From 0a505af783c919dd3d2e6cce6eef33b592360826 Mon Sep 17 00:00:00 2001 From: PEDRO DIEZ GARCIA Date: Wed, 24 Jan 2024 12:36:33 +0100 Subject: [PATCH 01/10] linter_testing --- .github/workflows/megalinter.yml | 72 ++++ .github/workflows/spectral_oas_lint.yml | 39 ++ .spectral.yml | 212 ++++++++++ .yamllint.yaml | 32 ++ javalint.xml | 372 ++++++++++++++++++ lint_function/camara-language-avoid-telco.js | 37 ++ lint_function/camara-reserved-words.js | 95 +++++ ...-no-secrets-in-path-or-query-parameters.js | 23 ++ 8 files changed, 882 insertions(+) create mode 100644 .github/workflows/megalinter.yml create mode 100644 .github/workflows/spectral_oas_lint.yml create mode 100644 .spectral.yml create mode 100644 .yamllint.yaml create mode 100644 javalint.xml create mode 100644 lint_function/camara-language-avoid-telco.js create mode 100644 lint_function/camara-reserved-words.js create mode 100644 lint_function/camara-security-no-secrets-in-path-or-query-parameters.js diff --git a/.github/workflows/megalinter.yml b/.github/workflows/megalinter.yml new file mode 100644 index 0000000..007438f --- /dev/null +++ b/.github/workflows/megalinter.yml @@ -0,0 +1,72 @@ +--- +# MegaLinter GitHub Action configuration file +# More info at https://megalinter.io +name: MegaLinter + +on: # yamllint disable-line rule:truthy + # Pull Requests to main + pull_request: + branches: [master, main] + +env: # Comment env block if you do not want to apply fixes + # Apply linter fixes configuration + APPLY_FIXES: all # When active, APPLY_FIXES must also be defined as environment variable (in github/workflows/mega-linter.yml or other CI tool) + APPLY_FIXES_EVENT: pull_request # Decide which event triggers application of fixes in a commit or a PR (pull_request, push, all) + APPLY_FIXES_MODE: commit # If APPLY_FIXES is used, defines if the fixes are directly committed (commit) or posted in a PR (pull_request) + +concurrency: + group: ${{ github.ref }}-${{ github.workflow }} + cancel-in-progress: true + +jobs: + build: + name: MegaLinter + runs-on: ubuntu-latest + permissions: + # Give the default GITHUB_TOKEN write permission to commit and push, comment issues & post new PR + # Remove the ones you do not need + contents: write + issues: write + pull-requests: write + steps: + # Git Checkout + - name: Checkout Code + uses: actions/checkout@v3 + with: + token: ${{ secrets.GITHUB_TOKEN }} + fetch-depth: 0 # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to improve performances + - name: Install Spectral + run: npm install -g @stoplight/spectral + - name: Install Spectral functions + run: npm install -g @stoplight/spectral-functions + - name: Run spectral:oas Spectral Linting + run: spectral lint code/API_definitions/openapi.yaml --verbose --ruleset .spectral.yml + # Replace openapi.yaml file with your API specification file + + # MegaLinter + - name: MegaLinter + id: ml + # You can override MegaLinter flavor used to have faster performances + # More info at https://megalinter.io/flavors/ + uses: oxsecurity/megalinter/flavors/java@v7.3.0 + env: + # All available variables are described in documentation + # https://megalinter.io/configuration/ + # VALIDATE_ALL_CODEBASE: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} # Validates all source when push on main, else just the git diff with main. Override with true if you always want to lint all sources + VALIDATE_ALL_CODEBASE: true + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # ADD YOUR CUSTOM ENV VARIABLES HERE OR DEFINE THEM IN A FILE .mega-linter.yml AT THE ROOT OF YOUR REPOSITORY + DISABLE: COPYPASTE,MARKDOWN + DISABLE_LINTERS: SPELL_CSPELL,SPELL_LYCHEE,YAML_PRETTIER,REPOSITORY_SEMGREP,REPOSITORY_DEVSKIM,REPOSITORY_KICS,REPOSITORY_TRIVY,REPOSITORY_CHECKOV,REPOSITORY_GITLEAKS,JAVA_PMD + YAML_YAMLLINT_CONFIG_FILE: ".yamllint.yaml" + JAVA_CHECKSTYLE_CONFIG_FILE: "javalint.xml" + + # Upload MegaLinter artifacts + - name: Archive production artifacts + if: ${{ success() }} || ${{ failure() }} + uses: actions/upload-artifact@v3 + with: + name: MegaLinter reports + path: | + megalinter-reports + mega-linter.log diff --git a/.github/workflows/spectral_oas_lint.yml b/.github/workflows/spectral_oas_lint.yml new file mode 100644 index 0000000..37424b4 --- /dev/null +++ b/.github/workflows/spectral_oas_lint.yml @@ -0,0 +1,39 @@ +--- +name: Spectral + +on: workflow_dispatch + +# env: # Comment env block if you do not want to apply fixes + # Apply linter fixes configuration +# APPLY_FIXES: all # When active, APPLY_FIXES must