continuous-intelligence/acdl

Fork 0

Files

T

History

Jon Chery 85c500e45a

Nova Slides Render / render (push) Failing after 1m1s

Details

feat(P4): pipeline hardening — Checkov before plan, Wiz-or-Checkov on plan (REQ-250)

Two-stage policy scan per item 20:

1. Checkov on static code BEFORE terraform plan (fail-fast, quick dev
   feedback). Added to run_platform.sh Step 3c + run_codegen.sh Step 3c
   (runs on the authored TF dir before plan, using --framework terraform).

2. Runtime policy scan on the plan AFTER terraform plan: Wiz when
   configured (WIZ_API_TOKEN + WIZ_API_URL), else Checkov against the
   plan as a drop-in replacement (--framework terraform_plan). Wiz and
   Checkov are NEVER both run on the plan. Replaces the old single
   Checkov-on-main.tf step in run_platform.sh Step 5 + run_postapply.sh
   Step 5.

pipelines/contract.yml: stage list updated — 'checkov' stage replaced by
'checkov-static' (before terraform-plan) + 'runtime-policy-scan' (after
terraform-plan). 9 stages → 10 stages. Header comment updated.

adapters/wiz/wiz_adapter.py: add --plan mode CLI (fetch_and_adapt_plan)
for scanning a terraform plan; backward-compat with the positional
<wiz_issues.json> <contract-id> mode. is_configured() gates the Wiz path.

Tests: test_pipeline_contract.py (9 → 10 stages, new stage names);
test_contract_resolver.py (rename test, assert checkov-static +
runtime-policy-scan present, old 'checkov' gone). Full suite: 685 pass
+ 1 pre-existing attestation failure (NOVA_ATTESTATION_SIGNING_KEY_ID
unset, unrelated to v1.21, fails on main without these changes too).

---ci---
project: acdl
phase: 4
milestone: v1.21
status: execute
phase_role: execution
---/ci---

2026-08-11 14:10:42 +00:00

__init__.py

feat(P23): tagging standard + Wiz adapter + Kyverno adapter

2026-07-22 20:00:46 +00:00

README.md

feat(P23): tagging standard + Wiz adapter + Kyverno adapter

2026-07-22 20:00:46 +00:00

wiz_adapter.py

feat(P4): pipeline hardening — Checkov before plan, Wiz-or-Checkov on plan (REQ-250)

2026-08-11 14:10:42 +00:00

README.md

Wiz Adapter

The Wiz adapter translates Wiz API issue records to the normalized ACDL PolicyCheckResult schema (engine: "wiz"), mirroring the Checkov adapter pattern.

What Wiz is

Wiz is a cloud security SaaS platform that continuously scans CSPM / CWPP / KSPM findings across AWS, Azure, GCP and Kubernetes. It exposes a GraphQL/REST API for fetching issue records.

Adapter behaviour

wiz_adapter.py <wiz_issues.json> <contract-id> reads a JSON file of Wiz issue records (the shape returned by the Wiz issues GraphQL query / list endpoint) and emits a list of PolicyCheckResult dicts:

Wiz field	PolicyCheckResult field
`id` / `control.id`	`ruleId`
`severity`	`severity` (mapped `CRITICAL/HIGH/MEDIUM/LOW/INFO`)
`status`	`result` (`OPEN→fail`, `RESOLVED→pass`, `IN_PROGRESS/DISMISSED→skipped`)
`title` / `control.name`	`message`
`entity.id`	`resourceRef` + `evidence.resource`
`entity.{name,cloudPlatform,subscriptionId}`	`evidence.*`

The adapter is read-only against a local JSON fixture; the pipeline is responsible for fetching from Wiz (when configured) and writing the file.

Offline / degraded behaviour (D-052)

When Wiz is not configured the pipeline passes an empty issues payload (or simply does not invoke the adapter). The adapter degrades gracefully:

an empty issues list → the adapter emits a single WIZ_NOT_CONFIGURED PolicyCheckResult with result: "skipped" so the confidence policy input stays non-empty (and does not falsely inflate the score).

is_configured() returns True only when the WIZ_API_TOKEN environment variable is set; the pipeline uses it to decide whether to fetch and invoke the adapter at all.

Configuration

Env var	Required	Purpose
`WIZ_API_TOKEN`	yes	Bearer token for the Wiz REST API. When unset, `is_configured()` returns `False`.
`WIZ_ENDPOINT`	no	Wiz API endpoint (defaults to `https://api.wiz.io` when implemented).

Schema path

The output records validate against schemas/policy_check_result.schema.json (engine: "wiz" was added to the enum in Phase 23).