From ee82212c6c3f0ac2f4fa9254d1d8f786990a27c7 Mon Sep 17 00:00:00 2001 From: ravindrapalaskar17 <117813163+ravindrapalaskar17@users.noreply.github.com> Date: Mon, 11 Dec 2023 13:03:02 +0530 Subject: [PATCH 01/15] Draft/api linting implementation guideline (#1) * Create .spectral.yml * Create camara-language-avoid-telco.js * Create camara-reserved-words.js * Create camara-security-no-secrets-in-path-or-query-parameters.js * Create megalinter.yml * Create API-linting-Implementation-Guideline.md * update API linting document files with new links of files * Update API-linting-Implementation-Guideline.md * Create javalint.xml * Create .yamllint.yaml * reserved word 'enum' and 'default' are removed from reserved word array * Remove reserved words from arrays: openAPIKeywords and reservedWords" * Enable recommended option true/false for each rule. * Update log of telco rule * Update log of reserved word rule * Update log of camara-security-no-secrets-in-path-or-query-parameters.js * update custom function rule name * update rule name as per camara standards --- artifacts/linting_rules/.spectral.yml | 212 ++++++++++ .../camara-language-avoid-telco.js | 37 ++ .../lint_function/camara-reserved-words.js | 95 +++++ ...-no-secrets-in-path-or-query-parameters.js | 23 ++ .../lint_function/workflows/.yamllint.yaml | 32 ++ .../lint_function/workflows/javalint.xml | 372 ++++++++++++++++++ .../lint_function/workflows/megalinter.yml | 72 ++++ .../API-linting-Implementation-Guideline.md | 76 ++++ 8 files changed, 919 insertions(+) create mode 100644 artifacts/linting_rules/.spectral.yml create mode 100644 artifacts/linting_rules/lint_function/camara-language-avoid-telco.js create mode 100644 artifacts/linting_rules/lint_function/camara-reserved-words.js create mode 100644 artifacts/linting_rules/lint_function/camara-security-no-secrets-in-path-or-query-parameters.js create mode 100644 artifacts/linting_rules/lint_function/workflows/.yamllint.yaml create mode 100644 artifacts/linting_rules/lint_function/workflows/javalint.xml create mode 100644 artifacts/linting_rules/lint_function/workflows/megalinter.yml create mode 100644 documentation/API-linting-Implementation-Guideline.md diff --git a/artifacts/linting_rules/.spectral.yml b/artifacts/linting_rules/.spectral.yml new file mode 100644 index 00000000..77e403ff --- /dev/null +++ b/artifacts/linting_rules/.spectral.yml @@ -0,0 +1,212 @@ +extends: "spectral:oas" +functions: + - camara-reserved-words + - camara-language-avoid-telco + - camara-security-no-secrets-in-path-or-query-parameters +functionsDir: "./lint_function" +rules: + # Built-in OpenAPI Specification ruleset. Each rule then can be enabled individually. + # The severity keyword is optional in rule definition and can be error, warn, info, hint, or off. The default value is warn. + contact-properties: false + duplicated-entry-in-enum: true + info-contact: true + info-description: true + info-license: true + license-url: true + no-$ref-siblings: error + no-eval-in-markdown: true + no-script-tags-in-markdown: true + openapi-tags: false + openapi-tags-alphabetical: false + openapi-tags-uniqueness: error + operation-description: true + operation-operationId: true + operation-operationId-unique: error + operation-operationId-valid-in-url: true + operation-parameters: true + operation-singular-tag: true + operation-success-response: true + operation-tags: true + operation-tag-defined: true + path-declarations-must-exist: true + path-keys-no-trailing-slash: true + path-not-include-query: true + path-params: error + tag-description: false + typed-enum: true + oas3-api-servers: true + oas3-examples-value-or-externalValue: true + oas3-operation-security-defined: true + oas3-parameter-description: false + oas3-schema: true + oas3-server-not-example.com: false + oas3-server-trailing-slash: true + oas3-unused-component: true + oas3-valid-media-example: true + oas3-valid-schema-example: true + oas3-server-variables: true + + # Custom Rules Utilizing Spectral's Built-in Functions and JavaScript Implementations + + camara-language-avoid-telco: + message: "{{error}}" + severity: hint + description: | + This rule checks for telco-specific terminology in your API definitions and suggests more inclusive terms. + given: "$..*.*" + then: + function: camara-language-avoid-telco + recommended: false # Set to true/false to enable/disable this rule + + camara-oas-version: + message: "OpenAPI Version Error: The OpenAPI specification must adhere to version 3.0.3." + severity: error + description: | + This rule validates the OpenAPI version in your specification and requires compliance with version 3.0.3. + given: "$" + then: + field: openapi + function: pattern + functionOptions: + match: 3.0.3 + recommended: true # Set to true/false to enable/disable this rule + + camara-path-param-id: + message: "Path Parameter Naming Warning: Use 'resource_id' instead of just 'id' in path parameters." + severity: warn + description: | + This rule ensures consistent and descriptive naming for path parameters in your OpenAPI specification. + Please use 'resource_id' instead of just 'id' for your path parameters. + given: "$..parameters[?(@.in == 'path')]" + then: + field: name + function: pattern + functionOptions: + notMatch: \b(id|Id|ID|iD)\b + recommended: true # Set to true/false to enable/disable this rule + + camara-security-no-secrets-in-path-or-query-parameters: + message: "Sensitive data found in path: {{error}} Consider avoiding the use of Sesentive data " + severity: warn + description: | + This rule checks for sensitive data ('MSISDN' and 'IMSI') in API paths and suggests avoiding their use. + given: + - "$.paths" + then: + function: camara-security-no-secrets-in-path-or-query-parameters + recommended: true # Set to true/false to enable/disable this rule + + camara-http-methods: + description: "Ensure that all path URLs have valid HTTP methods (GET, PUT, POST, DELETE, PATCH, OPTIONS)." + message: "Invalid HTTP method for '{{path}}'. Must be one of get, put, post, delete, patch, options." + severity: error + given: $.paths[*][*]~ + then: + function: pattern + functionOptions: + match: "^(get|put|post|delete|patch|options)$" + recommended: true # Set to true/false to enable/disable this rule + + camara-get-no-request-body: + message: There must be no request body for Get and DELETE + severity: error + given: + - "$.paths.*.get" + - "$.paths.*.delete" + then: + field: requestBody + function: falsy + recommended: true # Set to true/false to enable/disable this rule + + camara-reserved-words: + message: "Reserved words found {{error}} Consider avoiding the use of reserved word " + severity: warn + description: | + This rule checks Reserved words must not be used in the following parts of an API specification [Paths, Request Body properties, Component, Operation Id, Security Schema] + given: + - "$.paths" # Paths + - "$..parameters[*]" # Path or Query Parameter Names: + - "$..components.schemas.*.properties.*" # Request and Response body parameter + - "$.paths.*." # Path and Operation Names: + - "$.components.securitySchemes" # Security Schemes: + - "$.components.*.*" # Component Names: + - "$.paths.*.*.operationId" # OperationIds: + then: + function: camara-reserved-words + recommended: true # Set to true/false to enable/disable this rule + + camara-parameters-descriptions: + message: "Parameter description is missing or empty: {{error}}" + severity: warn + description: | + This Spectral rule ensures that each parameter in the API specification, including components and properties, has a descriptive and meaningful description. + given: + - "$.components.*.*" + - "$.components.*.*.properties.*" + then: + field: description + function: truthy + recommended: true # Set to true/false to enable/disable this rule + + camara-operation-summary: + message: "Operation Summary Warning: Each operation should include a short summary for better understanding." + severity: warn + description: | + This rule checks if each operation (POST, GET, DELETE, PUT, PATCH, OPTIONS) in your API specification has a meaningful summary. + Ensure that you have added a 'summary' field for each operation in your OpenAPI specification. + given: + - "$.paths.*.post" + - "$.paths.*.get" + - "$.paths.*.delete" + - "$.paths.*.put" + - "$.paths.*.patch" + - "$.paths.*.options" + then: + field: summary + function: truthy + recommended: true # Set to true/false to enable/disable this rule + + camara-discriminator-use: + description: | + Ensure that API definition YAML files with oneOf or anyOf sections include a discriminator object for serialization, deserialization, and validation. + severity: warn + given: "$..