also be defined as environment variable (in github/workflows/mega-linter.yml or other CI tool) +# APPLY_FIXES_EVENT: pull_request # Decide which event triggers application of fixes in a commit or a PR (pull_request, push, all) +# APPLY_FIXES_MODE: commit # If APPLY_FIXES is used, defines if the fixes are directly committed (commit) or posted in a PR (pull_request) + +concurrency: + group: ${{ github.ref }}-${{ github.workflow }} + cancel-in-progress: true + +jobs: + build: + name: Spectral linting + runs-on: ubuntu-latest + permissions: + # Give the default GITHUB_TOKEN write permission to commit and push, comment issues & post new PR + # Remove the ones you do not need + contents: write + issues: write + pull-requests: write + steps: + # Git Checkout + - name: Checkout Code + uses: actions/checkout@v3 + with: + token: ${{ secrets.GITHUB_TOKEN }} + fetch-depth: 0 # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to improve performances + - name: Install Spectral + run: npm install -g @stoplight/spectral + - name: Install Spectral functions + run: npm install -g @stoplight/spectral-functions + - name: Run spectral:oas Spectral Linting + run: spectral lint code/API_definitions/*.yaml --verbose --ruleset .spectral.yml + # Replace openapi.yaml file with your API specification file diff --git a/.spectral.yml b/.spectral.yml new file mode 100644 index 0000000..306c628 --- /dev/null +++ b/.spectral.yml @@ -0,0 +1,212 @@ +extends: "spectral:oas" +functions: + - camara-reserved-words + - camara-language-avoid-telco + - camara-security-no-secrets-in-path-or-query-parameters +functionsDir: "./lint_function" +rules: + # Built-in OpenAPI Specification ruleset. Each rule then can be enabled individually. + # The severity keyword is optional in rule definition and can be error, warn, info, hint, or off. The default value is warn. + contact-properties: false + duplicated-entry-in-enum: true + info-contact: true + info-description: true + info-license: true + license-url: true + no-$ref-siblings: error + no-eval-in-markdown: true + no-script-tags-in-markdown: true + openapi-tags: false + openapi-tags-alphabetical: false + openapi-tags-uniqueness: error + operation-description: true + operation-operationId: true + operation-operationId-unique: error + operation-operationId-valid-in-url: true + operation-parameters: true + operation-singular-tag: true + operation-success-response: true + operation-tags: true + operation-tag-defined: true + path-declarations-must-exist: true + path-keys-no-trailing-slash: true + path-not-include-query: true + path-params: error + tag-description: false + typed-enum: true + oas3-api-servers: true + oas3-examples-value-or-externalValue: true + oas3-operation-security-defined: true + oas3-parameter-description: false + oas3-schema: true + oas3-server-not-example.com: false + oas3-server-trailing-slash: true + oas3-unused-component: true + oas3-valid-media-example: true + oas3-valid-schema-example: true + oas3-server-variables: true + + # Custom Rules Utilizing Spectral's Built-in Functions and JavaScript Implementations + + camara-language-avoid-telco: + message: "{{error}}" + severity: hint + description: | + This rule checks for telco-specific terminology in your API definitions and suggests more inclusive terms. + given: "$..*.*" + then: + function: camara-language-avoid-telco + recommended: false # Set to true/false to enable/disable this rule + + camara-oas-version: + message: "OpenAPI Version Error: The OpenAPI specification must adhere to version 3.0.3." + severity: error + description: | + This rule validates the OpenAPI version in your specification and requires compliance with version 3.0.3. + given: "$" + then: + field: openapi + function: pattern + functionOptions: + match: 3.0.3 + recommended: true # Set to true/false to enable/disable this rule + + camara-path-param-id: + message: "Path Parameter Naming Warning: Use 'resource_id' instead of just 'id' in path parameters." + severity: warn + description: | + This rule ensures consistent and descriptive naming for path parameters in your OpenAPI specification. + Please use 'resource_id' instead of just 'id' for your path parameters. + given: "$..parameters[?