continuous-intelligence/acdl

Fork 0

Files

T

History

Jon Chery 2e2064559a

acdl-ci / Lint (push) Successful in 8s

Details

acdl-ci / Test (push) Successful in 25s

Details

acdl-ci / Platform check-only (offline) (push) Successful in 10s

Details

verify(P22-27): code review — 1 P0 auto-fixed, 2 P1 security fixes, 2 P2 nits

---ci---
project: acdl
phase: 22-27
milestone: v1.7
status: verify
lessons:
  - P0 fix: run_platform.sh check-only assertions were hardcoded to static-assets; generalized for all contracts
  - P1 fix: URL-encode contractId in GitHub issue search to prevent query injection
  - P1 fix: validate consumerRepo format against invoking principal identity (P1-2)
  - P2 fix: tagging-standard.json description referenced .yaml instead of .py
  - P2 fix: removed unused graph_resource_name_utils import in acdl_tagging.py
---/ci---

Multi-persona code review of the v1.7 milestone (130 files, +5568/-353).

P0 (1, auto-fixed):
  - run_platform.sh --check-only hardcoded static-assets assertions broke
    for other contracts (microservice). Generalized to structural checks.

P1 security fixes applied (2 of 9):
  - P1-1: URL-encode contractId in GitHub search query (injection prevention)
  - P1-2: Validate consumerRepo format (org/repo) when caller identity present

P1 flagged for post-hoc (7):
  - P1-3: SSM uses AWS-managed key, not platform CMK (ACDL_KMS_KEY_ID not set)
  - P1-4: WAF custom rules emit invalid HCL (attribute vs block syntax)
  - P1-5: WAF default_action input silently ignored (always emits allow {})
  - P1-6: consumer_invoke_policy.json has placeholder account ID (needs substitution)
  - P1-7: L2 composition outputs section not implemented in resolver
  - P1-8: terraform/spike/*.tf overwritten by run_platform.sh (state contamination)
  - P1-9: GitHub API URLs hardcoded (Gitea deployments silently fail)

P2 nits fixed (2 of 8):
  - P2-2: tagging-standard.json description referenced .yaml instead of .py
  - P2-3: unused graph_resource_name_utils import removed

Tests: 275 passed (was 272; +3 caller identity validation tests).

2026-07-22 21:09:52 +00:00

__init__.py

feat(P23): tagging standard + Wiz adapter + Kyverno adapter

2026-07-22 20:00:46 +00:00

acdl_tagging.py

verify(P22-27): code review — 1 P0 auto-fixed, 2 P1 security fixes, 2 P2 nits

2026-07-22 21:09:52 +00:00

README.md

feat(P23): tagging standard + Wiz adapter + Kyverno adapter

2026-07-22 20:00:46 +00:00

README.md

ACDL Custom Checkov Rules

This directory holds ACDL-authored Checkov custom rules, written in the Checkov Python custom-rule framework.

Files

acdl_tagging.py — ACDL_TAG_NAMING (D-054): ensures every taggable AWS resource carries the four required ACDL tags (acdl:owner, acdl:contract, acdl:environment, acdl:cost-center). This rule replaces the synthetic SKIPPED ACDL_TAG_NAMING record that the Checkov adapter previously emitted (D-043 closure). The canonical tag set is declared in schemas/tagging-standard.json.

How Checkov loads them

Checkov custom rules are discovered via the --external-checks-dir flag. scripts/run_platform.sh invokes Checkov with:

checkov -f terraform/spike/main.tf --framework terraform -o json --soft-fail \
        --external-checks-dir adapters/terraform/policy/custom_rules/

Checkov imports each *.py file in the directory and instantiates the module-level check object (see the check = AcdlTaggingStandard() line at the bottom of acdl_tagging.py).

Severity / result mapping

The Checkov adapter (adapters/terraform/policy/checkov_adapter.py) maps ACDL_TAG_NAMING to (tagging-standard, medium) in RULE_MAP. The custom rule therefore produces real PASS/FAIL PolicyCheckResult records, feeding the confidence signal instead of the old SKIPPED placeholder.