fix: v0.34.0 — docs/safety/ scaffold-path fallback + requirement registry sync - #46
Merged
Merged
Conversation
…stry sync iso26262.Assess, iec61508.Assess, do178.Assess, sci.Build, and sas.Build only checked SAFETY_PLAN.md/SVP.md/SCMP.md/SQAP.md at the bare project root, so a project scaffolded via `gofusa init`/`gofusa template` (which default to docs/safety/) immediately reported false gaps. Fixed by adding fusa.ResolveDoc, mirroring the multi-candidate-path handling iec62443.go already had for SECURITY.md/INCIDENT-RESPONSE.md. Also closed a 142-ID / 727-occurrence orphan-tag gap found while verifying the fix: entire subsystems (sas, sci, hara, gapreport, badge, metrics, disposition, impact, coupling, several analyze rules, and ~40 CLI-subcommand tags) carried real annotations never registered in .fusa-reqs.json. Registered all 142, fixed the handful of ID mismatches/duplicates found along the way, and added the test tags that became visible once those requirements entered the coverage gate. Closes #45 Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>
CI's doc-version-check gate requires README.md's Docker published-tags line and docs/tool-safety-manual.md's version header to reference the current fusa.Version. Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| if err := os.MkdirAll(filepath.Join(dir, "docs", "safety"), 0o755); err != nil { | ||
| t.Fatalf("mkdir: %v", err) | ||
| } | ||
| if err := os.WriteFile(filepath.Join(dir, "docs", "safety", "SAFETY_PLAN.md"), []byte("x"), 0o644); err != nil { |
| //fusa:test REQ-DOC001 | ||
| func TestBuild_DocsSafetyScaffoldPath(t *testing.T) { | ||
| dir := t.TempDir() | ||
| if err := os.MkdirAll(filepath.Join(dir, "docs", "safety"), 0o755); err != nil { |
| t.Fatalf("mkdir: %v", err) | ||
| } | ||
| for _, f := range []string{"SAFETY_PLAN.md", "SVP.md", "SCMP.md", "SQAP.md"} { | ||
| if err := os.WriteFile(filepath.Join(dir, "docs", "safety", f), []byte("x"), 0o644); err != nil { |
| //fusa:test REQ-DOC001 | ||
| func TestBuild_DocsSafetyScaffoldPath(t *testing.T) { | ||
| dir := t.TempDir() | ||
| if err := os.MkdirAll(filepath.Join(dir, "docs", "safety"), 0o755); err != nil { |
| if err := os.MkdirAll(filepath.Join(dir, "docs", "safety"), 0o755); err != nil { | ||
| t.Fatalf("mkdir: %v", err) | ||
| } | ||
| if err := os.WriteFile(filepath.Join(dir, "docs", "safety", "SAFETY_PLAN.md"), []byte("x"), 0o644); err != nil { |
| } | ||
| if docScaffoldFiles[name] { | ||
| alt := filepath.Join(projectRoot, "docs", "safety", filepath.FromSlash(name)) | ||
| if _, err := os.Stat(alt); err == nil { |
| //fusa:req REQ-DOC001 | ||
| func ResolveDoc(projectRoot, name string) string { | ||
| root := filepath.Join(projectRoot, filepath.FromSlash(name)) | ||
| if _, err := os.Stat(root); err == nil { |
| t.Fatalf("mkdir: %v", err) | ||
| } | ||
| for _, f := range []string{"SAFETY_PLAN.md", "SVP.md", "SCMP.md", "SQAP.md"} { | ||
| if err := os.WriteFile(filepath.Join(dir, "docs", "safety", f), []byte("x"), 0o644); err != nil { |
| //fusa:test REQ-DOC001 | ||
| func TestAssess_DocsSafetyScaffoldPath(t *testing.T) { | ||
| dir := t.TempDir() | ||
| if err := os.MkdirAll(filepath.Join(dir, "docs", "safety"), 0o755); err != nil { |
| // builders that check for these same files on disk also check | ||
| // docs/safety/<name> as a fallback to the bare project-root path, so a | ||
| // freshly-scaffolded project doesn't immediately report false gaps (#45). | ||
| var docScaffoldFiles = map[string]bool{ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
iso26262.Assess,iec61508.Assess,do178.Assess,sci.Build, andsas.Buildonly checkedSAFETY_PLAN.md/SVP.md/SCMP.md/SQAP.mdat the bare project root, so a project scaffolded viagofusa init/gofusa template(which default todocs/safety/) immediately reported false gaps against its own freshly-generated docs.fusa.ResolveDoc(projectRoot, name string) string, mirroring the multi-candidate-path handlingiec62443.goalready had forSECURITY.md/INCIDENT-RESPONSE.md, and wired it into all five builders.gofusa tracesurfaced a pre-existing 142-ID / 727-occurrence orphan-tag gap: entire subsystems (sas,sci,hara,gapreport,badge,metrics,disposition,impact,coupling, severalanalyzerules, and ~40 CLI-subcommand tags) carried real//fusa:req///fusa:testannotations that were never registered in.fusa-reqs.json. Registered all 142 (title/text/standard derived from each implementation's doc comment or--helpusage text), fixed a handful of ID mismatches/duplicates found along the way, and closed the test-tag gaps that became visible once those requirements entered the coverage gate..fusa-reqs.json: 233 → 363 requirements.gofusa trace: 0 orphans, 0 untested (down from 142 orphans / 568 TRACE009 warnings).Closes #45
Test plan
go build ./...— cleango vet ./...— cleango test ./...— all packages passgo test ./... -cover— every package at or above the 80% gategofusa trace --dir .— 0 orphan tags, 0 untested requirements (previously 142 orphans / 568 TRACE009 warnings)gofusa check --dir .— 0 ERROR findings, warning count dropped from 1007 to 437 (entirely from TRACE009 clearing)SAFETY_PLAN.md/SVP.md/SCMP.md/SQAP.mdunderdocs/safety/(matchinggofusa initdefaults) no longer reports those as gaps iniso26262/iec61508/do178/sci/sas