[?(@.oneOf || @.anyOf)]" + then: + field: discriminator + function: truthy + description: "Discriminator object is required when using oneOf or anyOf." + recommended: true # Set to true/false to enable/disable this rule + + camara-operationid-casing-convention: + message: Operation Id must be in Camel case "{{error}}" + severity: hint + description: | + This rule checks Operation ids should follow a specific case convention: camel case. + given: "$.paths.*.*.operationId" + then: + function: casing + functionOptions: + type: camel + recommended: true # Set to true/false to enable/disable this rule + + camara-schema-casing-convention: + description: This rule checks schema should follow a specific case convention pascal case. + message: "{{property}} should be pascal (uppper camel case)" + severity: warn + given: $.components.schemas[*]~ + then: + function: pattern + functionOptions: + match: "^([A-Z][a-z0-9]*([A-Z][a-z0-9]*)*)$" + recommended: true # Set to true/false to enable/disable this rule + + camara-parameter-casing-convention: + description: Paths should be kebab-case. + severity: error + message: "{{property}} is not kebab-case: {{error}}" + given: $.paths[*]~ + then: + function: pattern + functionOptions: + match: "^\/([a-z0-9]+(-[a-z0-9]+)*)?(\/[a-z0-9]+(-[a-z0-9]+)*|\/{.+})*$" # doesn't allow /asasd{asdas}sadas pattern or not closed braces + recommended: true # Set to true/false to enable/disable this rule diff --git a/artifacts/linting_rules/lint_function/camara-language-avoid-telco.js b/artifacts/linting_rules/lint_function/camara-language-avoid-telco.js new file mode 100644 index 00000000..f534cf7a --- /dev/null +++ b/artifacts/linting_rules/lint_function/camara-language-avoid-telco.js @@ -0,0 +1,37 @@ +const replacements = [ + { original: 'UE', recommended: 'device' }, + { original: 'MSISDN', recommended: 'phone number' }, + { original: 'mobile network', recommended: 'network' } +]; + +export default async function (input) { + const errors = []; + const suggestions = []; + + // Iterate over properties of the input object + for (const path in input) { + const value = input[path]; + + // Check if the value is a string + if (typeof value === 'string') { + for (const replacement of replacements) { + const original = replacement.original; + const recommended = replacement.recommended; + + // Use a regular expression to match 'original' as a standalone word + const regex = new RegExp(`\\b${original}\\b`, 'g'); + + // Check if 'original' exists in the value + if (regex.test(value)) { + errors.push(replacement); + suggestions.push(` Telco-specific terminology found in input: Consider replacing '${original}' with '${recommended}'.`); + } + } + } + } + + // Check if any word from 'replacements' is in the suggestions + if (errors.length > 0) { + console.log(`Hint camara-language-avoid-telco ` + suggestions.join(', ')); + } +}; diff --git a/artifacts/linting_rules/lint_function/camara-reserved-words.js b/artifacts/linting_rules/lint_function/camara-reserved-words.js new file mode 100644 index 00000000..d82d50f4 --- /dev/null +++ b/artifacts/linting_rules/lint_function/camara-reserved-words.js @@ -0,0 +1,95 @@ +const reservedWords = [ + 'abstract', + 'apiclient', + 'apiexception', + 'apiresponse', + 'assert', + 'boolean', + 'break', + 'byte', + 'case', + 'catch', + 'char', + 'class', + 'configuration', + 'const', + 'continue', + 'do', + 'double', + 'else', + 'extends', + 'file', + 'final', + 'finally', + 'float', + 'for', + 'goto', + 'if', + 'implements', + 'import', + 'instanceof', + 'int', + 'interface', + 'list', + 'localdate', + 'localreturntype', + 'localtime', + 'localvaraccept', + 'localvaraccepts', + 'localvarauthnames', + 'localvarcollectionqueryparams', + 'localvarcontenttype', + 'localvarcontenttypes', + 'localvarcookieparams', + 'localvarformparams', + 'localvarheaderparams', + 'localvarpath', + 'localvarpostbody', + 'localvarqueryparams', + 'long', + 'native', + 'new', + 'null', + 'object', + 'offsetdatetime', + 'package', + 'private', + 'protected', + 'public', + 'return', + 'short', + 'static', + 'strictfp', + 'stringutil', + 'super', + 'switch', + 'synchronized', + 'this', + 'throw', + 'throws', + 'transient', + 'try', + 'void', + 'volatile', + 'while' +]; +// Reserved word 'enum' and 'default' are removed from above reserved word array as they are common in openAPI keyword +export default async function lintReservedWords(input) { + // Iterate over properties of the input object + for (const path in input) { + if (typeof path === 'string') { + + for (const word of reservedWords) { + const regex = new RegExp(`\\b${word}\\b`, 'g'); // Use a regular expression to match 'word' as a standalone word + + if (regex.test(path)) { + const warningRuleName = 'camara-reserved-words'; + const description = `Reserved words found in input: Consider avoiding the use of reserved word '${word}'`; + // const location = `${path}`; + + console.log(`warning ${warningRuleName} ${description} ${path}`); + } + } + } + } +} diff --git a/artifacts/linting_rules/lint_function/camara-security-no-secrets-in-path-or-query-parameters.js b/artifacts/linting_rules/lint_function/camara-security-no-secrets-in-path-or-query-parameters.js new file mode 100644 index 00000000..1811f5bb --- /dev/null +++ b/artifacts/linting_rules/lint_function/camara-security-no-secrets-in-path-or-query-parameters.js @@ -0,0 +1,23 @@ +const sensetiveData = ['MSISDN','IMSI']; + +export default async function (input) { + + // Iterate over properties of the input object + for (const path in input) { + + if (typeof path === 'string') { + for (const word of sensetiveData) { + const regex = new RegExp(`\\b${word}\\b`, 'g'); // Use a regular expression to match 'word' as a standalone word + + if (regex.test(path)) { + + const warningRuleName = 'camara-security-no-secrets-in-path-or-query-parameters'; + const description = `Sensetive Data found in path: Consider avoiding the use of Sesentive data '${word}'`; + const location = `paths.${path}`; + console.log(`warning ${warningRuleName} ${description} ${location}`); + + } + } + } + } +} diff --git a/artifacts/linting_rules/lint_function/workflows/.yamllint.yaml b/artifacts/linting_rules/lint_function/workflows/.yamllint.yaml new file mode 100644 index 00000000..b47dce98 --- /dev/null +++ b/artifacts/linting_rules/lint_function/workflows/.yamllint.yaml @@ -0,0 +1,32 @@ +--- + +yaml-files: + - '*.yaml' + - '*.yml' + - '.yamllint' + +rules: + braces: enable + brackets: enable + colons: enable + commas: enable + comments: + level: error + comments-indentation: + level: error + document-end: disable + document-start: disable + empty-lines: enable + empty-values: disable + hyphens: enable + indentation: enable + key-duplicates: enable + key-ordering: disable + line-length: disable + new-line-at-end-of-file: enable + new-lines: enable + octal-values: disable + quoted-strings: disable + trailing-spaces: enable + truthy: + level: error diff --git a/artifacts/linting_rules/lint_function/workflows/javalint.xml b/artifacts/linting_rules/lint_function/workflows/javalint.xml new file mode 100644 index 00000000..b21d8da7 --- /dev/null +++ b/artifacts/linting_rules/lint_function/workflows/javalint.xml @@ -0,0 +1,372 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/artifacts/linting_rules/lint_function/workflows/megalinter.yml b/artifacts/linting_rules/lint_function/workflows/megalinter.yml new file mode 100644 index 00000000..007438f0 --- /dev/null +++ b/artifacts/linting_rules/lint_function/workflows/megalinter.yml @@ -0,0 +1,72 @@ +--- +# MegaLinter GitHub Action configuration file +# More info at https://megalinter.io +name: MegaLinter + +on: # yamllint disable-line rule:truthy + # Pull Requests to main + pull_request: + branches: [master, main] + +env: # Comment env block if you do not want to apply fixes + # Apply linter fixes configuration + APPLY_FIXES: all # When active, APPLY_FIXES must also be defined as environment variable (in github/workflows/mega-linter.yml or other CI tool) + APPLY_FIXES_EVENT: pull_request # Decide which event triggers application of fixes in a commit or a PR (pull_request, push, all) + APPLY_FIXES_MODE: commit # If APPLY_FIXES is used, defines if the fixes are directly committed (commit) or posted in a PR (pull_request) + +concurrency: + group: ${{ github.ref }}-${{ github.workflow }} + cancel-in-progress: true + +jobs: + build: + name: MegaLinter + runs-on: ubuntu-latest + permissions: + # Give the default GITHUB_TOKEN