Compliant Policies Arguments Validation

[almog2296]

Related Issues

fixes: Ticket

Description

Adds a new ignorable validation (BA129) that ensures commands/scripts declare the appropriate compliantpolicies when using arguments associated with specific compliance standards (defined in compliant_policies.json).

Key Logic:
Checks if command arguments match any known policy arguments.
Verifies that the compliantpolicies field contains the required policy name.
Multi-Policy Support: If an argument is associated with multiple policies (e.g., "Soft" and "Hard" remediation), the validation passes if at least one of them is present.

[github-actions]

Changelog(s) in markdown:

• Adds a new ignorable validation (BA129) that ensures commands/scripts declare the appropriate compliantpolicies when using arguments associated with specific compliance standards (defined in compliant_policies.json). #5168

[github-actions]

Changelog(s) in markdown:

• Adds a new validation (BA129) that ensures commands/scripts declare the appropriate compliantpolicies when using arguments associated with specific compliance standards (defined in compliant_policies.json). #5168

[Shellyber]

You can only report the actually missing policies to give more precise feedback.
Something like:

missing_for_arg = valid_policy_options - declared_policies
if missing_for_arg:
    problematic_arguments.add(arg)
    missing_policy_options.update(missing_for_arg)

[almog2296]

I can’t do this because, for example, for "user" it is sufficient that at least one policy is available "Hard User Remediation" or "Soft User Remediation".
So i check whether there is any overlap between the required and declared policies. If an overlap exists, we continue. If not, we add the relevant missing optional policies.

It will report only actually missing required policies because its per argument.