Repository navigation
docs: improve per flavor traceability - #1509
Open
Ron (rjaegers) wants to merge 14 commits into
Open
Ron (rjaegers) wants to merge 14 commits into
Ron (rjaegers) wants to merge 14 commits into
Conversation
Show full source references in the SVP and RTM and distinguish declared traceability from execution evidence. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Keep full procedure descriptions in the SVP and link to unique requirement/procedure anchors from the RTM. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Use stable test IDs and a textual SVP reference instead of Markdown cross-document links and HTML anchors. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Keep full requirement descriptions in the SRS and preserve capability headings for context. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Compile the SBDL model from product feature/test sources and the two annotated workflows instead of recursively ingesting the repository, keeping the documentation fixture out of the supplier model. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Enumerate all test and workflow source files while excluding only the standalone sample SBDL fixture. Preserve the test model instead of narrowing directory roots. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Remove only the documentation fixture from the ephemeral checkout before invoking the SBDL compiler recursively. Keep compiler output outside the scanned tree until compilation succeeds. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Relocate requirement-only compatibility, maintainability, security, and debugging feature sources into docs/requirements while leaving executable scenarios under test. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Keep flavor-specific BDD scenarios and their tags under test while moving compilation and analysis declarations to docs/requirements. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Keep flavor-tagged Gherkin scenarios alongside their requirement declarations and filter acceptance test generation using the target flavor tag. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Ron (rjaegers)
changed the title
Contributor
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Max errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|---|
| ✅ ACTION | actionlint | 23 | 0 | 0 | 0.1s | ||
| ✅ DOCKERFILE | hadolint | 4 | 0 | 0 | 0.24s | ||
| ✅ JSON | npm-package-json-lint | yes | no | no | 0.38s | ||
| ✅ JSON | prettier | 51 | 8 | 0 | 0 | 1.14s | |
| ✅ JSON | v8r | 51 | 0 | 0 | 18.34s | ||
| ✅ MARKDOWN | markdownlint | 13 | 0 | 0 | 0 | 0.52s | |
| ✅ MARKDOWN | markdown-table-formatter | 13 | 1 | 0 | 0 | 0.25s | |
| ✅ REPOSITORY | betterleaks | yes | no | no | 0.92s | ||
| ✅ REPOSITORY | checkov | yes | no | no | 27.66s | ||
| ✅ REPOSITORY | git_diff | yes | no | no | 0.01s | ||
| ✅ REPOSITORY | grype | yes | no | no | 92.04s | ||
| osv-scanner | yes | 1 | 3 | 1.66s | |||
| ✅ REPOSITORY | secretlint | yes | no | no | 0.99s | ||
| ✅ REPOSITORY | syft | yes | no | no | 2.33s | ||
| ✅ REPOSITORY | trivy | yes | no | no | 15.3s | ||
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.44s | ||
| ✅ REPOSITORY | trufflehog | yes | no | no | 2.45s | ||
| lychee | 123 | 1 | 0 | 21.22s | |||
| ✅ YAML | prettier | 36 | 1 | 0 | 0 | 0.84s | |
| ✅ YAML | v8r | 36 | 0 | 0 | 8.01s | ||
| ✅ YAML | yamllint | 36 | 0 | 0 | 1.01s |
Detailed Issues
⚠️ SPELL / lychee - 1 error
📝 Summary
---------------------
🔍 Total..........154
🔗 Unique.........126
✅ Successful.....148
⏳ Timeouts.........0
🔀 Redirected......19
👻 Excluded.........0
❓ Unknown..........0
🚫 Errors...........1
⛔ Unsupported......1
Errors in .github/TOOL_VERSION_ISSUE_TEMPLATE.md
[403] https://developer.arm.com/downloads/-/arm-gnu-toolchain-downloads (at 38:7) | Rejected status code: 403 Forbidden
Hint: Followed 19 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
⚠️ REPOSITORY / osv-scanner - 1 error
warning: Package '@azure/msal-node@5.6.0' is vulnerable to 'CVE-2026-109461' (also known as 'GHSA-xcx6-jx8p-x3h5').
= CVE-2026-109461: MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
= ### Impact
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow.
### Patches
Version 7.1.0 and higher are patched.
### Workarounds
Ensure you pass in only the auth_code to to acquireTokenByCode
warning: Package 'bare-metal@0.2.5' is vulnerable to 'RUSTSEC-2026-0110'.
= RUSTSEC-2026-0110: bare-metal is deprecated
= The `bare-metal` crate has been deprecated and archived.
For `Mutex` and `CriticalSection`, see the [`critical-section`](https://crates.io/crates/critical-section) crate instead.
warning: Package 'bare-metal@0.2.5' is vulnerable to 'RUSTSEC-2026-0110'.
= RUSTSEC-2026-0110: bare-metal is deprecated
= The `bare-metal` crate has been deprecated and archived.