write permission to commit and push, comment issues & post new PR + # Remove the ones you do not need + contents: write + issues: write + pull-requests: write + steps: + # Git Checkout + - name: Checkout Code + uses: actions/checkout@v3 + with: + token: ${{ secrets.GITHUB_TOKEN }} + fetch-depth: 0 # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to improve performances + - name: Install Spectral + run: npm install -g @stoplight/spectral + - name: Install Spectral functions + run: npm install -g @stoplight/spectral-functions + - name: Run spectral:oas Spectral Linting + run: spectral lint code/API_definitions/openapi.yaml --verbose --ruleset .spectral.yml + # Replace openapi.yaml file with your API specification file + + # MegaLinter + - name: MegaLinter + id: ml + # You can override MegaLinter flavor used to have faster performances + # More info at https://megalinter.io/flavors/ + uses: oxsecurity/megalinter/flavors/java@v7.3.0 + env: + # All available variables are described in documentation + # https://megalinter.io/configuration/ + # VALIDATE_ALL_CODEBASE: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} # Validates all source when push on main, else just the git diff with main. Override with true if you always want to lint all sources + VALIDATE_ALL_CODEBASE: true + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # ADD YOUR CUSTOM ENV VARIABLES HERE OR DEFINE THEM IN A FILE .mega-linter.yml AT THE ROOT OF YOUR REPOSITORY + DISABLE: COPYPASTE,MARKDOWN + DISABLE_LINTERS: SPELL_CSPELL,SPELL_LYCHEE,YAML_PRETTIER,REPOSITORY_SEMGREP,REPOSITORY_DEVSKIM,REPOSITORY_KICS,REPOSITORY_TRIVY,REPOSITORY_CHECKOV,REPOSITORY_GITLEAKS,JAVA_PMD + YAML_YAMLLINT_CONFIG_FILE: ".yamllint.yaml" + JAVA_CHECKSTYLE_CONFIG_FILE: "javalint.xml" + + # Upload MegaLinter artifacts + - name: Archive production artifacts + if: ${{ success() }} || ${{ failure() }} + uses: actions/upload-artifact@v3 + with: + name: MegaLinter reports + path: | + megalinter-reports + mega-linter.log diff --git a/documentation/API-linting-Implementation-Guideline.md b/documentation/API-linting-Implementation-Guideline.md new file mode 100644 index 00000000..aa55f6f9 --- /dev/null +++ b/documentation/API-linting-Implementation-Guideline.md @@ -0,0 +1,76 @@ +# CAMARA OpenAPI Linting Rules Implementaion Guideline [ How to integrate the rules into CAMARA repository ] + +## Introduction + +This guide provides instructions on implement linting rules for the CAMARA API using two methods: Spectral Linting and Megalinter with Spectral Linting. + +CAMARA suggests the second method, incorporating Megalinter with Spectral. + +## Megalinter with Spectral Linting + +Megalinter is an open-source tool for CI/CD workflows that analyzes the consistency of code, IAC, configuration, and scripts in repository sources. Megalinter supports Spectral Linting. + +## Implementation Files + +megalinter.yml :- Contains the configuration of megalinter along with spectral. + + .spectral.yml :- Linting rules based on the OpenAPI Specification + +## GitHub Actions Integration + +1. Add megalinter.yml to GitHub action workflow --> .github/workflows + + which include the configuration of megalinter and spectral for GitHub actions. + +2. Add .spectral.yml (Rules) File -> root location of repository + +3. Create lint-function folder + + Make a folder named lint_function at root location and add custom javascript function files that are imported in .spectral.yml (some rules require custom JavaScript functions to execute). + +4. Activate megalinter job + + The megalinter job will be automatically activated once you submit a pull request on the [main/master] branch of the CAMARA repository, as configured in megalinter. + +## Megalinter configuration: + +The megalinter configuration consists of the megalinter.yml file containing the necessary settings to run megalinter and spectral jobs on GitHub actions. + +Additionally, megalinter also supports linting of YAML and Java files. To enable this, users need to add the following ruleset files to the root location. + +1. Java Linting: javalint.xml + +2. YAML Linting: .yamllint.yaml + +## Spectral Configuration + +The spectral configuration consists of .spectral.yml file, which contains all the rules defined in the CAMARA OpenAPI specification. + +This file consolidates all rules: + +1. Spectral built-in OpenAPI specification ruleset: + + Ruleset extension: extends: "spectral:oas" + +2. Spectral rules with core functions +3. Spectral rules with customized JavaScript Functions + +## API Linting configuration steps for local + +1. Install spectral locally + + npm install -g @stoplight/spectral + +2. Intall spectral function locally. + + npm install --save @stoplight/spectral-functions + +3. Save files locally: + + Save "Spectral.yml" file (contains Linting rules) and lint_function folder (contains JavaScript customized functions) at the root location. + +4. Apply spectral rules on API specification loacally + + spectral lint openapi.yaml --verbose --ruleset .spectral.yml + + Replace 'openapi.yaml' with the path to your OpenAPI specification file From e8c103a6219be12e1cdfea54006553314c71d65b Mon Sep 17 00:00:00 2001 From: ravindrapalaskar17 <117813163+ravindrapalaskar17@users.noreply.github.com> Date: Wed, 13 Dec 2023 12:33:52 +0530 Subject: [PATCH 02/15] Update Sensitive data spelling and add phoneNumber in array. --- .../camara-security-no-secrets-in-path-or-query-parameters.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/artifacts/linting_rules/lint_function/camara-security-no-secrets-in-path-or-query-parameters.js b/artifacts/linting_rules/lint_function/camara-security-no-secrets-in-path-or-query-parameters.js index 1811f5bb..9a170b44 100644 --- a/artifacts/linting_rules/lint_function/camara-security-no-secrets-in-path-or-query-parameters.js +++ b/artifacts/linting_rules/lint_function/camara-security-no-secrets-in-path-or-query-parameters.js @@ -1,4 +1,4 @@ -const sensetiveData = ['MSISDN','IMSI']; +const sensitiveData = ['MSISDN','IMSI','phoneNumber']; export default async function (input) { From c42c43b0fd25b714becee3f4f9f847263aa096f0 Mon Sep 17 00:00:00 2001 From: ravindrapalaskar17 <117813163+ravindrapalaskar17@users.noreply.github.com> Date: Wed, 13 Dec 2023 15:54:44 +0530 Subject: [PATCH 03/15] Update Sensitive spelling from function --- .../camara-security-no-secrets-in-path-or-query-parameters.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/artifacts/linting_rules/lint_function/camara-security-no-secrets-in-path-or-query-parameters.js b/artifacts/linting_rules/lint_function/camara-security-no-secrets-in-path-or-query-parameters.js index 9a170b44..7387bb42 100644 --- a/artifacts/linting_rules/lint_function/camara-security-no-secrets-in-path-or-query-parameters.js +++ b/artifacts/linting_rules/lint_function/camara-security-no-secrets-in-path-or-query-parameters.js @@ -6,13 +6,13 @@ export default async function (input) { for (const path in input) { if (typeof path === 'string') { - for (const word of sensetiveData) { + for (const word of sensitiveData ) { const regex = new RegExp(`\\b${word}\\b`, 'g'); // Use a regular expression to match 'word' as a standalone word if (regex.test(path)) { const warningRuleName = 'camara-security-no-secrets-in-path-or-query-parameters'; - const description = `Sensetive Data found in path: Consider avoiding the use of Sesentive data '${word}'`; + const description = `sensitiveData Data found in path: Consider avoiding the use of sensitiveData data '${word}'`; const location = `paths.${path}`; console.log(`warning ${warningRuleName} ${description} ${location}`); From 64e1624911b1a8c0f987ae17f4e86b42d93b1c93 Mon Sep 17 00:00:00 2001 From: ravindrapalaskar17 <117813163+ravindrapalaskar17@users.noreply.github.com> Date: Wed, 10 Jan 2024 11:15:02 +0530 Subject: [PATCH 04/15] Update API guideline document --- documentation/API-linting-Implementation-Guideline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/documentation/API-linting-Implementation-Guideline.md b/documentation/API-linting-Implementation-Guideline.md index aa55f6f9..c588c990 100644 --- a/documentation/API-linting-Implementation-Guideline.md +++ b/documentation/API-linting-Implementation-Guideline.md @@ -2,9 +2,9 @@ ## Introduction -This guide provides instructions on implement linting rules for the CAMARA API using two methods: Spectral Linting and Megalinter with Spectral Linting. +This guide provides instructions to implement linting rules for the CAMARA APIs using two methods: Spectral Linting and Megalinter with Spectral Linting. -CAMARA suggests the second method, incorporating Megalinter with Spectral. +CAMARA recommends the second method, incorporating Megalinter with Spectral. ## Megalinter with Spectral Linting @@ -22,7 +22,7 @@ Megalinter is an open-source tool for CI/CD workflows that analyzes the consiste which include the configuration of megalinter and spectral for GitHub actions. -2. Add .spectral.yml (Rules) File -> root location of repository +2. Add .spectral.yml (rules) file to -> root location of repository 3. Create lint-function folder From f5d771c3bedb9028f7e1336874e0b9bea0d62cf4 Mon Sep 17 00:00:00 2001 From: ravindrapalaskar17 <117813163+ravindrapalaskar17@users.noreply.github.com> Date: Thu, 11 Jan 2024 18:48:53 +0530 Subject: [PATCH 05/15] Replace type pattern with spectral core casing function [ kebab and pascal] --- artifacts/linting_rules/.spectral.