Jon Chery
d5bae868a4
core/env.py dual-read helper (D-108); 21 ACDL_*→NOVA_* env vars migrated across core/scripts/adapters/tests/workflows + .env/.env.secrets (key rename, values stay). G-106 binding: run_platform.sh:288-289 + regression_verify.py:309-312 dual-read (NOVA first, ACDL fallback). G-108 binding: Gitea NOVA_* secrets created via API + workflow secrets: refs updated (deploy.yml + modules-lifecycle.yml, .gitea + .github). acdl_tagging.py→nova_tagging.py (D-109 warn mode, nova:* enforced). .acdl/→.nova/ consumer path (resolver + deploy workflow + schema + tests + docs). Test fixtures updated; pytest + run_ci.sh PASS. ---ci--- project: acdl phase: 2 milestone: v1.15 status: execute ---/ci---
42 lines
1.9 KiB
Markdown
42 lines
1.9 KiB
Markdown
# Nova Custom Checkov Rules
|
|
|
|
This directory holds Nova-authored Checkov custom rules, written in the
|
|
[Checkov Python custom-rule framework](https://www.checkov.io/4.Contributing/Custom%20Policies.html).
|
|
|
|
## Files
|
|
|
|
- `nova_tagging.py` — `NOVA_TAG_NAMING` (D-054, D-109 warn mode in P2):
|
|
ensures every taggable AWS resource carries the four required Nova tags
|
|
(`nova:owner`, `nova:contract`, `nova:environment`, `nova:cost-center`).
|
|
This rule replaces the synthetic SKIPPED `NOVA_TAG_NAMING` record that the
|
|
Checkov adapter previously emitted (D-043 closure). Renamed from
|
|
`acdl_tagging.py` / `ACDL_TAG_NAMING` in P2 (REQ-158). The canonical tag
|
|
set is declared in [`schemas/tagging-standard.json`](../../../schemas/tagging-standard.json).
|
|
|
|
**P2 warn mode (D-109):** existing resources still carry `acdl:*` tag-key
|
|
values (left for P3). When a resource has only `acdl:*`-style tags and no
|
|
`nova:*` tags, the rule logs a WARNING instead of failing, so the
|
|
regression gate stays green during the parallel-tag transition window.
|
|
P3 flips to hard-fail once `nova:*` tags are emitted in parallel and the
|
|
ABAC policy is swapped.
|
|
|
|
## How Checkov loads them
|
|
|
|
Checkov custom rules are discovered via the `--external-checks-dir` flag.
|
|
`scripts/run_platform.sh` invokes Checkov with:
|
|
|
|
```
|
|
checkov -f terraform/spike/main.tf --framework terraform -o json --soft-fail \
|
|
--external-checks-dir adapters/terraform/policy/custom_rules/
|
|
```
|
|
|
|
Checkov imports each `*.py` file in the directory and instantiates the
|
|
module-level `check` object (see the `check = NovaTaggingStandard()` line at
|
|
the bottom of `nova_tagging.py`).
|
|
|
|
## Severity / result mapping
|
|
|
|
The Checkov adapter (`adapters/terraform/policy/checkov_adapter.py`)
|
|
maps `NOVA_TAG_NAMING` to `(tagging-standard, medium)` in `RULE_MAP`. The
|
|
custom rule therefore produces real `PASS`/`FAIL` PolicyCheckResult records,
|
|
feeding the confidence signal instead of the old SKIPPED placeholder. |