Repository navigation
docs: improve per flavor traceability - #1509
Open
Ron (rjaegers) wants to merge 15 commits into
Open
Ron (rjaegers) wants to merge 15 commits into
Ron (rjaegers) wants to merge 15 commits into
Conversation
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Ron (rjaegers)
changed the title
Contributor
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Max errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|---|
| ✅ ACTION | actionlint | 23 | 0 | 0 | 0.3s | ||
| ✅ DOCKERFILE | hadolint | 4 | 0 | 0 | 0.51s | ||
| ✅ JSON | npm-package-json-lint | yes | no | no | 0.52s | ||
| ✅ JSON | prettier | 53 | 14 | 0 | 0 | 3.51s | |
| ✅ JSON | v8r | 53 | 0 | 0 | 16.91s | ||
| ✅ MARKDOWN | markdownlint | 13 | 0 | 0 | 0 | 1.24s | |
| ✅ MARKDOWN | markdown-table-formatter | 13 | 0 | 0 | 0 | 0.31s | |
| ✅ REPOSITORY | betterleaks | yes | no | no | 1.32s | ||
| ✅ REPOSITORY | checkov | yes | no | no | 21.85s | ||
| ✅ REPOSITORY | git_diff | yes | no | no | 0.03s | ||
| ✅ REPOSITORY | grype | yes | no | no | 109.72s | ||
| osv-scanner | yes | 1 | 4 | 1.82s | |||
| ✅ REPOSITORY | secretlint | yes | no | no | 1.38s | ||
| ✅ REPOSITORY | syft | yes | no | no | 5.57s | ||
| ✅ REPOSITORY | trivy | yes | no | no | 14.08s | ||
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.47s | ||
| ✅ REPOSITORY | trufflehog | yes | no | no | 5.43s | ||
| ✅ SPELL | lychee | 125 | 0 | 0 | 10.64s | ||
| ✅ YAML | prettier | 36 | 0 | 0 | 0 | 1.54s | |
| ✅ YAML | v8r | 36 | 0 | 0 | 12.2s | ||
| ✅ YAML | yamllint | 36 | 0 | 0 | 1.35s |
Detailed Issues
⚠️ REPOSITORY / osv-scanner - 1 error
warning: Package 'minimatch@10.2.6' is vulnerable to 'CVE-2026-118764' (also known as 'GHSA-g3hv-75wg-m249').
= CVE-2026-118764: minimatch has potential denial of service via globparts amplification
= minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess() when optimizationLevel >= 2.
researcher: Reid Downing (b1nv0id)
files:
- src/index.ts: 690-770
- src/index.ts: 780-796
issue:
input-controlled growth of globParts during first-phase preprocessing, followed by quadratic second-phase processing.
the **/../ transformation clones a globparts entry and appends the clone to the same globparts array:
parts.splice(gs, 1)
const other = parts.slice(0)
other[gs] = '**'
globParts.push(other)
this occurs inside a do...while (didSomething) fixpoint loop, allowing generated entries to be processed again.
the expanded globparts array is subsequently processed by secondPhasePreProcess(), which performs pairwise comparisons:
for (let i = 0; i < globParts.length - 1; i++) {
for (let j = i + 1; j < globParts.length; j++) {
this.partsMatch(...)
}
}
an attacker who can supply a glob pattern can therefore cause additional pattern entries to be generated during preprocessing, followed by quadratic pairwise processing, resulting in excessive cpu and memory consumption.
warning: Package 'minimatch@10.2.4' is vulnerable to 'CVE-2026-118764' (also known as 'GHSA-g3hv-75wg-m249').
= CVE-2026-118764: minimatch has potential denial of service via globparts amplification
= minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess() when optimizationLevel >= 2.
researcher: Reid Downing (b1nv0id)
files:
- src/index.ts: 690-770
- src/index.ts: 780-796
issue:
input-controlled growth of globParts during first-phase preprocessing, followed by quadratic second-phase processing.
the **/../ transformation clones a globparts entry and appends the clone to the same globparts array:
parts.splice(gs, 1)
const other = parts.slice(0)
other[gs] = '**'
globParts.push(other)
this occurs inside a do...while (didSomething) fixpoint loop, allowing generated entries to be processed again.
the expanded globparts array is subsequently processed by secondPhasePreProcess(), which performs pairwise comparisons:
for (let i = 0; i < globParts.length - 1; i++) {
for (let j = i + 1; j < globParts.length; j++) {
this.partsMatch(...)
}
}
an attacker who can supply a glob pattern can therefore cause additional pattern entries to be generated during preprocessing, followed by quadratic pairwise processing, resulting in excessive cpu and memory consumption.
warning: Package 'bare-metal@0.2.5' is vulnerable to 'RUSTSEC-2026-0110'.
= RUSTSEC-2026-0110: bare-metal is deprecated
= The `bare-metal` crate has been deprecated and archived.
For `Mutex` and `CriticalSection`, see the [`critical-section`](https://crates.io/crates/critical-section) crate instead.
warning: Package 'bare-metal@0.2.5' is vulnerable to 'RUSTSEC-2026-0110'.
= RUSTSEC-2026-0110: bare-metal is deprecated
= The `bare-metal` crate has been deprecated and archived.
For `Mutex` and `CriticalSection`, see the [`critical-section`](https://crates.io/crates/critical-section) crate instead.
warning: 4 warnings emitted
See detailed reports in MegaLinter artifacts
You could have the same capabilities but better runtime performances if you use a MegaLinter flavor:
- oxsecurity/megalinter/flavors/salesforce@v10.1.0 (58 linters)
Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)
- Documentation: Custom Flavors
- Command:
npx mega-linter-runner@10.1.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,DOCKERFILE_HADOLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R
Show us your support by starring ⭐ the repository
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The host-compilation acceptance scenario is grouped under the ARM Cortex rule, undermining the traceability this PR aims to improve.