(@.in == 'path')]" + then: + field: name + function: pattern + functionOptions: + notMatch: \b(id|Id|ID|iD)\b + recommended: true # Set to true/false to enable/disable this rule + + camara-security-no-secrets-in-path-or-query-parameters: + message: "Sensitive data found in path: {{error}} Consider avoiding the use of Sesentive data " + severity: warn + description: | + This rule checks for sensitive data ('MSISDN' and 'IMSI') in API paths and suggests avoiding their use. + given: + - "$.paths" + then: + function: camara-security-no-secrets-in-path-or-query-parameters + recommended: true # Set to true/false to enable/disable this rule + + camara-http-methods: + description: "Ensure that all path URLs have valid HTTP methods (GET, PUT, POST, DELETE, PATCH, OPTIONS)." + message: "Invalid HTTP method for '{{path}}'. Must be one of get, put, post, delete, patch, options." + severity: error + given: $.paths[*][*]~ + then: + function: pattern + functionOptions: + match: "^(get|put|post|delete|patch|options)$" + recommended: true # Set to true/false to enable/disable this rule + + camara-get-no-request-body: + message: There must be no request body for Get and DELETE + severity: error + given: + - "$.paths.*.get" + - "$.paths.*.delete" + then: + field: requestBody + function: falsy + recommended: true # Set to true/false to enable/disable this rule + + camara-reserved-words: + message: "Reserved words found {{error}} Consider avoiding the use of reserved word " + severity: warn + description: | + This rule checks Reserved words must not be used in the following parts of an API specification [Paths, Request Body properties, Component, Operation Id, Security Schema] + given: + - "$.paths" # Paths + - "$..parameters[*]" # Path or Query Parameter Names: + - "$..components.schemas.*.properties.*" # Request and Response body parameter + - "$.paths.*." # Path and Operation Names: + - "$.components.securitySchemes" # Security Schemes: + - "$.components.*.*" # Component Names: + - "$.paths.*.*.operationId" # OperationIds: + then: + function: camara-reserved-words + recommended: true # Set to true/false to enable/disable this rule + + camara-parameters-descriptions: + message: "Parameter description is missing or empty: {{error}}" + severity: warn + description: | + This Spectral rule ensures that each parameter in the API specification, including components and properties, has a descriptive and meaningful description. + given: + - "$.components.*.*" + - "$.components.*.*.properties.*" + then: + field: description + function: truthy + recommended: true # Set to true/false to enable/disable this rule + + camara-operation-summary: + message: "Operation Summary Warning: Each operation should include a short summary for better understanding." + severity: warn + description: | + This rule checks if each operation (POST, GET, DELETE, PUT, PATCH, OPTIONS) in your API specification has a meaningful summary. + Ensure that you have added a 'summary' field for each operation in your OpenAPI specification. + given: + - "$.paths.*.post" + - "$.paths.*.get" + - "$.paths.*.delete" + - "$.paths.*.put" + - "$.paths.*.patch" + - "$.paths.*.options" + then: + field: summary + function: truthy + recommended: true # Set to true/false to enable/disable this rule + + camara-discriminator-use: + description: | + Ensure that API definition YAML files with oneOf or anyOf sections include a discriminator object for serialization, deserialization, and validation. + severity: warn + given: "$..[?(@.oneOf || @.anyOf)]" + then: + field: discriminator + function: truthy + description: "Discriminator object is required when using oneOf or anyOf." + recommended: true # Set to true/false to enable/disable this rule + + camara-operationid-casing-convention: + message: Operation Id must be in Camel case "{{error}}" + severity: hint + description: | + This rule checks Operation ids should follow a specific case convention: camel case. + given: "$.paths.*.*.operationId" + then: + function: casing + functionOptions: + type: camel + recommended: true # Set to true/false to enable/disable this rule + + camara-schema-casing-convention: + description: This rule checks schema should follow a specific case convention pascal case. + message: "{{property}} should be pascal case (UppperCamelCase)" + severity: warn + given: $.components.schemas[*]~ + then: + function: casing + functionOptions: + type: pascal + recommended: true # Set to true/false to enable/disable this rule + + camara-parameter-casing-convention: + description: This rule checks Paths should follow a specific case convention kebab-case. + severity: error + message: "{{property}} should be kebab-case: {{error}}" + given: $.paths[*]~ + then: + function: casing + functionOptions: + type: kebab + recommended: true # Set to true/false to