@portll/cobolwork 0.5.0 → 0.7.0

package/schema/cobolwork.baseline.schema.json

@@ -0,0 +1,101 @@
+{
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "$id": "https://github.com/Portll/cobolwork/schema/cobolwork.baseline.schema.json",
+ "title": "cobolwork baseline file",
+ "description": "cobolwork.baseline.json: judgements over findings, matched by fingerprint. lib/baseline.mjs reads it and refuses an entry that does not validate.",
+ "type": "object",
+ "required": [
+  "entries"
+ ],
+ "patternProperties": {
+  "^_": {}
+ },
+ "properties": {
+  "$schema": {
+   "type": "string"
+  },
+  "version": {
+   "type": "integer",
+   "minimum": 0,
+   "maximum": 1,
+   "description": "The baseline version. A file without one is read as version 0, which holds the same entries as version 1."
+  },
+  "entries": {
+   "type": "array",
+   "items": {
+    "$ref": "#/$defs/entry"
+   }
+  }
+ },
+ "$defs": {
+  "entry": {
+   "type": "object",
+   "required": [
+    "fingerprint",
+    "rule",
+    "action",
+    "reason",
+    "who",
+    "at"
+   ],
+   "properties": {
+    "fingerprint": {
+     "type": "string",
+     "pattern": "^[0-9a-f]{32}$"
+    },
+    "rule": {
+     "type": "string",
+     "minLength": 1
+    },
+    "path": {
+     "type": "string",
+     "description": "Where the finding was when the entry was written; not used to match it."
+    },
+    "action": {
+     "enum": [
+      "accept",
+      "false-positive",
+      "wont-fix",
+      "incorrect-scan-result",
+      "note",
+      "resolved"
+     ],
+     "description": "The first four suppress the finding until expires."
+    },
+    "reason": {
+     "type": "string",
+     "minLength": 1
+    },
+    "who": {
+     "type": "string",
+     "minLength": 1
+    },
+    "at": {
+     "type": "string",
+     "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}(T[0-9]{2}:[0-9]{2}(:[0-9]{2}(\\.[0-9]+)?)?(Z|[+-][0-9]{2}:?[0-9]{2})?)?$"
+    },
+    "expires": {
+     "type": [
+      "string",
+      "null"
+     ],
+     "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}(T[0-9]{2}:[0-9]{2}(:[0-9]{2}(\\.[0-9]+)?)?(Z|[+-][0-9]{2}:?[0-9]{2})?)?$",
+     "description": "Required for an action that suppresses."
+    },
+    "defect": {
+     "type": "object",
+     "required": [
+      "detail"
+     ],
+     "properties": {
+      "detail": {
+       "type": "string",
+       "minLength": 1
+      }
+     },
+     "description": "What the scanner got wrong, for incorrect-scan-result."
+    }
+   }
+  }
+ }
+}

package/schema/cobolwork.policy.schema.json

@@ -108,6 +108,13 @@
     "always"
    ],
    "description": "When every program a change edits, or whose copybooks it edits, needs an ironwork equivalence statement passed to build --equivalence: never, only when a commit in the change names a code assistant or bot as author, committer or co-author (machineAuthored), or always. The stricter of the floor and the repository applies. Default never."
+  },
+  "interface": {
+   "enum": [
+    "warn",
+    "tier"
+   ],
+   "description": "How an abend found by fuzzing a subprogram at its interface is gated, when no caller run shows a caller passes the input that gave it: warn never blocks on it, tier gates it by its tier as any other finding. The stricter of the floor and the repository applies. Default warn. cobolwork before 0.5.62 refuses this key."
   }
  },
  "$defs": {

