - uses: ruby/setup-ruby@v1
         with:
-          ruby-version: 4.0.1
+          ruby-version: 4.0.9
           bundler-cache: true
       - name: Build RubyGem
         run: |

data/CHANGELOG.md

@@ -1,3 +1,13 @@
+### 0.6.2 / 2026-11-02
+* Report the file and check when data cannot be merged instead of crashing
+* Report a `profiles`, `ce` or `checks` section that is not a hash, and a check's
+  `settings`, `ces` or remediation section of the wrong type, instead of crashing
+* Report a CE's `imported_data` that is not a hash instead of crashing
+* Exit with a non-zero status when linting fails with an exception
+
+### 0.6.1 / 2026-08-20
+* Support compliance_engine 1.x
+
 ### 0.6.0 / 2026-03-11
 * Add `.scelint` defaults file support (rspec-style CLI argument defaults)
 * Add `--allow-reserved-words` option to skip reserved word checks on parameter names

data/Gemfile

@@ -3,18 +3,18 @@ source 'https://rubygems.org'
 # Specify your gem's dependencies in scelint.gemspec
 gemspec
 
-gem 'rake', '~> 13.3.0'
+gem 'rake', '~> 13.4.0'
 
 group :tests do
   gem 'rspec', '~> 3.13.1'
-  gem 'rubocop', '~> 1.85.0'
-  gem 'rubocop-performance', '~> 1.26.0'
+  gem 'rubocop', '~> 1.92.0'
+  gem 'rubocop-performance', '~> 1.27.0'
   gem 'rubocop-rake', '~> 0.7.1'
-  gem 'rubocop-rspec', '~> 3.9.0'
+  gem 'rubocop-rspec', '~> 3.10.0'
 end
 
 group :development do
   gem 'pry', '~> 0.16.0'
   gem 'pry-byebug', '~> 3.12.0'
-  gem 'rdoc', '~> 7.2.0'
+  gem 'rdoc', '~> 8.1.0'
 end

data/lib/scelint/cli.rb

@@ -81,6 +81,8 @@ class Scelint::CLI < Thor
     exit exit_code
   rescue => e
     logger.fatal e.message
+    logger.debug e.backtrace.join("\n")
+    exit 1
   end
   default_task :lint
 

data/lib/scelint/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Scelint
-  VERSION = '0.6.0'
+  VERSION = '0.6.2'
 end

data/lib/scelint.rb

@@ -314,6 +314,11 @@ module Scelint
     def check_imported_data(file, file_data)
       ok = ['checktext', 'fixtext']
 
+      unless file_data.is_a?(Hash)
+        warnings << "#{file}: bad imported_data '#{file_data}'"
+        return
+      end
+
       file_data.each do |key, value|
         warnings << "#{file}: unexpected key '#{key}'" unless ok.include?(key)
 
@@ -337,7 +342,22 @@ module Scelint
         'benchmark_version',
       ]
 
+      unless file_data.is_a?(Hash)
+        errors << "#{file}: 'profiles' must be a hash, got #{file_data.class}"
+        return
+      end
+
       file_data.each do |profile, value|
+        if value.nil?
+          warnings << "#{file} (profile '#{profile}'): empty value"
+          next
+        end
+
+        unless value.is_a?(Hash)
+          errors << "#{file} (profile '#{profile}'): contains something other than a hash"
+          next
+        end
+
         value.each_key do |key|
           warnings << "#{file} (profile '#{profile}'): unexpected key '#{key}'" unless ok.include?(key)
         end
@@ -367,7 +387,22 @@ module Scelint
         'notes',
       ]
 
+      unless file_data.is_a?(Hash)
+        errors << "#{file}: 'ce' must be a hash, got #{file_data.class}"
+        return
+      end
+
       file_data.each do |ce, value|
+        if value.nil?
+          warnings << "#{file} (CE '#{ce}'): empty value"
+          next
+        end
+
+        unless value.is_a?(Hash)
+          errors << "#{file} (CE '#{ce}'): contains something other than a hash"
+          next
+        end
+
         value.each_key do |key|
           warnings << "#{file} (CE '#{ce}'): unexpected key '#{key}'" unless ok.include?(key)
         end
@@ -445,6 +480,11 @@ module Scelint
 
       if remediation_section.is_a?(Hash)
         remediation_section.each do |section, value|
+          if ['scan-false-positive', 'disabled', 'risk'].include?(section) && !value.is_a?(Array)
+            errors << "#{file} (check '#{check}'): malformed remediation section #{section}, expecting an array."
+            next
+          end
+
           case section
           when 'scan-false-positive', 'disabled'
             value.each do |reason|
@@ -512,6 +552,16 @@ module Scelint
         return false
       end
 
+      unless file_data.is_a?(Hash)
+        msg = "#{file} (check '#{check}'): settings must be a hash, got #{file_data.class}"
+        if file == 'merged data'
+          errors << msg
+        else
+          warnings << msg
+        end
+        return false
+      end
+
       if file_data.key?('parameter')
         check_parameter(file, check, file_data['parameter'])
       else
@@ -542,12 +592,16 @@ module Scelint
     # Check CEs in a check
     #
     # @param file [String] The path to the file being checked
+    # @param check [String] The name of the check
     # @param file_data [Array] The data to validate
-    def check_check_ces(file, file_data)
-      warnings << "#{file}: bad ces '#{file_data}'" unless file_data.is_a?(Array)
+    def check_check_ces(file, check, file_data)
+      unless file_data.is_a?(Array)
+        warnings << "#{file} (check '#{check}'): bad ces '#{file_data}'"
+        return
+      end
 
       file_data.each do |key|
-        warnings << "#{file}: bad ce '#{key}'" unless key.is_a?(String)
+        warnings << "#{file} (check '#{check}'): bad ce '#{key}'" unless key.is_a?(String)
       end
     end
 