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/artifacts/linting_rules/.spectral.yml b/artifacts/linting_rules/.spectral.yml index 77e403ff..306c6288 100644 --- a/artifacts/linting_rules/.spectral.yml +++ b/artifacts/linting_rules/.spectral.yml @@ -191,22 +191,22 @@ rules: camara-schema-casing-convention: description: This rule checks schema should follow a specific case convention pascal case. - message: "{{property}} should be pascal (uppper camel case)" + message: "{{property}} should be pascal case (UppperCamelCase)" severity: warn given: $.components.schemas[*]~ then: - function: pattern + function: casing functionOptions: - match: "^([A-Z][a-z0-9]*([A-Z][a-z0-9]*)*)$" + type: pascal recommended: true # Set to true/false to enable/disable this rule camara-parameter-casing-convention: - description: Paths should be kebab-case. + description: This rule checks Paths should follow a specific case convention kebab-case. severity: error - message: "{{property}} is not kebab-case: {{error}}" + message: "{{property}} should be kebab-case: {{error}}" given: $.paths[*]~ then: - function: pattern + function: casing functionOptions: - match: "^\/([a-z0-9]+(-[a-z0-9]+)*)?(\/[a-z0-9]+(-[a-z0-9]+)*|\/{.+})*$" # doesn't allow /asasd{asdas}sadas pattern or not closed braces + type: kebab recommended: true # Set to true/false to enable/disable this rule From 98420998bed874e2c12333c69daee2bfce3582b9 Mon Sep 17 00:00:00 2001 From: ravindrapalaskar17 <117813163+ravindrapalaskar17@users.noreply.github.com> Date: Thu, 25 Jan 2024 16:06:45 +0530 Subject: [PATCH 06/15] change megalinter.yml position --- .../.github/workflows/megalinter.yml | 72 +++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100644 artifacts/Github_templates/.github/workflows/megalinter.yml diff --git a/artifacts/Github_templates/.github/workflows/megalinter.yml b/artifacts/Github_templates/.github/workflows/megalinter.yml new file mode 100644 index 00000000..007438f0 --- /dev/null +++ b/artifacts/Github_templates/.github/workflows/megalinter.yml @@ -0,0 +1,72 @@ +--- +# MegaLinter GitHub Action configuration file +# More info at https://megalinter.io +name: MegaLinter + +on: # yamllint disable-line rule:truthy + # Pull Requests to main + pull_request: + branches: [master, main] + +env: # Comment env block if you do not want to apply fixes + # Apply linter fixes configuration + APPLY_FIXES: all # When active, APPLY_FIXES must also be defined as environment variable (in github/workflows/mega-linter.yml or other CI tool) + APPLY_FIXES_EVENT: pull_request # Decide which event triggers application of fixes in a commit or a PR (pull_request, push, all) + APPLY_FIXES_MODE: commit # If APPLY_FIXES is used, defines if the fixes are directly committed (commit) or posted in a PR (pull_request) + +concurrency: + group: ${{ github.ref }}-${{ github.workflow }} + cancel-in-progress: true + +jobs: + build: + name: MegaLinter + runs-on: ubuntu-latest + permissions: + # Give the default GITHUB_TOKEN write permission to commit and push, comment issues & post new PR + # Remove the ones you do not need + contents: write + issues: write + pull-requests: write + steps: + # Git Checkout + - name: Checkout Code + uses: actions/checkout@v3 + with: + token: ${{ secrets.GITHUB_TOKEN }} + fetch-depth: 0 # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to improve performances + - name: Install Spectral + run: npm install -g @stoplight/spectral + - name: Install Spectral functions + run: npm install -g @stoplight/spectral-functions + - name: Run spectral:oas Spectral Linting + run: spectral lint code/API_definitions/openapi.yaml --verbose --ruleset .spectral.yml + # Replace openapi.yaml file with your API specification file + + # MegaLinter + - name: MegaLinter + id: ml + # You can override MegaLinter flavor used to have faster performances + # More info at https://megalinter.io/flavors/ + uses: oxsecurity/megalinter/flavors/java@v7.3.0 + env: + # All available variables are described in documentation + # https://megalinter.io/configuration/ + # VALIDATE_ALL_CODEBASE: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} # Validates all source when push on main, else just the git diff with main. Override with true if you always want to lint all sources + VALIDATE_ALL_CODEBASE: true + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # ADD YOUR CUSTOM ENV VARIABLES HERE OR DEFINE THEM IN A FILE .mega-linter.yml AT THE ROOT OF YOUR REPOSITORY + DISABLE: COPYPASTE,MARKDOWN + DISABLE_LINTERS: SPELL_CSPELL,SPELL_LYCHEE,YAML_PRETTIER,REPOSITORY_SEMGREP,REPOSITORY_DEVSKIM,REPOSITORY_KICS,REPOSITORY_TRIVY,REPOSITORY_CHECKOV,REPOSITORY_GITLEAKS,JAVA_PMD + YAML_YAMLLINT_CONFIG_FILE: ".yamllint.yaml" + JAVA_CHECKSTYLE_CONFIG_FILE: "javalint.xml" + + # Upload MegaLinter artifacts + - name: Archive production artifacts + if: ${{ success() }} || ${{ failure() }} + uses: actions/upload-artifact@v3 + with: + name: MegaLinter reports + path: | + megalinter-reports + mega-linter.log From ad14389260504731221062edf8d6ab17361dbdfb Mon Sep 17 00:00:00 2001 From: ravindrapalaskar17 <117813163+ravindrapalaskar17@users.noreply.github.com> Date: Thu, 25 Jan 2024 16:12:42 +0530 Subject: [PATCH 07/15] change position of megalinter.yml file --- .../.github/workflows/megalinter.yml | 72 +++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100644 artifacts/linting_rules/.github/workflows/megalinter.yml diff --git a/artifacts/linting_rules/.github/workflows/megalinter.yml b/artifacts/linting_rules/.github/workflows/megalinter.yml new file mode 100644 index 00000000..007438f0 --- /dev/null +++ b/artifacts/linting_rules/.github/workflows/megalinter.yml @@ -0,0 +1,72 @@ +--- +# MegaLinter GitHub Action configuration file +# More info at https://megalinter.io +name: MegaLinter + +on: # yamllint disable-line rule:truthy + # Pull Requests to main + pull_request: + branches: [master, main] + +env: # Comment env block if you do not want to apply fixes + # Apply linter fixes configuration + APPLY_FIXES: all # When active, APPLY_FIXES must also be defined as environment variable (in github/workflows/mega-linter.yml or other CI tool) + APPLY_FIXES_EVENT: pull_request # Decide which event triggers application of fixes in a commit or a PR (pull_request, push, all) + APPLY_FIXES_MODE: commit # If APPLY_FIXES is used, defines if the fixes are directly committed (commit) or posted in a PR (pull_request) + +concurrency: + group: ${{ github.ref }}-${{ github.workflow }} + cancel-in-progress: true + +jobs: + build: + name: MegaLinter + runs-on: ubuntu-latest + permissions: + # Give the default GITHUB_TOKEN write permission to commit and push, comment issues & post new PR + # Remove the ones you do not need + contents: write + issues: write + pull-requests: write + steps: + # Git Checkout + - name: Checkout Code + uses: actions/checkout@v3 + with: + token: ${{ secrets.GITHUB_TOKEN }} + fetch-depth: 0 # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to improve performances + - name: Install Spectral + run: npm install -g @stoplight/spectral + - name: Install Spectral functions + run: npm install -g @stoplight/spectral-functions + - name: Run spectral:oas Spectral Linting + run: spectral lint code/API_definitions/openapi.yaml --verbose --ruleset .spectral.yml + # Replace openapi.yaml file with your API specification file + + # MegaLinter + - name: MegaLinter + id: ml + # You can override MegaLinter flavor used to have faster performances + # More info at https://megalinter.io/flavors/ + uses: oxsecurity/megalinter/flavors/java@v7.3.0 + env: + # All available variables are described in documentation + # https://megalinter.io/configuration/ + # VALIDATE_ALL_CODEBASE: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} # Validates