9f6e6f7fb3
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
Signals CI & Image / signals-ci (push) Has been cancelled
Policy Lint & Smoke / policy-lint (push) Has been cancelled
Policy Simulation / policy-simulate (push) Has been cancelled
SDK Publish & Sign / sdk-publish (push) Has been cancelled
AOC Guard CI / aoc-guard (push) Has been cancelled
AOC Guard CI / aoc-verify (push) Has been cancelled
Concelier Attestation Tests / attestation-tests (push) Has been cancelled
devportal-offline / build-offline (push) Has been cancelled
50 lines
1.6 KiB
Bash
50 lines
1.6 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
ROOT=$(cd "$(dirname "$0")/.." && pwd)
|
|
CLI_PROJECT="$ROOT/Cli/StellaOps.Cli/StellaOps.Cli.csproj"
|
|
POLICY_FILES=("docs/examples/policies/baseline.stella" "docs/examples/policies/internal-only.stella" "docs/examples/policies/serverless.stella")
|
|
SBOM_FILE="docs/examples/policies/sample-sbom.json"
|
|
OUT_DIR="${OUT_DIR:-out/policy-sim}"
|
|
THRESHOLD=${THRESHOLD:-0}
|
|
|
|
usage() {
|
|
cat <<'USAGE'
|
|
Batch policy simulate harness (DEVOPS-POLICY-27-002)
|
|
- Runs stella policy simulate against sample policies and a sample SBOM
|
|
- Fails if violation count exceeds THRESHOLD (default 0)
|
|
|
|
Env/flags:
|
|
OUT_DIR=out/policy-sim
|
|
THRESHOLD=0
|
|
SBOM_FILE=docs/examples/policies/sample-sbom.json
|
|
USAGE
|
|
}
|
|
|
|
if [[ ${1:-} == "-h" || ${1:-} == "--help" ]]; then usage; exit 0; fi
|
|
mkdir -p "$OUT_DIR"
|
|
|
|
violations=0
|
|
for policy in "${POLICY_FILES[@]}"; do
|
|
name=$(basename "$policy" .stella)
|
|
report="$OUT_DIR/${name}-simulate.json"
|
|
dotnet run --project "$CLI_PROJECT" -- policy simulate --policy "$policy" --sbom "$SBOM_FILE" --format json --no-color > "$report"
|
|
# count violations if field exists
|
|
count=$(python - <<PY "$report"
|
|
import json,sys
|
|
with open(sys.argv[1]) as f:
|
|
data=json.load(f)
|
|
viol = 0
|
|
if isinstance(data, dict):
|
|
viol = len(data.get("violations", [])) if isinstance(data.get("violations", []), list) else 0
|
|
print(viol)
|
|
PY)
|
|
echo "[$name] violations=$count" | tee -a "$OUT_DIR/summary.txt"
|
|
violations=$((violations + count))
|
|
done
|
|
|
|
echo "total_violations=$violations" | tee -a "$OUT_DIR/summary.txt"
|
|
if (( violations > THRESHOLD )); then
|
|
echo "Violation threshold exceeded ($violations > $THRESHOLD)" >&2
|
|
exit 1
|
|
fi
|