feat: add comply pipeline workflow#40
Draft
jpower432 wants to merge 24 commits into
Draft
Conversation
Add repeatable --source and --schema flags to the mcp serve command, allowing direct configuration without a YAML file. When --source flags are present, a ComplyPackConfig is built from flag values; otherwise the existing --config file path is used. - parseSourceFlags: handles oci:// (TLS) and oci+http:// (plain HTTP) - parseSchemaFlags: handles bare platform names and platform=source syntax - Refactor NewServer to accept ServerOptions.Config directly Assisted-by: Claude (Anthropic, Claude Opus 4.6) Signed-off-by: Jennifer Power <[email protected]>
Remove hardcoded version "1.0" from buildConfigFromFlags in mcp.go since the MCP server does not use the version field (it's only needed for pack/scan commands). Add comprehensive test for buildConfigFromFlags to verify complete flag-to-config transformation including source parsing, schema parsing, and proper struct field population. Assisted-by: Claude (Anthropic, Claude Opus 4.6) Signed-off-by: Jennifer Power <[email protected]>
Multi-stage build with UBI 9 micro base image. Produces a minimal container for MCP server distribution via GHCR. Refs: complytime#24 ADR: docs/adr/012-container-mcp-distribution.md Assisted-by: Claude (Anthropic, Claude Opus 4.6) Signed-off-by: Jennifer Power <[email protected]>
Uses org-infra reusable workflows for GHCR publish with SLSA provenance, SBOM attestations, and Sigstore signing. Multi-arch (amd64/arm64) build on version tags and main pushes. Refs: complytime#24 Assisted-by: Claude (Anthropic, Claude Opus 4.6) Signed-off-by: Jennifer Power <[email protected]>
Claude Code, Cursor, and Gemini CLI manifests following the superpowers multi-manifest pattern. Updates .mcp.json to reference the container image. Restructures skill directory layout. Removes openpackage.yml and legacy install docs. Refs: complytime#24 Assisted-by: Claude (Anthropic, Claude Opus 4.6) Signed-off-by: Jennifer Power <[email protected]>
Covers Claude Code, OpenCode, flag syntax, config file fallback, and image verification. Refs: complytime#24 Assisted-by: Claude (Anthropic, Claude Opus 4.6) Signed-off-by: Jennifer Power <[email protected]>
Copy CA certificates into the UBI micro container so the CUE registry (registry.cue.works) is reachable over TLS. Assisted-by: Claude (Anthropic, Claude Opus 4.6) Signed-off-by: Jennifer Power <[email protected]>
Pin reusable workflow references to SHA and pin ubi9-micro to a versioned digest to satisfy zizmor and hadolint. Assisted-by: Claude (Anthropic, Claude Opus 4.6) Signed-off-by: Jennifer Power <[email protected]>
Signed-off-by: Jennifer Power <[email protected]> Co-authored-by: Jennifer Power <[email protected]>
Signed-off-by: Jennifer Power <[email protected]>
Previously, passing only --schema without --source fell through to config file loading and failed. Now either flag triggers the flags-based config path. Assisted-by: Claude (Anthropic, Claude Opus 4.6) Signed-off-by: Jennifer Power <[email protected]>
Prevents auto-loading a broken config with placeholder values and :latest tag. Users copy and fill in their own registry, source, and pinned version. Assisted-by: Claude (Anthropic, Claude Opus 4.6) Signed-off-by: Jennifer Power <[email protected]>
- Fix allowed_identity_regex to match org-infra reusable workflow origin - Add Trivy image scan stage between build and sign - Gate signing on scan success via verify_vuln - Run container as non-root user (ARG USER_UID=10001) Assisted-by: Claude (Anthropic, Claude Opus 4.6) Signed-off-by: Jennifer Power <[email protected]>
Add delta comparison engine for parameter harmonization across framework layers with mismatch-only verdicts. Add analyze_parameter_delta MCP tool. Extend get_assessment_requirements with scope filter (array of applicability groups) so models can query by maturity level without parsing catalog files. Include artifact kind (Policy, ControlCatalog, etc.) in MCP resource listing. Add ImportedGuidanceIDs to ResolvedPolicy. Assisted-by: Claude (Anthropic, Claude Opus 4.6) Signed-off-by: Jennifer Power <[email protected]>
Add comply pipeline skills (scoping, mapping, adherence) with router that dispatches sub-stages by filename from the skill base directory. Add /comply:pack for Rego generation and /comply:setup for workspace configuration. Skills enforce MCP-grounded control data access via get_assessment_requirements with scope filter. Update plugin manifests to register new commands. Assisted-by: Claude (Anthropic, Claude Opus 4.6) Signed-off-by: Jennifer Power <[email protected]>
…mply pipeline Assisted-by: Claude (Anthropic, Claude Opus 4.6) Signed-off-by: Jennifer Power <[email protected]>
Strip verdicts, specificity detection, and string-matching heuristics from the delta engine. The tool now gathers structured L3 parameter values alongside L1/L2 requirement text and returns them as pairs. The model interprets the relationship — parsing prose for parameter values is what AI does well and heuristics do poorly. Assisted-by: Claude (Anthropic, Claude Opus 4.6) Signed-off-by: Jennifer Power <[email protected]>
Signed-off-by: Jennifer Power <[email protected]>
Remove verdict types, specificity layers, and heuristic references. Mapping skill now instructs the model to interpret parameter comparisons using domain context rather than relying on engine verdicts. Output schema uses comparisons with interpretation field. Assisted-by: Claude (Anthropic, Claude Opus 4.6) Signed-off-by: Jennifer Power <[email protected]>
The tool previously only looked up resolved policies by name. When a catalog name was passed, it failed with "policy not found". Now falls back to wrapping a bare catalog in a synthetic ResolvedPolicy so the tool works with both policy and catalog names. Assisted-by: Claude (Anthropic, Claude Opus 4.6) Signed-off-by: Jennifer Power <[email protected]>
Signed-off-by: Jennifer Power <[email protected]>
Signed-off-by: Jennifer Power <[email protected]>
jpower432
changed the title
Use hyphenated field names (mapping-references, assessment-plans, evaluation-methods, accepted-values, reference-id). Add required fields: title (top-level), metadata.author, contacts, scope with applicability groups. Fix evaluation-methods to use id/type/mode structure. Add id fields to assessment plans and parameters. Assisted-by: Claude (Anthropic, Claude Opus 4.6) Signed-off-by: Jennifer Power <[email protected]>
Fixes golangci-lint unused finding. Assisted-by: Claude (Anthropic, Claude Opus 4.6) Signed-off-by: Jennifer Power <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds a user invocable command for running with multiple stages -
scopingfrom a system profile +mappingdetermines imports and parameters harmonization +adherenceto determine what evidence will be collection.Related Issues
Blocked by #31
Closes #26
Demo'd using #39
Review Hints