all source when push on main, else just the git diff with main. Override with true if you always want to lint all sources + VALIDATE_ALL_CODEBASE: true + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # ADD YOUR CUSTOM ENV VARIABLES HERE OR DEFINE THEM IN A FILE .mega-linter.yml AT THE ROOT OF YOUR REPOSITORY + DISABLE: COPYPASTE,MARKDOWN + DISABLE_LINTERS: SPELL_CSPELL,SPELL_LYCHEE,YAML_PRETTIER,REPOSITORY_SEMGREP,REPOSITORY_DEVSKIM,REPOSITORY_KICS,REPOSITORY_TRIVY,REPOSITORY_CHECKOV,REPOSITORY_GITLEAKS,JAVA_PMD + YAML_YAMLLINT_CONFIG_FILE: ".yamllint.yaml" + JAVA_CHECKSTYLE_CONFIG_FILE: "javalint.xml" + + # Upload MegaLinter artifacts + - name: Archive production artifacts + if: ${{ success() }} || ${{ failure() }} + uses: actions/upload-artifact@v3 + with: + name: MegaLinter reports + path: | + megalinter-reports + mega-linter.log From c7481b080045c6100c13705f00c737f9a335fa7a Mon Sep 17 00:00:00 2001 From: ravindrapalaskar17 <117813163+ravindrapalaskar17@users.noreply.github.com> Date: Thu, 25 Jan 2024 16:16:21 +0530 Subject: [PATCH 08/15] change position of javalint.xml --- artifacts/linting_rules/javalint.xml | 372 +++++++++++++++++++++++++++ 1 file changed, 372 insertions(+) create mode 100644 artifacts/linting_rules/javalint.xml diff --git a/artifacts/linting_rules/javalint.xml b/artifacts/linting_rules/javalint.xml new file mode 100644 index 00000000..b21d8da7 --- /dev/null +++ b/artifacts/linting_rules/javalint.xml @@ -0,0 +1,372 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + From 91bf9b34d5b2a53d414ab1139f4cb57a6d6879e6 Mon Sep 17 00:00:00 2001 From: ravindrapalaskar17 <117813163+ravindrapalaskar17@users.noreply.github.com> Date: Thu, 25 Jan 2024 16:17:01 +0530 Subject: [PATCH 09/15] change location of .yamllint.yaml --- artifacts/linting_rules/.yamllint.yaml | 32 ++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 artifacts/linting_rules/.yamllint.yaml diff --git a/artifacts/linting_rules/.yamllint.yaml b/artifacts/linting_rules/.yamllint.yaml new file mode 100644 index 00000000..b47dce98 --- /dev/null +++ b/artifacts/linting_rules/.yamllint.yaml @@ -0,0 +1,32 @@ +--- + +yaml-files: + - '*.yaml' + - '*.yml' + - '.yamllint' + +rules: + braces: enable + brackets: enable + colons: enable + commas: enable + comments: + level: error + comments-indentation: + level: error + document-end: disable + document-start: disable + empty-lines: enable + empty-values: disable + hyphens: enable + indentation: enable + key-duplicates: enable + key-ordering: disable + line-length: disable + new-line-at-end-of-file: enable + new-lines: enable + octal-values: disable + quoted-strings: disable + trailing-spaces: enable + truthy: + level: error From da45a2ee52ee0ed04dd9479cf9357e953ca01a58 Mon Sep 17 00:00:00 2001 From: ravindrapalaskar17 <117813163+ravindrapalaskar17@users.noreply.github.com> Date: Thu, 25 Jan 2024 16:17:49 +0530 Subject: [PATCH 10/15] Delete artifacts/linting_rules/lint_function/workflows directory --- .../lint_function/workflows/.yamllint.yaml | 32 -- .../lint_function/workflows/javalint.xml | 372 ------------------ .../lint_function/workflows/megalinter.yml | 72 ---- 3 files changed, 476 deletions(-) delete mode 100644 artifacts/linting_rules/lint_function/workflows/.yamllint.yaml delete mode 100644 artifacts/linting_rules/lint_function/workflows/javalint.xml delete mode 100644 artifacts/linting_rules/lint_function/workflows/megalinter.yml diff --git a/artifacts/linting_rules/lint_function/workflows/.yamllint.yaml b/artifacts/linting_rules/lint_function/workflows/.yamllint.yaml deleted file mode 100644 index b47dce98..00000000 --- a/artifacts/linting_rules/lint_function/workflows/.yamllint.yaml +++ /dev/null @@ -1,32 +0,0 @@ ---- - -yaml-files: - - '*.yaml' - - '*.yml' - - '.yamllint' - -rules: - braces: enable - brackets: enable - colons: enable - commas: enable - comments: - level: error - comments-indentation: - level: error - document-end: disable - document-start: disable - empty-lines: enable - empty-values: disable - hyphens: enable - indentation: enable - key-duplicates: enable - key-ordering: disable - line-length: disable - new-line-at-end-of-file: enable - new-lines: enable - octal-values: disable - quoted-strings: disable - trailing-spaces: enable - truthy: - level: error diff --git a/artifacts/linting_rules/lint_function/workflows/javalint.xml b/artifacts/linting_rules/lint_function/workflows/javalint.xml deleted file mode 100644 index b21d8da7..00000000 --- a/artifacts/linting_rules/lint_function/workflows/javalint.xml +++ /dev/null @@ -1,372 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/artifacts/linting_rules/lint_function/workflows/megalinter.yml b/artifacts/linting_rules/lint_function/workflows/megalinter.yml deleted file mode 100644 index 007438f0..00000000 --- a/artifacts/linting_rules/lint_function/workflows/megalinter.yml +++ /dev/null @@ -1,72 +0,0 @@ ---- -# MegaLinter GitHub Action configuration file -# More info at https://megalinter.io -name: MegaLinter - -on: # yamllint disable-line rule:truthy - # Pull Requests to main - pull_request: - branches: [master, main] - -env: # Comment env block if you do not want to apply fixes - # Apply linter fixes configuration - APPLY_FIXES: all # When active, APPLY_FIXES must also be defined as environment variable (in github/workflows/mega-linter.yml or other CI tool) - APPLY_FIXES_EVENT: pull_request # Decide which event triggers application of fixes in a commit or a PR (pull_request, push, all) - APPLY_FIXES_MODE: commit # If APPLY_FIXES is used, defines if the fixes are directly committed (commit) or posted in a PR (pull_request) - -concurrency: - group: ${{ github.ref }}-${{ github.workflow }} - cancel-in-progress: true - -jobs: - build: - name: MegaLinter - runs-on: ubuntu-latest - permissions: - # Give the default GITHUB_TOKEN write permission to commit and push, comment issues & post new PR - # Remove the ones you do not need - contents: write - issues: write - pull-requests: write - steps: - # Git Checkout - - name: Checkout Code - uses: actions/checkout@v3 - with: - token: ${{ secrets.GITHUB_TOKEN }} - fetch-depth: 0 # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to improve performances - - name: Install Spectral - run: npm install -g @stoplight/spectral - - name: Install Spectral functions - run: npm install -g @stoplight/spectral-functions - - name: Run spectral:oas Spectral Linting - run: spectral lint code/API_definitions/openapi.yaml --verbose --ruleset .spectral.yml - # Replace openapi.yaml file with your API specification file - - # MegaLinter - - name: MegaLinter - id: ml - # You can override MegaLinter flavor used to have faster performances - # More info at https://megalinter.io/flavors/ - uses: oxsecurity/megalinter/flavors/java@v7.3.0 - env: - # All available variables are described in documentation - # https://megalinter.io/configuration/ - # VALIDATE_ALL_CODEBASE: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} # Validates all source when push on main, else just the git diff with main. Override with true if you always want to lint all sources - VALIDATE_ALL_CODEBASE: true - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # ADD YOUR CUSTOM ENV VARIABLES HERE OR DEFINE THEM IN A FILE .mega-linter.yml AT THE ROOT OF YOUR REPOSITORY - DISABLE: COPYPASTE,MARKDOWN - DISABLE_LINTERS: SPELL_CSPELL,SPELL_LYCHEE,YAML_PRETTIER,REPOSITORY_SEMGREP,REPOSITORY_DEVSKIM,REPOSITORY_KICS,REPOSITORY_TRIVY,REPOSITORY_CHECKOV,REPOSITORY_GITLEAKS,JAVA_PMD - YAML_YAMLLINT_CONFIG_FILE: ".yamllint.yaml" - JAVA_CHECKSTYLE_CONFIG_FILE: "javalint.xml" - - # Upload MegaLinter artifacts - - name: Archive production artifacts - if: ${{ success() }} || ${{ failure() }} - uses: actions/upload-artifact@v3 - with: - name: MegaLinter reports - path: | - megalinter-reports - mega-linter.log From aaeb455e3400347de1ae6558337ef739cb943837 Mon Sep 17 00:00:00 2001 From: ravindrapalaskar17 <117813163+ravindrapalaskar17@users.noreply.github.com> Date: Thu, 25 Jan 2024 16:21:10 +0530 Subject: [PATCH 11/15] Delete artifacts/Github_templates/.github/workflows directory --- .../.github/workflows/megalinter.yml | 72 ------------------- 1 file changed, 72 deletions(-) delete mode 100644 artifacts/Github_templates/.github/workflows/megalinter.yml diff --git a/artifacts/Github_templates/.github/workflows/megalinter.yml b/artifacts/Github_templates/.github/workflows/megalinter.yml deleted file mode 100644 index 007438f0..00000000 --- a/artifacts/Github_templates/.github/workflows/megalinter.yml +++ /dev/null @@ -1,72 +0,0 @@ ---- -# MegaLinter GitHub Action configuration file -# More info at https://megalinter.io -name: MegaLinter - -on: # yamllint disable-line rule:truthy - # Pull Requests to main - pull_request: - branches: [master, main] - -env: # Comment env block if you do not want to apply fixes - # Apply linter fixes configuration - APPLY_FIXES: all # When active, APPLY_FIXES must also be defined as environment variable (in github/workflows/mega-linter.yml or other CI tool) - APPLY_FIXES_EVENT: pull_request # Decide which event triggers application of fixes in a commit or a PR (pull_request, push, all) - APPLY_FIXES_MODE: commit # If APPLY_FIXES is used, defines if the fixes are directly committed (commit) or posted in a PR (pull_request) - -concurrency: - group: ${{ github.ref }}-${{ github.workflow }} - cancel-in-progress: true - -jobs: - build: - name: MegaLinter - runs-on: ubuntu-latest - permissions: - # Give the default GITHUB_TOKEN write permission to commit and push, comment issues & post new PR - # Remove the ones you do not need - contents: write - issues: write - pull-requests: write - steps: - # Git Checkout - - name: Checkout Code - uses: actions/checkout@v3 - with: - token: ${{ secrets.GITHUB_TOKEN }} - fetch-depth: 0 # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to improve performances - - name: Install Spectral - run: npm install -g @stoplight/spectral - - name: Install Spectral functions - run: npm install -g @stoplight/spectral-functions - - name: Run spectral:oas Spectral Linting - run: spectral lint code/API_definitions/openapi.yaml --verbose --ruleset .spectral.yml - # Replace openapi.yaml file with your API specification file - - # MegaLinter - - name: MegaLinter - id: ml - # You can override MegaLinter flavor used to have faster performances - # More info at https://megalinter.io/flavors/ - uses: oxsecurity/megalinter/flavors/java@v7.3.0 - env: - # All available variables are described in documentation - # https://megalinter.io/configuration/ - # VALIDATE_ALL_CODEBASE: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} # Validates all source when push on main, else just the git diff with main. Override with true if you always want to lint all sources - VALIDATE_ALL_CODEBASE: true - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # ADD YOUR CUSTOM ENV VARIABLES HERE OR DEFINE THEM IN A FILE .mega-linter.yml AT THE ROOT OF YOUR REPOSITORY - DISABLE: COPYPASTE,MARKDOWN - DISABLE_LINTERS: SPELL_CSPELL,SPELL_LYCHEE,YAML_PRETTIER,REPOSITORY_SEMGREP,REPOSITORY_DEVSKIM,REPOSITORY_KICS,REPOSITORY_TRIVY,REPOSITORY_CHECKOV,REPOSITORY_GITLEAKS,JAVA_PMD - YAML_YAMLLINT_CONFIG_FILE: ".yamllint.yaml" - JAVA_CHECKSTYLE_CONFIG_FILE: "javalint.xml" - - # Upload MegaLinter artifacts - - name: Archive production artifacts - if: ${{ success() }} || ${{ failure() }} - uses: actions/upload-artifact@v3 - with: - name: MegaLinter reports - path: | - megalinter-reports - mega-linter.log From 29e4e9da8b8ca7dd0e435fb8a942ac4ba3952b59 Mon Sep 17 00:00:00 2001 From: Rafal Artych <121048129+rartych@users.noreply.github.com> Date: Fri, 2 Feb 2024 09:55:04 +0100 Subject: [PATCH 12/15] Api linting rartych (#2) * Update camara-language-avoid-telco.js Header comment added * Update camara-reserved-words.js Header comment added * Update camara-security-no-secrets-in-path-or-query-parameters.js Header comment added * Update .spectral.yml Comment header added * Update .yamllint.yaml Header comment added * Delete artifacts/linting_rules/javalint.xml By default Java is not used in API specification repositories * Update megalinter.yml Header comment extended * Update .yamllint.yaml Changes in default configuration of yamllint * Update .spectral.yml oas3-operation-security-defined rule was disabled as it do not fully support OpenIdConnect flow * Update megalinter.yml Megalinter configuration change, disable not needed linters * Update megalinter.yml Disable running spectral outside of Megalinter * Create spectral_oas_lint.yml workflow configuration to manually run CAMARA OAS rules * Update spectral_oas_lint.yml Simplification * Update .spectral.yml New functions added/modified (more granularity for descriptions) * Update .spectral.yml typo * Update API-linting-Implementation-Guideline.md Modification and reshuffling of the how-to file * Update spectral_oas_lint.yml * Update .spectral.yml Changed camara-discriminator-use severity to: hint * Update .spectral.yml oas3-server-variables commented out * Update megalinter.yml Actions checkout@v4 upload-artifact@v4 --- .../.github/workflows/megalinter.yml | 17 +- .../.github/workflows/spectral_oas_lint.yml | 36 ++ artifacts/linting_rules/.spectral.yml | 66 +++- artifacts/linting_rules/.yamllint.yaml | 6 +- artifacts/linting_rules/javalint.xml | 372 ------------------ .../camara-language-avoid-telco.js | 3 + .../lint_function/camara-reserved-words.js | 3 + ...-no-secrets-in-path-or-query-parameters.js | 3 + .../API-linting-Implementation-Guideline.md | 69 ++-- 9 files changed, 154 insertions(+), 421 deletions(-) create mode 100644 artifacts/linting_rules/.github/workflows/spectral_oas_lint.yml delete mode 100644 artifacts/linting_rules/javalint.xml diff --git a/artifacts/linting_rules/.github/workflows/megalinter.yml b/artifacts/linting_rules/.github/workflows/megalinter.yml index 007438f0..455905e8 100644 --- a/artifacts/linting_rules/.github/workflows/megalinter.yml +++ b/artifacts/linting_rules/.github/workflows/megalinter.yml @@ -1,6 +1,9 @@ --- # MegaLinter GitHub Action configuration file # More info at https://megalinter.io +# CAMARA Project - Github Action for Pull Reqests +# 31.01.2024 - initial version + name: MegaLinter on: # yamllint disable-line rule:truthy @@ -31,7 +34,7 @@ jobs: steps: # Git Checkout - name: Checkout Code - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: token: ${{ secrets.GITHUB_TOKEN }} fetch-depth: 0 # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to improve performances @@ -39,8 +42,8 @@ jobs: run: npm install -g @stoplight/spectral - name: Install Spectral functions run: npm install -g @stoplight/spectral-functions - - name: Run spectral:oas Spectral Linting - run: spectral lint code/API_definitions/openapi.yaml --verbose --ruleset .spectral.yml + # - name: Run spectral:oas Spectral Linting + # run: spectral lint code/API_definitions/*.yaml --verbose --ruleset .spectral.yml # Replace openapi.yaml file with your API specification file # MegaLinter @@ -52,19 +55,21 @@ jobs: env: # All available variables are described in documentation # https://megalinter.io/configuration/ + PRINT_ALPACA: false # VALIDATE_ALL_CODEBASE: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} # Validates all source when push on main, else just the git diff with main. Override with true if you always want to lint all sources VALIDATE_ALL_CODEBASE: true GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # ADD YOUR CUSTOM ENV VARIABLES HERE OR DEFINE THEM IN A FILE .mega-linter.yml AT THE ROOT OF YOUR REPOSITORY DISABLE: COPYPASTE,MARKDOWN - DISABLE_LINTERS: SPELL_CSPELL,SPELL_LYCHEE,YAML_PRETTIER,REPOSITORY_SEMGREP,REPOSITORY_DEVSKIM,REPOSITORY_KICS,REPOSITORY_TRIVY,REPOSITORY_CHECKOV,REPOSITORY_GITLEAKS,JAVA_PMD + DISABLE_LINTERS: SPELL_CSPELL,SPELL_LYCHEE,YAML_PRETTIER,REPOSITORY_GRYPE, REPOSITORY_SEMGREP,REPOSITORY_DEVSKIM,REPOSITORY_KICS,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,REPOSITORY_CHECKOV,REPOSITORY_GITLEAKS,YAML_V8R,JAVA_PMD,JAVA_CHECKSTYLE YAML_YAMLLINT_CONFIG_FILE: ".yamllint.yaml" - JAVA_CHECKSTYLE_CONFIG_FILE: "javalint.xml" + OPENAPI_SPECTRAL_CONFIG_FILE: ".spectral.yml" + YAML_YAMLLINT_FILTER_REGEX_INCLUDE: "(code/)" # Upload MegaLinter artifacts - name: Archive production artifacts if: ${{ success() }} || ${{ failure() }} - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@v4 with: name: MegaLinter reports path: | diff --git a/artifacts/linting_rules/.github/workflows/spectral_oas_lint.yml b/artifacts/linting_rules/.github/workflows/spectral_oas_lint.yml new file mode 100644 index 00000000..a828fd58 --- /dev/null +++ b/artifacts/linting_rules/.github/workflows/spectral_oas_lint.yml @@ -0,0 +1,36 @@ +--- +# CAMARA Project - workflow configuration to manually run CAMARA OAS rules +# see https://docs.github.com/en/actions/using-workflows/manually-running-a-workflow +# 31.01.2024 - initial version + +name: Spectral manual run + +on: workflow_dispatch + +concurrency: + group: ${{ github.ref }}-${{ github.workflow }} + cancel-in-progress: true + +jobs: + build: + name: Spectral linting + runs-on: ubuntu-latest + permissions: + # Give the default