For `Mutex` and `CriticalSection`, see the [`critical-section`](https://crates.io/crates/critical-section) crate instead.
warning: 3 warnings emitted
See detailed reports in MegaLinter artifacts
You could have the same capabilities but better runtime performances if you use a MegaLinter flavor:
- oxsecurity/megalinter/flavors/salesforce@v10.1.0 (58 linters)
Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)
- Documentation: Custom Flavors
- Command:
npx mega-linter-runner@10.1.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,DOCKERFILE_HADOLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R
Show us your support by starring ⭐ the repository
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| permissions: *build-push-test-permissions | ||
| with: | ||
| acceptance-test-path: ${{ (github.actor != 'dependabot[bot]' && matrix.flavor == 'cpp') && 'test/cpp/features' || '' }} | ||
| acceptance-test-tag: '@flavor:${{ matrix.flavor }}' |
Contributor
There was a problem hiding this comment.
[MegaLinter] reported by reviewdog 🐶
Suggested change
| acceptance-test-tag: '@flavor:${{ matrix.flavor }}' | |
| acceptance-test-tag: "@flavor:${{ matrix.flavor }}" |
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The host-compilation acceptance scenario is grouped under the ARM Cortex rule, undermining the traceability this PR aims to improve.
No open issues 🎉
What changed in this PR
This PR improves per-flavor requirements traceability by centralizing requirement definitions, adding Rust test links, and filtering acceptance scenarios by container flavor.
Changes:
- Consolidates requirements under
docs/requirementsand updates related references. - Passes flavor tags through acceptance-test workflows and Playwright configuration.
- Adds test source locations to generated documentation and distinguishes declared traceability from execution results.
| File | Description |
|---|---|
test/rust/integration-tests.bats |
Adds requirement-trace annotations to existing tests. |
test/embedded-cpp/features/compilation.feature |
Removes the relocated ARM compilation requirement. |
test/cpp/features/playwright.config.ts |
Uses centralized features and environment-based tag filtering. |
docs/templates/software-verification-plan.md.j2 |
Includes test source locations. |
docs/templates/requirements-traceability-matrix.md.j2 |
Shows stable IDs, source locations, and declared traceability. |
docs/requirements/static-dynamic-analysis.feature |
Centralizes analysis requirements and the formatting scenario. |
docs/requirements/security.feature |
Centralizes supply-chain security requirements. |
docs/requirements/maintainability.feature |
Centralizes maintainability requirements. |
docs/requirements/embedded-debugging.feature |
Centralizes the firmware-upload requirement. |
docs/requirements/debugging.feature |
Centralizes debugging requirements. |
docs/requirements/compilation.feature |
Adds the relocated ARM Cortex compilation requirement. |
docs/requirements/compatibility.feature |
Centralizes platform and tooling compatibility requirements. |
docs/adr/0000-record-architecture-decisions.md |
Updates the maintainability requirement link. |
.github/workflows/wc-document-generation.yml |
Removes the sample model before compilation. |
.github/workflows/wc-build-push-test.yml |
Accepts and forwards the acceptance-test tag. |
.github/workflows/wc-acceptance-test.yml |
Requires a flavor tag and exposes it to acceptance tests. |
.github/workflows/build-push-test.yml |
Supplies the matrix flavor tag. |
Review effort: Balanced
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Update the BDD watcher to monitor docs/requirements and the actual Playwright harness paths. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Contributor
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🚀 Hey, I have created a Pull Request
Description of changes
This pull request introduces several improvements to requirements traceability, acceptance test configuration, and documentation structure. The most significant changes include enhanced traceability reporting in documentation, improved configuration and selection of acceptance test scenarios by tag, and the relocation and deduplication of requirement definitions. There are also updates to the Playwright and BDD test infrastructure to better support these changes.
Requirements traceability and documentation:
requirements-traceability-matrix.md.j2) now lists each requirement with its declared verification tests and their source locations, clarifies that a trace link does not guarantee test execution or passing, and provides improved traceability reporting and summary. [1] [2] [3]software-verification-plan.md.j2) now displays the source location for each test linked to a requirement.Acceptance test configuration and selection:
wc-build-push-test.yml,build-push-test.yml,wc-acceptance-test.yml) now pass and consume anacceptance-test-taginput, enabling selection of test scenarios by tag (e.g.,@flavor:cpp). The acceptance test job now checks for this tag and passes it as an environment variable. [1] [2] [3] [4] [5]playwright.config.ts) and related scripts are updated to select features from the new requirements directory and filter scenarios by theACCEPTANCE_TEST_TAGenvironment variable. [1] [2]Requirements and test definitions:
test/embedded-cpp/features/compilation.feature(now removed) todocs/requirements/compilation.feature, consolidating requirement definitions in the documentation. [1] [2]integration-tests.batsare now explicitly linked to requirements with SBDL annotations, improving traceability. [1] [2] [3] [4] [5] [6]Document generation and validation:
✔️ Checklist