test ScubaBaselines.json generation #10
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Purpose: Automatically generates ScubaBaselines.json from baseline markdown files when they are modified in a PR. | |
| # This ensures the machine-readable baseline asset package stays in sync with the authoritative markdown source. | |
| name: Generate ScubaBaselines.json from Markdown | |
| on: | |
| pull_request: | |
| paths: | |
| - 'PowerShell/ScubaGear/baselines/aad.md' | |
| - 'PowerShell/ScubaGear/baselines/defender.md' | |
| - 'PowerShell/ScubaGear/baselines/exo.md' | |
| - 'PowerShell/ScubaGear/baselines/powerbi.md' | |
| - 'PowerShell/ScubaGear/baselines/powerplatform.md' | |
| - 'PowerShell/ScubaGear/baselines/sharepoint.md' | |
| - 'PowerShell/ScubaGear/baselines/teams.md' | |
| - 'utils/workflow/Generate-ScubaBaseline.ps1' | |
| - '.github/workflows/generate_baseline_json.yaml' | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| generate-baseline: | |
| name: Generate Baseline JSON | |
| runs-on: windows-latest | |
| steps: | |
| - name: Checkout PR branch | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.head_ref }} | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| fetch-depth: 0 # Fetch full history to enable branch comparison | |
| - name: Configure Git | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| - name: Check for baseline changes | |
| id: check_changes | |
| shell: pwsh | |
| run: | | |
| # Get list of changed files in the PR | |
| $changedFiles = git diff --name-only origin/${{ github.base_ref }}...HEAD | |
| # Define baseline markdown files | |
| $baselineFiles = @( | |
| 'PowerShell/ScubaGear/baselines/aad.md', | |
| 'PowerShell/ScubaGear/baselines/defender.md', | |
| 'PowerShell/ScubaGear/baselines/exo.md', | |
| 'PowerShell/ScubaGear/baselines/powerbi.md', | |
| 'PowerShell/ScubaGear/baselines/powerplatform.md', | |
| 'PowerShell/ScubaGear/baselines/sharepoint.md', | |
| 'PowerShell/ScubaGear/baselines/teams.md' | |
| ) | |
| # Check if any baseline files changed | |
| $baselineChanged = $false | |
| foreach ($file in $changedFiles) { | |
| if ($baselineFiles -contains $file) { | |
| $baselineChanged = $true | |
| Write-Output "Baseline file changed: $file" | |
| } | |
| } | |
| # Set output for next steps | |
| if ($baselineChanged) { | |
| Write-Output "Baseline markdown files have changed - will generate JSON" | |
| "baseline_changed=true" | Out-File -FilePath $env:GITHUB_OUTPUT -Append | |
| } else { | |
| Write-Output "Only workflow files changed - skipping JSON generation" | |
| "baseline_changed=false" | Out-File -FilePath $env:GITHUB_OUTPUT -Append | |
| } | |
| - name: Generate ScubaBaselines.json | |
| if: steps.check_changes.outputs.baseline_changed == 'true' | |
| shell: pwsh | |
| run: | | |
| # Run the generation script with validation and output to schema folder | |
| .\utils\workflow\Generate-ScubaBaseline.ps1 -OutputPath "PowerShell/ScubaGear/schemas/ScubaBaselines.json" -Validate | |
| Write-Output "`nGeneration complete!" | |
| - name: Check for changes to commit | |
| if: steps.check_changes.outputs.baseline_changed == 'true' | |
| id: check_commit | |
| shell: pwsh | |
| run: | | |
| # Check if ScubaBaselines.json was modified | |
| $status = git status --porcelain PowerShell/ScubaGear/schemas/ScubaBaselines.json | |
| if ($status) { | |
| Write-Output "ScubaBaselines.json has been modified" | |
| "has_changes=true" | Out-File -FilePath $env:GITHUB_OUTPUT -Append | |
| } else { | |
| Write-Output "No changes to ScubaBaselines.json" | |
| "has_changes=false" | Out-File -FilePath $env:GITHUB_OUTPUT -Append | |
| } | |
| - name: Commit and push changes | |
| if: steps.check_commit.outputs.has_changes == 'true' | |
| shell: pwsh | |
| env: | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| PR_BRANCH: ${{ github.head_ref }} | |
| run: | | |
| Write-Output "Committing updated ScubaBaselines.json to PR branch" | |
| # Add the generated file | |
| git add PowerShell/ScubaGear/schemas/ScubaBaselines.json | |
| # Commit with descriptive message | |
| git commit -m "Auto-generate ScubaBaselines.json from markdown baselines | |
| This file was automatically generated by the GitHub Actions workflow. | |
| Workflow: generate_baseline_json.yaml | |
| Trigger: Baseline markdown file changes in PR #$env:PR_NUMBER | |
| Generated: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss UTC') | |
| " | |
| # Push to the PR branch | |
| git push origin HEAD:$env:PR_BRANCH | |
| Write-Output "Successfully committed and pushed ScubaBaselines.json" | |
| - name: Add PR comment | |
| if: steps.check_commit.outputs.has_changes == 'true' | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const message = `## ScubaBaselines.json Auto-Generated | |
| The machine-readable baseline asset package has been automatically updated based on your markdown baseline changes. | |
| ### What happened? | |
| - Parsed all baseline markdown files | |
| - Extracted policy metadata and exclusion mappings | |
| - Generated versioned JSON output | |
| - Validated JSON structure | |
| - Committed \`PowerShell/ScubaGear/schemas/ScubaBaselines.json\` to this PR | |
| ### Next steps | |
| - Review the generated JSON file in the PR diff | |
| - Ensure the changes align with your baseline updates | |
| - If everything looks good, the JSON will be included when this PR is merged | |
| --- | |
| *This is an automated message from the \`generate_baseline_json.yaml\` workflow.*`; | |
| github.rest.issues.createComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: context.issue.number, | |
| body: message | |
| }); | |
| - name: Summary | |
| if: always() | |
| shell: pwsh | |
| run: | | |
| if ("${{ steps.check_changes.outputs.baseline_changed }}" -eq "true") { | |
| Write-Output "Baseline markdown files changed" | |
| if ("${{ steps.check_commit.outputs.has_changes }}" -eq "true") { | |
| Write-Output "ScubaBaselines.json generated and committed" | |
| } else { | |
| Write-Output "ScubaBaselines.json unchanged (no updates needed)" | |
| } | |
| } else { | |
| Write-Output "No baseline markdown changes detected" | |
| Write-Output " Only workflow/script files were modified" | |
| } |