enable/disable this rule diff --git a/.yamllint.yaml b/.yamllint.yaml new file mode 100644 index 0000000..b47dce9 --- /dev/null +++ b/.yamllint.yaml @@ -0,0 +1,32 @@ +--- + +yaml-files: + - '*.yaml' + - '*.yml' + - '.yamllint' + +rules: + braces: enable + brackets: enable + colons: enable + commas: enable + comments: + level: error + comments-indentation: + level: error + document-end: disable + document-start: disable + empty-lines: enable + empty-values: disable + hyphens: enable + indentation: enable + key-duplicates: enable + key-ordering: disable + line-length: disable + new-line-at-end-of-file: enable + new-lines: enable + octal-values: disable + quoted-strings: disable + trailing-spaces: enable + truthy: + level: error diff --git a/javalint.xml b/javalint.xml new file mode 100644 index 0000000..b21d8da --- /dev/null +++ b/javalint.xml @@ -0,0 +1,372 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/lint_function/camara-language-avoid-telco.js b/lint_function/camara-language-avoid-telco.js new file mode 100644 index 0000000..f534cf7 --- /dev/null +++ b/lint_function/camara-language-avoid-telco.js @@ -0,0 +1,37 @@ +const replacements = [ + { original: 'UE', recommended: 'device' }, + { original: 'MSISDN', recommended: 'phone number' }, + { original: 'mobile network', recommended: 'network' } +]; + +export default async function (input) { + const errors = []; + const suggestions = []; + + // Iterate over properties of the input object + for (const path in input) { + const value = input[path]; + + // Check if the value is a string + if (typeof value === 'string') { + for (const replacement of replacements) { + const original = replacement.original; + const recommended = replacement.recommended; + + // Use a regular expression to match 'original' as a standalone word + const regex = new RegExp(`\\b${original}\\b`, 'g'); + + // Check if 'original' exists in the value + if (regex.test(value)) { + errors.push(replacement); + suggestions.push(` Telco-specific terminology found in input: Consider replacing '${original}' with '${recommended}'.`); + } + } + } + } + + // Check if any word from 'replacements' is in the suggestions + if (errors.length > 0) { + console.log(`Hint camara-language-avoid-telco ` + suggestions.join(', ')); + } +}; diff --git a/lint_function/camara-reserved-words.js b/lint_function/camara-reserved-words.js new file mode 100644 index 0000000..d82d50f --- /dev/null +++ b/lint_function/camara-reserved-words.js @@ -0,0 +1,95 @@ +const reservedWords = [ + 'abstract', + 'apiclient', + 'apiexception', + 'apiresponse', + 'assert', + 'boolean', + 'break', + 'byte', + 'case', + 'catch', + 'char', + 'class', + 'configuration', + 'const', + 'continue', + 'do', + 'double', + 'else', + 'extends', + 'file', + 'final', + 'finally', + 'float', + 'for', + 'goto', + 'if', + 'implements', + 'import', + 'instanceof', + 'int', + 'interface', + 'list', + 'localdate', + 'localreturntype', + 'localtime', + 'localvaraccept', + 'localvaraccepts', + 'localvarauthnames', + 'localvarcollectionqueryparams', + 'localvarcontenttype', + 'localvarcontenttypes', + 'localvarcookieparams', + 'localvarformparams', + 'localvarheaderparams', + 'localvarpath', + 'localvarpostbody', + 'localvarqueryparams', + 'long', + 'native', + 'new', + 'null', + 'object', + 'offsetdatetime', + 'package', + 'private', + 'protected', + 'public', + 'return', + 'short', + 'static', + 'strictfp', + 'stringutil', + 'super', + 'switch', + 'synchronized', + 'this', + 'throw', + 'throws', + 'transient', + 'try', + 'void', + 'volatile', + 'while' +]; +// Reserved word 'enum' and 'default' are removed from above reserved word array as they are common in openAPI keyword +export default async function lintReservedWords(input) { + // Iterate over properties of the input object + for (const path in input) { + if (typeof path === 'string') { + + for (const word of reservedWords) { + const regex = new RegExp(`\\b${word}\\b`, 'g'); // Use a regular expression to match 'word' as a standalone word + + if (regex.test(path)) { + const warningRuleName = 'camara-reserved-words'; + const description = `Reserved words found in input: Consider avoiding the use of reserved word '${word}'`; + // const location = `${path}`; + + console.log(`warning ${warningRuleName} ${description} ${path}`); + } + } + } + } +} diff --git a/lint_function/camara-security-no-secrets-in-path-or-query-parameters.js b/lint_function/camara-security-no-secrets-in-path-or-query-parameters.js new file mode 100644 index 