Files

T

Jon Chery d5bae868a4 feat(P2): Nova rebrand — code/env-vars/consumer-path (REQ-158/159/160)

core/env.py dual-read helper (D-108); 21 ACDL_*→NOVA_* env vars migrated
across core/scripts/adapters/tests/workflows + .env/.env.secrets (key
rename, values stay). G-106 binding: run_platform.sh:288-289 +
regression_verify.py:309-312 dual-read (NOVA first, ACDL fallback).
G-108 binding: Gitea NOVA_* secrets created via API + workflow secrets:
refs updated (deploy.yml + modules-lifecycle.yml, .gitea + .github).
acdl_tagging.py→nova_tagging.py (D-109 warn mode, nova:* enforced).
.acdl/→.nova/ consumer path (resolver + deploy workflow + schema +
tests + docs). Test fixtures updated; pytest + run_ci.sh PASS.

---ci---
project: acdl
phase: 2
milestone: v1.15
status: execute
---/ci---

2026-07-30 01:25:24 +00:00

1.9 KiB

Raw Blame History

Nova Custom Checkov Rules

This directory holds Nova-authored Checkov custom rules, written in the Checkov Python custom-rule framework.

Files

nova_tagging.py — NOVA_TAG_NAMING (D-054, D-109 warn mode in P2): ensures every taggable AWS resource carries the four required Nova tags (nova:owner, nova:contract, nova:environment, nova:cost-center). This rule replaces the synthetic SKIPPED NOVA_TAG_NAMING record that the Checkov adapter previously emitted (D-043 closure). Renamed from acdl_tagging.py / ACDL_TAG_NAMING in P2 (REQ-158). The canonical tag set is declared in schemas/tagging-standard.json.

P2 warn mode (D-109): existing resources still carry acdl:* tag-key values (left for P3). When a resource has only acdl:*-style tags and no nova:* tags, the rule logs a WARNING instead of failing, so the regression gate stays green during the parallel-tag transition window. P3 flips to hard-fail once nova:* tags are emitted in parallel and the ABAC policy is swapped.

How Checkov loads them

Checkov custom rules are discovered via the --external-checks-dir flag. scripts/run_platform.sh invokes Checkov with:

checkov -f terraform/spike/main.tf --framework terraform -o json --soft-fail \
        --external-checks-dir adapters/terraform/policy/custom_rules/

Checkov imports each *.py file in the directory and instantiates the module-level check object (see the check = NovaTaggingStandard() line at the bottom of nova_tagging.py).

Severity / result mapping

The Checkov adapter (adapters/terraform/policy/checkov_adapter.py) maps NOVA_TAG_NAMING to (tagging-standard, medium) in RULE_MAP. The custom rule therefore produces real PASS/FAIL PolicyCheckResult records, feeding the confidence signal instead of the old SKIPPED placeholder.

1.9 KiB Raw Blame History

Nova Custom Checkov Rules

Files

How Checkov loads them

Severity / result mapping

1.9 KiB

Raw Blame History