Skip to content
cis-controls

Playbooks

  • Cut a release nobody has checked this yet, still a draft
    How a release is made: Conventional Commits on main, an ## [Unreleased] changelog section, the v0.0.0 baseline tag that keeps the first release at 0.1.0, and semantic-release.yml, which tags the release and dispatches Knowledge Release to attach schema-<tag>-cis-controls.yaml once KNOWLEDGE_RELEASE_ENABLED is true.

  • Knowledge sources map nobody has checked this yet, still a draft, a reader disputed this on .github/ISSUE_TEMPLATE
    The librarian’s scrape map: every repository location and external page this bundle derives concepts from, the concepts each yields, how to re-check each on a refresh run, and the paths left out on purpose.

  • Regenerate and test after a schema change nobody has checked this yet, still a draft
    How to change the schema and check it: uv sync --group dev, edit src/cis_controls/schema/cis_controls.yaml with no CIS text in it, then just lint, just gen-project, just gen-doc, just lokf-adapt and just test, and the pre-commit hooks before a pull request.

  • Update the upstream pins nobody has checked this yet, still a draft
    What to do when the weekly upstream watch reports that CIS’s pages name a version of the CIS Controls newer than the pinned 8.1.2, no longer name 8.1, have gone or redirected, or could not be read: read CIS’s notes, decide whether the schema moves, and move the pins in scripts/check_upstream_release.py and the schema header together.

  • Validate data against the schema nobody has checked this yet, still a draft
    How to validate CIS Controls data with linkml-validate before loading it into the generated Python models, which check less: the dataclasses check no pattern, and the Pydantic models miss the identifier types’ patterns. No validator checks that a Safeguard carries its Control’s number, a repeated identifier or group, or that IG1 brings IG2.