0000000..7387bb4 --- /dev/null +++ b/lint_function/camara-security-no-secrets-in-path-or-query-parameters.js @@ -0,0 +1,23 @@ +const sensitiveData = ['MSISDN','IMSI','phoneNumber']; + +export default async function (input) { + + // Iterate over properties of the input object + for (const path in input) { + + if (typeof path === 'string') { + for (const word of sensitiveData ) { + const regex = new RegExp(`\\b${word}\\b`, 'g'); // Use a regular expression to match 'word' as a standalone word + + if (regex.test(path)) { + + const warningRuleName = 'camara-security-no-secrets-in-path-or-query-parameters'; + const description = `sensitiveData Data found in path: Consider avoiding the use of sensitiveData data '${word}'`; + const location = `paths.${path}`; + console.log(`warning ${warningRuleName} ${description} ${location}`); + + } + } + } + } +} From 86f5a6cadee4c3b8fb70bcae27743d01fa077d42 Mon Sep 17 00:00:00 2001 From: PEDRO DIEZ GARCIA Date: Wed, 24 Jan 2024 13:27:46 +0100 Subject: [PATCH 02/10] update --- .spectral.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.spectral.yml b/.spectral.yml index 306c628..e9b82c2 100644 --- a/.spectral.yml +++ b/.spectral.yml @@ -46,6 +46,7 @@ rules: oas3-valid-schema-example: true oas3-server-variables: true + # Custom Rules Utilizing Spectral's Built-in Functions and JavaScript Implementations camara-language-avoid-telco: From 7f89bca9342abb08f6f60e77498ea76bf72320a7 Mon Sep 17 00:00:00 2001 From: PEDRO DIEZ GARCIA Date: Wed, 24 Jan 2024 13:55:55 +0100 Subject: [PATCH 03/10] editorial_update --- .spectral.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.spectral.yml b/.spectral.yml index e9b82c2..306c628 100644 --- a/.spectral.yml +++ b/.spectral.yml @@ -46,7 +46,6 @@ rules: oas3-valid-schema-example: true oas3-server-variables: true - # Custom Rules Utilizing Spectral's Built-in Functions and JavaScript Implementations camara-language-avoid-telco: From f6710d3863f731d62036fbf744e2c4bc3488a7b0 Mon Sep 17 00:00:00 2001 From: PEDRO DIEZ GARCIA Date: Wed, 24 Jan 2024 17:02:42 +0100 Subject: [PATCH 04/10] update_linter_config_24_ENE --- .github/workflows/megalinter.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/megalinter.yml b/.github/workflows/megalinter.yml index 007438f..1711086 100644 --- a/.github/workflows/megalinter.yml +++ b/.github/workflows/megalinter.yml @@ -40,7 +40,7 @@ jobs: - name: Install Spectral functions run: npm install -g @stoplight/spectral-functions - name: Run spectral:oas Spectral Linting - run: spectral lint code/API_definitions/openapi.yaml --verbose --ruleset .spectral.yml + run: spectral lint code/API_definitions/carrier_billing.yaml --verbose --ruleset .spectral.yml # Replace openapi.yaml file with your API specification file # MegaLinter @@ -60,6 +60,7 @@ jobs: DISABLE_LINTERS: SPELL_CSPELL,SPELL_LYCHEE,YAML_PRETTIER,REPOSITORY_SEMGREP,REPOSITORY_DEVSKIM,REPOSITORY_KICS,REPOSITORY_TRIVY,REPOSITORY_CHECKOV,REPOSITORY_GITLEAKS,JAVA_PMD YAML_YAMLLINT_CONFIG_FILE: ".yamllint.yaml" JAVA_CHECKSTYLE_CONFIG_FILE: "javalint.xml" + OPENAPI_SPECTRAL_CONFIG_FILE: ".spectral.yml" # Upload MegaLinter artifacts - name: Archive production artifacts From eaacdfaf003648e541e60f1dd1273df7af6e7190 Mon Sep 17 00:00:00 2001 From: PEDRO DIEZ GARCIA Date: Fri, 2 Feb 2024 18:45:48 +0100 Subject: [PATCH 05/10] linter_aligment_proposal_31_ENE --- .github/workflows/megalinter.yml | 16 +++-- .github/workflows/spectral_oas_lint.yml | 17 ++--- .spectral.yml | 66 ++++++++++++++++--- .yamllint.yaml | 6 +- lint_function/camara-language-avoid-telco.js | 3 + lint_function/camara-reserved-words.js | 3 + ...-no-secrets-in-path-or-query-parameters.js | 3 + 7 files changed, 87 insertions(+), 27 deletions(-) diff --git a/.github/workflows/megalinter.yml b/.github/workflows/megalinter.yml index 1711086..455905e 100644 --- a/.github/workflows/megalinter.yml +++ b/.github/workflows/megalinter.yml @@ -1,6 +1,9 @@ --- # MegaLinter GitHub Action configuration file # More info at https://megalinter.io +# CAMARA Project - Github Action for Pull Reqests +# 31.01.2024 - initial version + name: MegaLinter on: # yamllint disable-line rule:truthy @@ -31,7 +34,7 @@ jobs: steps: # Git Checkout - name: Checkout Code - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: token: ${{ secrets.GITHUB_TOKEN }} fetch-depth: 0 # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to improve performances @@ -39,8 +42,8 @@ jobs: run: npm install -g @stoplight/spectral - name: Install Spectral functions run: npm install -g @stoplight/spectral-functions - - name: Run spectral:oas Spectral Linting - run: spectral lint code/API_definitions/carrier_billing.yaml --verbose --ruleset .spectral.yml + # - name: Run spectral:oas Spectral Linting + # run: spectral lint code/API_definitions/*.yaml --verbose --ruleset .spectral.yml # Replace openapi.yaml file with your API specification file # MegaLinter @@ -52,20 +55,21 @@ jobs: env: # All available variables are described in documentation # https://megalinter.io/configuration/ + PRINT_ALPACA: false # VALIDATE_ALL_CODEBASE: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} # Validates all source when push on main, else just the git diff with main. Override with true if you always want to lint all sources VALIDATE_ALL_CODEBASE: true GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # ADD YOUR CUSTOM ENV VARIABLES HERE OR DEFINE THEM IN A FILE .mega-linter.yml AT THE ROOT OF YOUR REPOSITORY DISABLE: COPYPASTE,MARKDOWN - DISABLE_LINTERS: SPELL_CSPELL,SPELL_LYCHEE,YAML_PRETTIER,REPOSITORY_SEMGREP,REPOSITORY_DEVSKIM,REPOSITORY_KICS,REPOSITORY_TRIVY,REPOSITORY_CHECKOV,REPOSITORY_GITLEAKS,JAVA_PMD + DISABLE_LINTERS: SPELL_CSPELL,SPELL_LYCHEE,YAML_PRETTIER,REPOSITORY_GRYPE, REPOSITORY_SEMGREP,REPOSITORY_DEVSKIM,REPOSITORY_KICS,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,REPOSITORY_CHECKOV,REPOSITORY_GITLEAKS,YAML_V8R,JAVA_PMD,JAVA_CHECKSTYLE YAML_YAMLLINT_CONFIG_FILE: ".yamllint.yaml" - JAVA_CHECKSTYLE_CONFIG_FILE: "javalint.xml" OPENAPI_SPECTRAL_CONFIG_FILE: ".spectral.yml" + YAML_YAMLLINT_FILTER_REGEX_INCLUDE: "(code/)" # Upload MegaLinter artifacts - name: Archive production artifacts if: ${{ success() }} || ${{ failure() }} - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@v4 with: name: MegaLinter reports path: | diff --git a/.github/workflows/spectral_oas_lint.yml b/.github/workflows/spectral_oas_lint.yml index 37424b4..a828fd5 100644 --- a/.github/workflows/spectral_oas_lint.yml +++ b/.github/workflows/spectral_oas_lint.yml @@ -1,14 +1,12 @@ --- -name: Spectral +# CAMARA Project - workflow configuration to manually run CAMARA OAS rules +# see https://docs.github.com/en/actions/using-workflows/manually-running-a-workflow +# 31.01.2024 - initial version + +name: Spectral manual run on: workflow_dispatch -# env: # Comment env block if you do not want to apply fixes - # Apply linter fixes configuration -# APPLY_FIXES: all # When active, APPLY_FIXES must also be defined as environment variable (in github/workflows/mega-linter.yml or other CI tool) -# APPLY_FIXES_EVENT: pull_request # Decide which event triggers application of fixes in a commit or a PR (pull_request, push, all) -# APPLY_FIXES_MODE: commit # If APPLY_FIXES is used, defines if the fixes are directly committed (commit) or posted in a PR (pull_request) - concurrency: group: ${{ github.ref }}-${{ github.workflow }} cancel-in-progress: true @@ -26,7 +24,7 @@ jobs: steps: # Git Checkout - name: Checkout Code - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: token: ${{ secrets.GITHUB_TOKEN }} fetch-depth: 0 # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to improve performances @@ -34,6 +32,5 @@ jobs: run: npm install -g @stoplight/spectral - name: Install Spectral functions run: npm install -g @stoplight/spectral-functions - - name: Run spectral:oas Spectral Linting + - name: Run Spectral linting run: spectral lint code/API_definitions/*.yaml --verbose --ruleset .spectral.yml - # Replace openapi.yaml file with your API specification file diff --git a/.spectral.yml b/.spectral.yml index 306c628..dc21cb8 100644 --- a/.spectral.yml +++ b/.spectral.yml @@ -1,3 +1,7 @@ +# CAMARA Project - linting ruleset - documentation avaialable here: +# https://github.com/camaraproject/Commonalities/blob/main/documentation/Linting-rules.md +# 31.01.2024 - initial version + extends: "spectral:oas" functions: - camara-reserved-words @@ -36,7 +40,7 @@ rules: typed-enum: true oas3-api-servers: true oas3-examples-value-or-externalValue: true - oas3-operation-security-defined: true + oas3-operation-security-defined: false oas3-parameter-description: false oas3-schema: true oas3-server-not-example.com: false @@ -44,7 +48,7 @@ rules: oas3-unused-component: true oas3-valid-media-example: true oas3-valid-schema-example: true - oas3-server-variables: true + # oas3-server-variables: true # Custom Rules Utilizing Spectral's Built-in Functions and JavaScript Implementations @@ -134,12 +138,54 @@ rules: then: function: camara-reserved-words recommended: true # Set to true/false to enable/disable this rule - + + camara-routes-description: + message: "Functionality method description Warning: Each method should have description." + severity: warn + description: | + This rule checks if each operation (POST, GET, DELETE, PUT, PATCH, OPTIONS) in your API specification has a description. + Ensure that you have added a 'summary' field for each operation in your OpenAPI specification. + given: + - "$.paths.