GITHUB_TOKEN write permission to commit and push, comment issues & post new PR + # Remove the ones you do not need + contents: write + issues: write + pull-requests: write + steps: + # Git Checkout + - name: Checkout Code + uses: actions/checkout@v4 + with: + token: ${{ secrets.GITHUB_TOKEN }} + fetch-depth: 0 # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to improve performances + - name: Install Spectral + run: npm install -g @stoplight/spectral + - name: Install Spectral functions + run: npm install -g @stoplight/spectral-functions + - name: Run Spectral linting + run: spectral lint code/API_definitions/*.yaml --verbose --ruleset .spectral.yml diff --git a/artifacts/linting_rules/.spectral.yml b/artifacts/linting_rules/.spectral.yml index 306c6288..399816d1 100644 --- a/artifacts/linting_rules/.spectral.yml +++ b/artifacts/linting_rules/.spectral.yml @@ -1,3 +1,7 @@ +# CAMARA Project - linting ruleset - documentation avaialable here: +# https://github.com/camaraproject/Commonalities/blob/main/documentation/Linting-rules.md +# 31.01.2024 - initial version + extends: "spectral:oas" functions: - camara-reserved-words @@ -36,7 +40,7 @@ rules: typed-enum: true oas3-api-servers: true oas3-examples-value-or-externalValue: true - oas3-operation-security-defined: true + oas3-operation-security-defined: false oas3-parameter-description: false oas3-schema: true oas3-server-not-example.com: false @@ -44,7 +48,7 @@ rules: oas3-unused-component: true oas3-valid-media-example: true oas3-valid-schema-example: true - oas3-server-variables: true + # oas3-server-variables: true # Custom Rules Utilizing Spectral's Built-in Functions and JavaScript Implementations @@ -134,12 +138,54 @@ rules: then: function: camara-reserved-words recommended: true # Set to true/false to enable/disable this rule - + + camara-routes-description: + message: "Functionality method description Warning: Each method should have description." + severity: warn + description: | + This rule checks if each operation (POST, GET, DELETE, PUT, PATCH, OPTIONS) in your API specification has a description. + Ensure that you have added a 'summary' field for each operation in your OpenAPI specification. + given: + - "$.paths.*.post" + - "$.paths.*.get" + - "$.paths.*.delete" + - "$.paths.*.put" + - "$.paths.*.patch" + - "$.paths.*.options" + then: + field: description + function: truthy + recommended: true # Set to true/false to enable/disable this rule + camara-parameters-descriptions: message: "Parameter description is missing or empty: {{error}}" severity: warn description: | - This Spectral rule ensures that each parameter in the API specification, including components and properties, has a descriptive and meaningful description. + This Spectral rule ensures that each path parameter in the API specification has a descriptive and meaningful description. + given: + - "$.paths..parameters.*" + then: + field: description + function: truthy + recommended: true # Set to true/false to enable/disable this rule + + camara-response-descriptions: + message: "Parameter description is missing or empty: {{error}}" + severity: warn + description: | + This Spectral rule ensures that each responese object in the API specification has a descriptive and meaningful description. + given: + - "$.paths..responses.*" + then: + field: description + function: truthy + recommended: true # Set to true/false to enable/disable this rule + + camara-properties-descriptions: + message: "Property description is missing or empty: {{error}}" + severity: warn + description: | + This Spectral rule ensures that each propoerty within objects in the API specification has a descriptive and meaningful description. given: - "$.components.*.*" - "$.components.*.*.properties.*" @@ -147,7 +193,7 @@ rules: field: description function: truthy recommended: true # Set to true/false to enable/disable this rule - + camara-operation-summary: message: "Operation Summary Warning: Each operation should include a short summary for better understanding." severity: warn @@ -169,7 +215,7 @@ rules: camara-discriminator-use: description: | Ensure that API definition YAML files with oneOf or anyOf sections include a discriminator object for serialization, deserialization, and validation. - severity: warn + severity: hint given: "$..[?(@.oneOf || @.anyOf)]" then: field: discriminator @@ -201,12 +247,12 @@ rules: recommended: true # Set to true/false to enable/disable this rule camara-parameter-casing-convention: - description: This rule checks Paths should follow a specific case convention kebab-case. + description: Paths should be kebab-case. severity: error - message: "{{property}} should be kebab-case: {{error}}" + message: "{{property}} is not kebab-case: {{error}}" given: $.paths[*]~ then: - function: casing + function: pattern functionOptions: - type: kebab + match: "^\/([a-z0-9]+(-[a-z0-9]+)*)?(\/[a-z0-9]+(-[a-z0-9]+)*|\/{.+})*$" # doesn't allow /asasd{asdas}sadas pattern or not closed braces recommended: true # Set to true/false to enable/disable this rule diff --git a/artifacts/linting_rules/.yamllint.yaml b/artifacts/linting_rules/.yamllint.yaml index b47dce98..39268751 100644 --- a/artifacts/linting_rules/.yamllint.yaml +++ b/artifacts/linting_rules/.yamllint.yaml @@ -1,4 +1,6 @@ --- +# CAMARA Project - YAML linting configuration for yamllint https://yamllint.readthedocs.io/en/latest/rules.html +# 31.01.2024 - initial version yaml-files: - '*.yaml' @@ -11,6 +13,7 @@ rules: colons: enable commas: enable comments: + min-spaces-from-content: 1 level: error comments-indentation: level: error @@ -24,7 +27,8 @@ rules: key-ordering: disable line-length: disable new-line-at-end-of-file: enable - new-lines: enable + new-lines: + type: platform octal-values: disable quoted-strings: disable trailing-spaces: enable diff --git a/artifacts/linting_rules/javalint.xml b/artifacts/linting_rules/javalint.xml deleted file mode 100644 index b21d8da7..00000000 --- a/artifacts/linting_rules/javalint.xml +++ /dev/null @@ -1,372 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/artifacts/linting_rules/lint_function/camara-language-avoid-telco.js b/artifacts/linting_rules/lint_function/camara-language-avoid-telco.js index f534cf7a..061b5431 100644 --- a/artifacts/linting_rules/lint_function/camara-language-avoid-telco.js +++ b/artifacts/linting_rules/lint_function/camara-language-avoid-telco.js @@ -1,3 +1,6 @@ +// CAMARA Project - support function for Spectral linter +// 31.01.2024 - initial version + const replacements = [ { original: 'UE', recommended: 'device' }, { original: 'MSISDN', recommended: 'phone number' }, diff --git a/artifacts/linting_rules/lint_function/camara-reserved-words.js b/artifacts/linting_rules/lint_function/camara-reserved-words.js index d82d50f4..c28e63ab 100644 --- a/artifacts/linting_rules/lint_function/camara-reserved-words.js +++ b/artifacts/linting_rules/lint_function/camara-reserved-words.js @@ -1,3 +1,6 @@ +// CAMARA Project - support function for Spectral linter +// 31.01.2024 - initial version + const reservedWords = [ 'abstract', 'apiclient', diff --git a/artifacts/linting_rules/lint_function/camara-security-no-secrets-in-path-or-query-parameters.js b/artifacts/linting_rules/lint_function/camara-security-no-secrets-in-path-or-query-parameters.js index 7387bb42..ebbff2a4 100644 --- a/artifacts/linting_rules/lint_function/camara-security-no-secrets-in-path-or-query-parameters.js +++ b/artifacts/linting_rules/lint_function/camara-security-no-secrets-in-path-or-query-parameters.js @@ -1,3 +1,6 @@ +// CAMARA Project - support function for Spectral linter +// 31.01.2024 - initial version + const sensitiveData = ['MSISDN','IMSI','phoneNumber']; export default async function (input) { diff --git a/documentation/API-linting-Implementation-Guideline.md b/documentation/API-linting-Implementation-Guideline.md index c588c990..f26256b0 100644 --- a/documentation/API-linting-Implementation-Guideline.md +++ b/documentation/API-linting-Implementation-Guideline.md @@ -2,75 +2,80 @@ ## Introduction -This guide provides instructions to implement linting rules for the CAMARA APIs using two methods: Spectral Linting and Megalinter with Spectral Linting. +This guide provides instructions how to implement linting rules for the CAMARA APIs using two methods: **[GitHub Actions](API-linting-Implementation-Guideline.md#github-actions-integration)** and **[local deployment](API-linting-Implementation-Guideline.md#github-actions-integration)**, both methods use [Spectral tool](https://docs.stoplight.io/docs/spectral/674b27b261c3c-overview). +All