bamaer opened a new issue, #8814:
URL: https://github.com/apache/hop/issues/8814
### What would you like to happen?
### What
An optional `tags:` map on each rule in a rule pack's YAML. Values are a
string or a list of strings.
```yaml
SEC-002:
# ...the rule as today...
tags:
category: secrets
owner: platform-team
policy: ["SEC-POL-4", "SEC-POL-7"]
```
The engine never evaluates tags. They are carried onto every finding the
rule produces and written out:
- **SARIF:** `properties.tags` on the rule as a flat array of `key:value`
strings (the form GitHub code scanning and Azure DevOps read), plus the
structured map under `properties.hopTags`. While there, also write the rule's
description as `fullDescription`, and `helpUri` when a rule gives one.
- **JSON:** a `tags` object on each finding.
The YAML parser should log a warning for an unknown key on a rule, instead
of dropping it silently.
### Why
Teams and vendors want to attach their own meaning to a rule without
changing what it checks: a category, an owning team, a link to an internal
policy or control. Today the only free-form data on a rule is `parameters:`,
and parameters change how a rule behaves, so they are the wrong place for it.
Keeping tags inert means a pack can change its tags with no risk of changing
its findings.
The unknown-key warning matters for the same reason: a typo such as `tag:`
would otherwise remove every tag without anyone noticing.
### Out of scope
- A built-in tag vocabulary.
- Filtering or grouping by tag in Hop GUI (can follow later).
### Done when
- A rule's tags appear in SARIF and JSON output.
- Unknown keys on a rule are logged as warnings.
- The rule pack documentation describes `tags:`.
### Issue Priority
Priority: 2
### Issue Component
Component: Hop Config, Component: Metadata
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