@@ -567,6 +621,11 @@ module Scelint
         'remediation',
       ]
 
+      unless file_data.is_a?(Hash)
+        errors << "#{file}: 'checks' must be a hash, got #{file_data.class}"
+        return
+      end
+
       file_data.each do |check, value|
         if value.nil?
           warnings << "#{file} (check '#{check}'): empty value"
@@ -579,6 +638,7 @@ module Scelint
           end
         else
           errors << "#{file} (check '#{check}'): contains something other than a hash, this is most likely caused by a missing note or ce element under the check"
+          next
         end
 
         check_type(file, check, value['type']) if value['type'] || file == 'merged data'
@@ -589,7 +649,7 @@ module Scelint
         check_controls(file, value['controls']) unless value['controls'].nil?
         check_identifiers(file, value['identifiers']) unless value['identifiers'].nil?
         check_oval_ids(file, value['oval-ids']) unless value['oval-ids'].nil?
-        check_check_ces(file, value['ces']) unless value['ces'].nil?
+        check_check_ces(file, check, value['ces']) unless value['ces'].nil?
         check_confine(file, value['confine']) unless value['confine'].nil?
       end
     end
@@ -672,7 +732,12 @@ module Scelint
 
       # Unconfined, verify that hiera data exists
       data.profiles.each_key do |profile|
-        hiera = data.hiera([profile])
+        begin
+          hiera = data.hiera([profile])
+        rescue => e
+          errors << "Profile '#{profile}': unable to render Hiera data (#{e.message})"
+          next
+        end
         if hiera.nil?
           errors << "Profile '#{profile}': Invalid Hiera data (returned nil)"
           next
@@ -687,8 +752,20 @@ module Scelint
       # Again, this time confined
       confines.each do |confine|
         data.facts = confine
-        data.profiles.select { |_, value| value.ces&.count&.positive? || value.controls&.count&.positive? }.each_key do |profile|
-          hiera = data.hiera([profile])
+        eligible = data.profiles.select do |profile, value|
+          value.ces&.count&.positive? || value.controls&.count&.positive?
+        rescue => e
+          errors << "Profile '#{profile}': unable to render Hiera data (#{e.message}) with facts #{confine}"
+          false
+        end
+
+        eligible.each_key do |profile|
+          begin
+            hiera = data.hiera([profile])
+          rescue => e
+            errors << "Profile '#{profile}': unable to render Hiera data (#{e.message}) with facts #{confine}"
+            next
+          end
           if hiera.nil?
             errors << "Profile '#{profile}': Invalid Hiera data (returned nil) with facts #{confine}"
             next
@@ -728,18 +805,33 @@ module Scelint
 
     # Merge a ComplianceEngine::Collection object into a Hash
     #
+    # Components that cannot be merged (usually because a fragment is
+    # malformed) are reported as errors and left out of the result rather
+    # than aborting the entire lint run.
+    #
     # @param collection [ComplianceEngine::Collection] A collection object
+    # @param type [String] The type of component in the collection, used in error messages
     # @return [Hash] The merged data
-    def merge(collection)
-      collection.to_h.reduce({}) { |result, value| result.merge!(value[0] => value[1].to_h) }
+    def merge(collection, type)
+      collection.to_h.each_with_object({}) do |(key, value), result|
+        result[key] = value.to_h
+      rescue => e
+        errors << "merged data: unable to merge #{type} '#{key}': #{e.message}"
+      end
     end
 
     # Perform lint checks on merged data
+    #
+    # @note Unlike #lint, this has no file to attribute a failure to, so any
+    #   unexpected exception is reported against 'merged data' rather than
+    #   escaping to the caller.
     def merged_data_lint
-      check_profiles('merged data', merge(data.profiles))
-      check_ce('merged data', merge(data.ces))
-      check_checks('merged data', merge(data.checks))
-      check_controls('merged data', merge(data.controls))
+      check_profiles('merged data', merge(data.profiles, 'profile'))
+      check_ce('merged data', merge(data.ces, 'CE'))
+      check_checks('merged data', merge(data.checks, 'check'))
+      check_controls('merged data', merge(data.controls, 'control'))
+    rescue => e
+      errors << "merged data: #{e.message}"
     end
   end
 end

data/scelint.gemspec

@@ -26,5 +26,5 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency 'deep_merge', '~> 1.2'
   spec.add_dependency 'thor', '~> 1.3'
-  spec.add_dependency 'compliance_engine', '>= 0.1.0', '< 0.3.0'
+  spec.add_dependency 'compliance_engine', '~> 1.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: scelint
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.6.2
 platform: ruby
 authors:
 - Steven Pritchard
@@ -41,22 +41,16 @@ dependencies:
   name: compliance_engine
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 0.1.0
-    - - "<"
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.3.0
+        version: '1.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 0.1.0
-    - - "<"
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.3.0
+        version: '1.0'
 email:
 - simp@simp-project.org
 executables:
@@ -100,7 +94,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Linter SIMP Compliance Engine data
 test_files: []