feat(frameworks): own grouping/taxonomy upstream - fix M365-Assess sync regression + v3.5.0 render-taxonomy#411
Merged
Conversation
…stops regressing it M365-Assess consumes data/frameworks/*.json verbatim via sync-checkid.yml, but its hand-added grouping/taxonomy presentation metadata (groupBy, groupLabel, groups, sections, taxonomyDecision, taxonomyReason, note) was absent from CheckID's source — so every sync (e.g. Galvnyz/M365-Assess#989 for v3.4.1) overwrote it, dropping CIS M365 v6 sections "4: Intune" and "9: Fabric (Power BI)", the SCuBA groups map (incl. MS.INTUNE), and grouping metadata across 12 other frameworks. Port the enrichment upstream so CheckID is the complete source of truth and the next sync is a no-op for these keys. Also relabels 31 previously-orphaned registry checks (5 Intune 4.x, 26 Power BI 9.x) under their correct CIS M365 v6 sections. No schema change (frameworks.schema.json already permits these via additionalProperties). Idempotency verified against M365-Assess base for all 14 files; 377 Pester tests pass.
…pendices Declare render-taxonomy grouping for the 4 frameworks that had none (#323) and close a latent coverage gap in PCI-DSS: - iso-27017: section-prefix axis (ISO/IEC 27002:2015 clauses 5-18) - nist-800-171: family axis (3.1-3.14 NIST 800-171 R2 families + NFO bucket; new groupBy strategy "nist-800-171-family") - gdpr / nis2: article axis (new groupBy strategy "article-prefix") - pci-dss: add appendix groups A1/A2/A3 — registry has appendix controls the 1-12 requirement map did not cover (would have landed in downstream "Other") Every declared group map covers 100% of the controlId prefixes present in data/registry.json (verified by the new group-coverage test).
…age test Resolves the schema half of the render-taxonomy contract (#407): declare the optional keys groupBy (enum of 9 parser strategies), groupLabel, groups, sections, controls, taxonomyDecision, taxonomyReason in data/frameworks.schema.json (additionalProperties stays true; no existing file breaks — all 20 validate). Add tests/framework-grouping-coverage.Tests.ps1: for every framework that declares a groupBy, assert each registry controlId resolves to a declared group key via that strategy's parser. Satisfies the "every controlId resolves to a declared family" acceptance criterion shared by #318-#322. 409 Pester tests pass.
Daren9m
added this to the
v3.5.0 — Cross-Cutting Reconciliation & Canonical Data Layer milestone
Content enrichment populationOverall (1106 checks): rationale 26.4% (292/1106) • impact 26.4% (292/1106) • references 26.4% (292/1106)
Informational only — does not gate the build. The hard release-gate for Critical/High enrichment lives in #281 (v3.2.0). |
Framework mapping count delta
Result: ✓ PASS — no framework mapping regressions detected. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
M365-Assess consumes CheckID's
data/frameworks/*.jsonverbatim via itssync-checkid.ymlworkflow (seeREFERENCES.md: "Fetchdata/registry.jsonanddata/frameworks/*.jsonfrom the tagged version"). The grouping/taxonomy presentation metadata that M365-Assess maintainers had hand-added downstream was never present in CheckID's source, so every sync overwrote it.The v3.4.1 auto-sync PR Galvnyz/M365-Assess#989 dropped, among others:
cis-m365-v6sections "4": "Intune" and "9": "Fabric (Power BI)"cisa-scubagroupsmap includingMS.INTUNEThis PR makes CheckID the canonical owner of that metadata so the next sync is a no-op, and delivers the planned v3.5.0 render-taxonomy layer on top of it.
What
1. Stop the regression (
fix(frameworks): carry grouping/taxonomy metadata ...)Restore
groupBy/groupLabel/groups/sections/taxonomyDecision/taxonomyReason/noteto the 14 frameworks #989 regressed. Verified byte-idempotent against M365-Assess base, so re-syncing produces zero grouping diff. Relabels 31 previously-orphaned registry checks (5 Intune4.x, 26 Power BI9.x) under their correct CIS M365 v6 sections.2. Backfill + completeness (
feat(frameworks): backfill native grouping axes ...)Declare native axes for the 4 frameworks that had none (#323):
section-prefixnist-800-171-family(new)article-prefix(new)article-prefix(new)Also completes PCI-DSS: adds appendix groups
A1/A2/A3. The registry has appendix controls that the 1-12 requirement map did not cover (a latent "Other" bucket on the M365-Assess side too).3. Contract + enforcement (
feat(frameworks): formalize render-taxonomy schema keys ...)Formalize the render-taxonomy keys in
data/frameworks.schema.json(#407):groupBy(enum of 9 strategies),groupLabel,groups/sections/controls,taxonomyDecision,taxonomyReason.additionalPropertiesstaystrue; all 20 framework files validate. Addtests/framework-grouping-coverage.Tests.ps1asserting every registry controlId resolves to a declared group for eachgroupByframework.New contract vocabulary (please review)
Two new
groupBystrategy names join the cross-repo contract; consumers that render native grouping must implement them:article-prefix--^Article\s+(\d+)-> article number (gdpr, nis2)nist-800-171-family--NFO*->NFO, else first two dot-segments (3.12.1->3.12)Testing
frameworks.schema.json.groupByframework's map covers 100% of registry controlId prefixes.Rollout
sync-checkid-- the framework files then sync clean.Closes #318, #319, #320, #321, #322, #323, #407
Refs #317, #324, Galvnyz/M365-Assess#989