*.post" + - "$.paths.*.get" + - "$.paths.*.delete" + - "$.paths.*.put" + - "$.paths.*.patch" + - "$.paths.*.options" + then: + field: description + function: truthy + recommended: true # Set to true/false to enable/disable this rule + camara-parameters-descriptions: message: "Parameter description is missing or empty: {{error}}" severity: warn description: | - This Spectral rule ensures that each parameter in the API specification, including components and properties, has a descriptive and meaningful description. + This Spectral rule ensures that each path parameter in the API specification has a descriptive and meaningful description. + given: + - "$.paths..parameters.*" + then: + field: description + function: truthy + recommended: true # Set to true/false to enable/disable this rule + + camara-response-descriptions: + message: "Parameter description is missing or empty: {{error}}" + severity: warn + description: | + This Spectral rule ensures that each responese object in the API specification has a descriptive and meaningful description. + given: + - "$.paths..responses.*" + then: + field: description + function: truthy + recommended: true # Set to true/false to enable/disable this rule + + camara-properties-descriptions: + message: "Property description is missing or empty: {{error}}" + severity: warn + description: | + This Spectral rule ensures that each propoerty within objects in the API specification has a descriptive and meaningful description. given: - "$.components.*.*" - "$.components.*.*.properties.*" @@ -147,7 +193,7 @@ rules: field: description function: truthy recommended: true # Set to true/false to enable/disable this rule - + camara-operation-summary: message: "Operation Summary Warning: Each operation should include a short summary for better understanding." severity: warn @@ -169,7 +215,7 @@ rules: camara-discriminator-use: description: | Ensure that API definition YAML files with oneOf or anyOf sections include a discriminator object for serialization, deserialization, and validation. - severity: warn + severity: hint given: "$..[?(@.oneOf || @.anyOf)]" then: field: discriminator @@ -201,12 +247,12 @@ rules: recommended: true # Set to true/false to enable/disable this rule camara-parameter-casing-convention: - description: This rule checks Paths should follow a specific case convention kebab-case. + description: Paths should be kebab-case. severity: error - message: "{{property}} should be kebab-case: {{error}}" + message: "{{property}} is not kebab-case: {{error}}" given: $.paths[*]~ then: - function: casing + function: pattern functionOptions: - type: kebab + match: "^\/([a-z0-9]+(-[a-z0-9]+)*)?(\/[a-z0-9]+(-[a-z0-9]+)*|\/{.+})*$" # doesn't allow /asasd{asdas}sadas pattern or not closed braces recommended: true # Set to true/false to enable/disable this rule diff --git a/.yamllint.yaml b/.yamllint.yaml index b47dce9..3926875 100644 --- a/.yamllint.yaml +++ b/.yamllint.yaml @@ -1,4 +1,6 @@ --- +# CAMARA Project - YAML linting configuration for yamllint https://yamllint.readthedocs.io/en/latest/rules.html +# 31.01.2024 - initial version yaml-files: - '*.yaml' @@ -11,6 +13,7 @@ rules: colons: enable commas: enable comments: + min-spaces-from-content: 1 level: error comments-indentation: level: error @@ -24,7 +27,8 @@ rules: key-ordering: disable line-length: disable new-line-at-end-of-file: enable - new-lines: enable + new-lines: + type: platform octal-values: disable quoted-strings: disable trailing-spaces: enable diff --git a/lint_function/camara-language-avoid-telco.js b/lint_function/camara-language-avoid-telco.js index f534cf7..061b543 100644 --- a/lint_function/camara-language-avoid-telco.js +++ b/lint_function/camara-language-avoid-telco.js @@ -1,3 +1,6 @@ +// CAMARA Project - support function for Spectral linter +// 31.01.2024 - initial version + const replacements = [ { original: 'UE', recommended: 'device' }, { original: 'MSISDN', recommended: 'phone number' }, diff --git a/lint_function/camara-reserved-words.js b/lint_function/camara-reserved-words.js index d82d50f..c28e63a 