package/schema/cobolwork.site.schema.json

@@ -0,0 +1,116 @@
+{
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "$id": "https://github.com/Portll/cobolwork/schema/cobolwork.site.schema.json",
+ "title": "cobolwork site file",
+ "description": "cobolwork.site.json: the facts about an estate that no repository holds. lib/site.mjs reads it; a key it does not read is reported under summary.siteWarnings, and a key opening with an underscore is a note for people.",
+ "type": "object",
+ "additionalProperties": false,
+ "patternProperties": {
+  "^_": {}
+ },
+ "properties": {
+  "$schema": {
+   "type": "string"
+  },
+  "version": {
+   "description": "The site file version. A file without one is read as version 0, which holds the same keys as version 1.",
+   "type": "integer",
+   "minimum": 0,
+   "maximum": 1
+  },
+  "productionQualifiers": {
+   "$ref": "#/$defs/names",
+   "description": "Dataset qualifiers that name production data, matched as whole leading components."
+  },
+  "productionJobPaths": {
+   "$ref": "#/$defs/names",
+   "description": "Paths of jobs allowed to touch production."
+  },
+  "nonProductionJobPaths": {
+   "$ref": "#/$defs/names",
+   "description": "Paths of jobs that are not production jobs."
+  },
+  "systemNames": {
+   "$ref": "#/$defs/names",
+   "description": "Names of production systems, which the recon rules look for in source."
+  },
+  "vendorPacks": {
+   "$ref": "#/$defs/names",
+   "description": "Vendor rule packs to load, by name."
+  },
+  "allowUnvalidatedPacks": {
+   "type": "boolean",
+   "description": "Load a vendor pack that has not been validated."
+  },
+  "runtimeVersions": {
+   "type": "object",
+   "description": "The version of each runtime the estate runs, by product, so an advisory against it can be matched.",
+   "additionalProperties": {
+    "type": [
+     "string",
+     "number"
+    ]
+   }
+  },
+  "internalReaderDds": {
+   "$ref": "#/$defs/names",
+   "description": "DDs in the CICS region's JCL that are SYSOUT=(class,INTRDR)."
+  },
+  "internalReaderQueues": {
+   "$ref": "#/$defs/names",
+   "description": "Transient-data queues that reach the internal reader."
+  },
+  "compilerOptions": {
+   "$ref": "#/$defs/names",
+   "description": "The estate's default compiler options, as its compile procedure sets them."
+  },
+  "apfLibraries": {
+   "$ref": "#/$defs/names",
+   "description": "APF-authorised libraries."
+  },
+  "restrictedDatasets": {
+   "$ref": "#/$defs/names",
+   "description": "Dataset prefixes only a privileged user may read."
+  },
+  "surrogateUsers": {
+   "$ref": "#/$defs/names",
+   "description": "Users a job may legitimately run as."
+  },
+  "superuserIds": {
+   "$ref": "#/$defs/names",
+   "description": "Ids privileged in UNIX System Services: UID 0, or a holder of BPX.SUPERUSER."
+  },
+  "openTransactions": {
+   "$ref": "#/$defs/names",
+   "description": "Transactions any user can start. A COBOLWORK_REACH extract overrides it."
+  },
+  "restrictedTransactions": {
+   "$ref": "#/$defs/names",
+   "description": "Transactions a control restricts. A COBOLWORK_REACH extract overrides it."
+  },
+  "openJobs": {
+   "$ref": "#/$defs/names",
+   "description": "Jobs any user can submit. A COBOLWORK_REACH extract overrides it."
+  },
+  "restrictedJobs": {
+   "$ref": "#/$defs/names",
+   "description": "Jobs a control restricts. A COBOLWORK_REACH extract overrides it."
+  },
+  "privilegedTransactions": {
+   "$ref": "#/$defs/names",
+   "description": "Transactions that run with elevated authority. A COBOLWORK_REACH extract overrides it."
+  },
+  "privilegedJobs": {
+   "$ref": "#/$defs/names",
+   "description": "Jobs that run with elevated authority. A COBOLWORK_REACH extract overrides it."
+  }
+ },
+ "$defs": {
+  "names": {
+   "type": "array",
+   "items": {
+    "type": "string"
+   }
+  }
+ }
+}