No open issues 🎉
What changed in this PR
This PR improves per-flavor requirements traceability by centralizing requirement definitions, adding Rust test links, and filtering acceptance scenarios by container flavor.
Changes:
- Consolidates requirements under
docs/requirementsand updates related references. - Passes flavor tags through acceptance-test workflows and Playwright configuration.
- Adds test source locations to generated documentation and distinguishes declared traceability from execution results.
| File | Description |
|---|---|
test/rust/integration-tests.bats |
Adds requirement-trace annotations to existing tests. |
test/embedded-cpp/features/compilation.feature |
Removes the relocated ARM compilation requirement. |
test/cpp/features/playwright.config.ts |
Uses centralized features and environment-based tag filtering. |
docs/templates/software-verification-plan.md.j2 |
Includes test source locations. |
docs/templates/requirements-traceability-matrix.md.j2 |
Shows stable IDs, source locations, and declared traceability. |
docs/requirements/static-dynamic-analysis.feature |
Centralizes analysis requirements and the formatting scenario. |
docs/requirements/security.feature |
Centralizes supply-chain security requirements. |
docs/requirements/maintainability.feature |
Centralizes maintainability requirements. |
docs/requirements/embedded-debugging.feature |
Centralizes the firmware-upload requirement. |
docs/requirements/debugging.feature |
Centralizes debugging requirements. |
docs/requirements/compilation.feature |
Adds the relocated ARM Cortex compilation requirement. |
docs/requirements/compatibility.feature |
Centralizes platform and tooling compatibility requirements. |
docs/adr/0000-record-architecture-decisions.md |
Updates the maintainability requirement link. |
.github/workflows/wc-document-generation.yml |
Removes the sample model before compilation. |
.github/workflows/wc-build-push-test.yml |
Accepts and forwards the acceptance-test tag. |
.github/workflows/wc-acceptance-test.yml |
Requires a flavor tag and exposes it to acceptance tests. |
.github/workflows/build-push-test.yml |
Supplies the matrix flavor tag. |
Review effort: Balanced
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Ron (rjaegers)
temporarily deployed
to
acceptance-testing
October 27, 2026 13:31 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
Contributor
Ron (rjaegers)
temporarily deployed
to
acceptance-testing
October 27, 2026 13:55 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Show full source references in the SVP and RTM and distinguish declared traceability from execution evidence. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Keep full procedure descriptions in the SVP and link to unique requirement/procedure anchors from the RTM. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Use stable test IDs and a textual SVP reference instead of Markdown cross-document links and HTML anchors. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Keep full requirement descriptions in the SRS and preserve capability headings for context. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Compile the SBDL model from product feature/test sources and the two annotated workflows instead of recursively ingesting the repository, keeping the documentation fixture out of the supplier model. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Enumerate all test and workflow source files while excluding only the standalone sample SBDL fixture. Preserve the test model instead of narrowing directory roots. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Remove only the documentation fixture from the ephemeral checkout before invoking the SBDL compiler recursively. Keep compiler output outside the scanned tree until compilation succeeds. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Relocate requirement-only compatibility, maintainability, security, and debugging feature sources into docs/requirements while leaving executable scenarios under test. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Keep flavor-specific BDD scenarios and their tags under test while moving compilation and analysis declarations to docs/requirements. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Keep flavor-tagged Gherkin scenarios alongside their requirement declarations and filter acceptance test generation using the target flavor tag. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Update the BDD watcher to monitor docs/requirements and the actual Playwright harness paths. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Signed-off-by: Ron <45816308+rjaegers@users.noreply.github.com>
Ron (rjaegers)
force-pushed
the
docs/improve-per-flavor-traceability
branch
from
November 6, 2026 10:41
48a2b19 to
4b723d8
Compare
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🚀 Hey, I have created a Pull Request
Description of changes
This pull request introduces several improvements to requirements traceability, acceptance test configuration, and documentation structure. The most significant changes include enhanced traceability reporting in documentation, improved configuration and selection of acceptance test scenarios by tag, and the relocation and deduplication of requirement definitions. There are also updates to the Playwright and BDD test infrastructure to better support these changes.
Requirements traceability and documentation:
requirements-traceability-matrix.md.j2) now lists each requirement with its declared verification tests and their source locations, clarifies that a trace link does not guarantee test execution or passing, and provides improved traceability reporting and summary. [1] [2] [3]software-verification-plan.md.j2) now displays the source location for each test linked to a requirement.Acceptance test configuration and selection:
wc-build-push-test.yml,build-push-test.yml,wc-acceptance-test.yml) now pass and consume anacceptance-test-taginput, enabling selection of test scenarios by tag (e.g.,@flavor:cpp). The acceptance test job now checks for this tag and passes it as an environment variable. [1] [2] [3] [4] [5]playwright.config.ts) and related scripts are updated to select features from the new requirements directory and filter scenarios by theACCEPTANCE_TEST_TAGenvironment variable. [1] [2]Requirements and test definitions:
test/embedded-cpp/features/compilation.feature(now removed) todocs/requirements/compilation.feature, consolidating requirement definitions in the documentation. [1] [2]integration-tests.batsare now explicitly linked to requirements with SBDL annotations, improving traceability. [1] [2] [3] [4] [5] [6]Document generation and validation:
✔️ Checklist