needed files are stored in [artifacts subfolder](https://github.com/camaraproject/Commonalities/tree/API-linting-Implementation-Guideline/artifacts/linting_rules). -CAMARA recommends the second method, incorporating Megalinter with Spectral. +The target method is linting rules integration with CAMARA API subproject repositories using GitHub Actions. -## Megalinter with Spectral Linting -Megalinter is an open-source tool for CI/CD workflows that analyzes the consistency of code, IAC, configuration, and scripts in repository sources. Megalinter supports Spectral Linting. +## Spectral Configuration + +The Spectral configuration consists of .spectral.yml file, which contains all the rules defined for CAMARA OpenAPI specification as described in [Linting-rules.md](Linting-rules.md) + +This file consolidates all rules: -## Implementation Files +1. Spectral Core OpenAPI specification linting ruleset: -megalinter.yml :- Contains the configuration of megalinter along with spectral. + `Ruleset extension: extends: "spectral:oas"` + +2. Spectral rules with built-in functions +3. Spectral rules with custom JavaScript functions - .spectral.yml :- Linting rules based on the OpenAPI Specification ## GitHub Actions Integration -1. Add megalinter.yml to GitHub action workflow --> .github/workflows +1. Add **[.spectral.yml](https://github.com/camaraproject/Commonalities/blob/main/artifacts/linting_rules/.spectral.yml)** (rules) file to -> root location of repository - which include the configuration of megalinter and spectral for GitHub actions. +2. Create **lint-function** folder -2. Add .spectral.yml (rules) file to -> root location of repository + Make a folder named `lint_function` at root location and add custom [JavaScript function files](https://github.com/camaraproject/Commonalities/tree/API-linting-Implementation-Guideline/artifacts/linting_rules/lint_function) that are imported in .spectral.yml (some rules require custom JavaScript functions to execute). -3. Create lint-function folder +3. Add **[spectral_oas_lint.yml](https://github.com/camaraproject/Commonalities/blob/main/artifacts/linting_rules/.github/workflows/spectral_oas_lint.yml)** to GitHub action workflows in `.github/workflows` folder + which includes the configuration of Spectral workflow for GitHub actions. - Make a folder named lint_function at root location and add custom javascript function files that are imported in .spectral.yml (some rules require custom JavaScript functions to execute). +4. Add [megalinter.yml](https://github.com/camaraproject/Commonalities/blob/main/artifacts/linting_rules/.github/workflows/megalinter.yml) to GitHub action workflows in `.github/workflows` folder + which includes the configuration of Megalinter and Spectral for GitHub actions. -4. Activate megalinter job +### Manually running linting workflow - The megalinter job will be automatically activated once you submit a pull request on the [main/master] branch of the CAMARA repository, as configured in megalinter. +**spectral_oas_lint.yml** includes configuration of the OAS linting workflow to be run manually as described in [GitHub Actions documentation](https://docs.github.com/en/actions/using-workflows/manually-running-a-workflow). -## Megalinter configuration: +The rules will be applied to all files with *.yaml extension in '/code/API_definitions/' folder of the repository. +Write access to the repository is required to perform these steps. -The megalinter configuration consists of the megalinter.yml file containing the necessary settings to run megalinter and spectral jobs on GitHub actions. +The output from Spectral can be seen by expanding the step **Run Spectral Linting** of given worflow run Actions section of GitHub repository. -Additionally, megalinter also supports linting of YAML and Java files. To enable this, users need to add the following ruleset files to the root location. -1. Java Linting: javalint.xml +### Megalinter integration -2. YAML Linting: .yamllint.yaml +[Megalinter](https://megalinter.io/latest/) is an Open-Source tool for CI/CD workflows that analyzes the consistency of code, configurations and scripts in repository sources. Megalinter supports Spectral linting. +The Megalinter job will be automatically activated once you submit a pull request on the [main/master] branch of the CAMARA repository, as configured in megalinter.yml. -## Spectral Configuration +The Megalinter configuration consists of the megalinter.yml file containing the necessary settings to run Megalinter and Spectral jobs on GitHub actions. -The spectral configuration consists of .spectral.yml file, which contains all the rules defined in the CAMARA OpenAPI specification. +Additionally, Megalinter also supports linting of YAML files. To enable this, users need to add the following ruleset files to the root location. -This file consolidates all rules: +- YAML Linting: .yamllint.yaml -1. Spectral built-in OpenAPI specification ruleset: - Ruleset extension: extends: "spectral:oas" -2. Spectral rules with core functions -3. Spectral rules with customized JavaScript Functions -## API Linting configuration steps for local +## API Linting configuration steps for local deployment -1. Install spectral locally +1. Install Spectral locally: npm install -g @stoplight/spectral -2. Intall spectral function locally. +2. Install Spectral functions locally: npm install --save @stoplight/spectral-functions 3. Save files locally: - Save "Spectral.yml" file (contains Linting rules) and lint_function folder (contains JavaScript customized functions) at the root location. + Save ".spectral.yml" file (contains Linting rules) and lint_function folder (contains JavaScript customized functions) at the root location. -4. Apply spectral rules on API specification loacally +4. Apply spectral rules on API specification loacally: spectral lint openapi.yaml --verbose --ruleset .spectral.yml - Replace 'openapi.yaml' with the path to your OpenAPI specification file + *Replace **'openapi.yaml'** with the path to your OpenAPI specification file.* From 3f3ff603653c9d51a4657c09ceab3088f35c3380 Mon Sep 17 00:00:00 2001 From: ravindrapalaskar17 <117813163+ravindrapalaskar17@users.noreply.github.com> Date: Sat, 3 Feb 2024 11:53:38 +0530 Subject: [PATCH 13/15] Update indentation in .spectral.yml file --- artifacts/linting_rules/.spectral.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/artifacts/linting_rules/.spectral.yml b/artifacts/linting_rules/.spectral.yml index 399816d1..0b16508e 100644 --- a/artifacts/linting_rules/.spectral.yml +++ b/artifacts/linting_rules/.spectral.yml @@ -138,8 +138,8 @@ rules: then: function: camara-reserved-words recommended: true # Set to true/false to enable/disable this rule - - camara-routes-description: + + camara-routes-description: message: "Functionality method description Warning: Each method should have description." severity: warn description: | From 38b97bc5a7c7cf98463e4cb082f74ec6fcda6bc8 Mon Sep 17 00:00:00 2001 From: Rafal Artych <121048129+rartych@users.noreply.github.com> Date: Thu, 8 Feb 2024 10:32:59 +0100 Subject: [PATCH 14/15] Update megalinter.yml Custom regex including filter added for Spectral --- artifacts/linting_rules/.github/workflows/megalinter.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/artifacts/linting_rules/.github/workflows/megalinter.yml b/artifacts/linting_rules/.github/workflows/megalinter.yml index 455905e8..6bda7009 100644 --- a/artifacts/linting_rules/.github/workflows/megalinter.yml +++ b/artifacts/linting_rules/.github/workflows/megalinter.yml @@ -65,6 +65,7 @@ jobs: YAML_YAMLLINT_CONFIG_FILE: ".yamllint.yaml" OPENAPI_SPECTRAL_CONFIG_FILE: ".spectral.yml" YAML_YAMLLINT_FILTER_REGEX_INCLUDE: "(code/)" + OPENAPI_SPECTRAL_FILTER_REGEX_INCLUDE: "(code/)" # Upload MegaLinter artifacts - name: Archive production artifacts From e30f39ad65f20b699e2879b820e6823d89c72e90 Mon Sep 17 00:00:00 2001 From: Rafal Artych <121048129+rartych@users.noreply.github.com> Date: Thu, 8 Feb 2024 11:40:30 +0100 Subject: [PATCH 15/15] Update .yamllint.yaml new-lines: disable --- artifacts/linting_rules/.yamllint.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/artifacts/linting_rules/.yamllint.yaml b/artifacts/linting_rules/.yamllint.yaml index 39268751..081ef093 100644 --- a/artifacts/linting_rules/.yamllint.yaml +++ b/artifacts/linting_rules/.yamllint.yaml @@ -27,8 +27,7 @@ rules: key-ordering: disable line-length: disable new-line-at-end-of-file: enable - new-lines: - type: platform + new-lines: disable octal-values: disable quoted-strings: disable trailing-spaces: enable