Add per product control files

[Mab879]

Description:

Adds the ability for control files to come from the product folder.

This is a very draft to get feedback. I plan on exploring inheritance vs the total overriding like today.

Rationale:

Fixes #14036

Review Hints:

• Move some control files for other products to product specific folder.
• Play with duplicate control file ids, make sure that overriding works as expected. You should get warning when you do.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[Mab879]

@ComplianceAsCode/suse-maintainers currently if same control id is in the product controls folder and the product controls it will fully override it for that product is that expected behavior you for?

[svet-se]

@ComplianceAsCode/suse-maintainers currently if same control id is in the product controls folder and the product controls it will fully override it for that product is that expected behavior you for?

Hey @Mab879, yes, in the current context, it makes sense for the product controls to override the controls.

[Mab879]

/packit retest-failed

[vojtapolasek]

Looks good, please see my specific comment.

[vojtapolasek]

This would be always True.

Suggested change

	if policy in self.policies:
	raise ValueError("Policy %s already exists" % policy)
	if policy.id in self.policies:
	raise ValueError(f"Policy {policy.id} was defined first at {self.policies[policy.id].filepath} and now another policy with the same ID is being loaded from {policy.filepath}.")

[Mab879]

Always was false, but I moved this to a warning. I did not think this should be an error.

[vojtapolasek]

You are correct. This is not about overriding of controls, but whole policies.

[vojtapolasek]

/retest

[openshift-ci]

@Mab879: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-node-compliance	7bfaf6b	link	true	/test e2e-aws-openshift-node-compliance
ci/prow/e2e-aws-openshift-platform-compliance	7bfaf6b	link	true	/test e2e-aws-openshift-platform-compliance

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[vojtapolasek]

I am waiving OCP tests, it looks like an infrastructure error. Moreover, we are not touching the ocp4 product.

[vojtapolasek]

Looks good now, thank you.

[marcusburghardt]

Hi @Mab879 , it broke a transformation workflow to OSCAL: https://github.com/ComplianceAsCode/content/actions/runs/19137808094/job/54694313641

Is that something experimental or already defined? If so, we probably need to also adapt integrations relying in control files.

[Mab879]

We might add inheritance vs the straight replacement of policies, but that is TBD.