100644 --- a/lint_function/camara-reserved-words.js +++ b/lint_function/camara-reserved-words.js @@ -1,3 +1,6 @@ +// CAMARA Project - support function for Spectral linter +// 31.01.2024 - initial version + const reservedWords = [ 'abstract', 'apiclient', diff --git a/lint_function/camara-security-no-secrets-in-path-or-query-parameters.js b/lint_function/camara-security-no-secrets-in-path-or-query-parameters.js index 7387bb4..ebbff2a 100644 --- a/lint_function/camara-security-no-secrets-in-path-or-query-parameters.js +++ b/lint_function/camara-security-no-secrets-in-path-or-query-parameters.js @@ -1,3 +1,6 @@ +// CAMARA Project - support function for Spectral linter +// 31.01.2024 - initial version + const sensitiveData = ['MSISDN','IMSI','phoneNumber']; export default async function (input) { From 9de6e3ff9d525c8abb9160a752efd342df49c0b1 Mon Sep 17 00:00:00 2001 From: PEDRO DIEZ GARCIA Date: Wed, 7 Feb 2024 17:10:10 +0100 Subject: [PATCH 06/10] align_linter_config_with_commonalities_PR110 --- .spectral.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.spectral.yml b/.spectral.yml index dc21cb8..0b16508 100644 --- a/.spectral.yml +++ b/.spectral.yml @@ -138,7 +138,7 @@ rules: then: function: camara-reserved-words recommended: true # Set to true/false to enable/disable this rule - + camara-routes-description: message: "Functionality method description Warning: Each method should have description." severity: warn From 9162e2f09d9914eae6c82d9d4e532715d12620f0 Mon Sep 17 00:00:00 2001 From: PEDRO DIEZ GARCIA Date: Wed, 7 Feb 2024 18:12:46 +0100 Subject: [PATCH 07/10] adapt_folder_checking --- .github/workflows/megalinter.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/megalinter.yml b/.github/workflows/megalinter.yml index 455905e..7661b8f 100644 --- a/.github/workflows/megalinter.yml +++ b/.github/workflows/megalinter.yml @@ -42,8 +42,8 @@ jobs: run: npm install -g @stoplight/spectral - name: Install Spectral functions run: npm install -g @stoplight/spectral-functions - # - name: Run spectral:oas Spectral Linting - # run: spectral lint code/API_definitions/*.yaml --verbose --ruleset .spectral.yml + - name: Run spectral:oas Spectral Linting + run: spectral lint code/API_definitions/*.yaml --verbose --ruleset .spectral.yml # Replace openapi.yaml file with your API specification file # MegaLinter From 2a853d6228e3fa7b382d8d6c4bb0d636cdab922b Mon Sep 17 00:00:00 2001 From: PEDRO DIEZ GARCIA Date: Wed, 7 Feb 2024 18:21:39 +0100 Subject: [PATCH 08/10] revert_previous_change --- .github/workflows/megalinter.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/megalinter.yml b/.github/workflows/megalinter.yml index 7661b8f..455905e 100644 --- a/.github/workflows/megalinter.yml +++ b/.github/workflows/megalinter.yml @@ -42,8 +42,8 @@ jobs: run: npm install -g @stoplight/spectral - name: Install Spectral functions run: npm install -g @stoplight/spectral-functions - - name: Run spectral:oas Spectral Linting - run: spectral lint code/API_definitions/*.yaml --verbose --ruleset .spectral.yml + # - name: Run spectral:oas Spectral Linting + # run: spectral lint code/API_definitions/*.yaml --verbose --ruleset .spectral.yml # Replace openapi.yaml file with your API specification file # MegaLinter From c942a9137254a7050e8c2652e94f6a2601014466 Mon Sep 17 00:00:00 2001 From: PEDRO DIEZ GARCIA Date: Thu, 8 Feb 2024 13:04:30 +0100 Subject: [PATCH 09/10] align_with_commonalities_status_07_feb --- .github/workflows/megalinter.yml | 1 + .yamllint.yaml | 3 +-- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/megalinter.yml b/.github/workflows/megalinter.yml index 455905e..6bda700 100644 --- a/.github/workflows/megalinter.yml +++ b/.github/workflows/megalinter.yml @@ -65,6 +65,7 @@ jobs: YAML_YAMLLINT_CONFIG_FILE: ".yamllint.yaml" OPENAPI_SPECTRAL_CONFIG_FILE: ".spectral.yml" YAML_YAMLLINT_FILTER_REGEX_INCLUDE: "(code/)" + OPENAPI_SPECTRAL_FILTER_REGEX_INCLUDE: "(code/)" # Upload MegaLinter artifacts - name: Archive production artifacts diff --git a/.yamllint.yaml b/.yamllint.yaml index 3926875..081ef09 100644 --- a/.yamllint.yaml +++ b/.yamllint.yaml @@ -27,8 +27,7 @@ rules: key-ordering: disable line-length: disable new-line-at-end-of-file: enable - new-lines: - type: platform + new-lines: disable octal-values: disable quoted-strings: disable trailing-spaces: enable From ba6e6483d193a6763a512bae49810e7912576927 Mon Sep 17 00:00:00 2001 From: PEDRO DIEZ GARCIA Date: Thu, 15 Feb 2024 14:03:03 +0100 Subject: [PATCH 10/10] Trigger_linter_relaunch