OWASP / OWASP/cornucopia

Make deck scaffolding cover content files, drop the redundant image config, and copy images into static/ automatically

Open
#3,454 2 comments 0 reactions 1 assignee Claimed by @ayman-art View on GitHub
cornucopia.owasp.org enhancement github_actions python
Dominant language
Python
Stars
146
Forks
97
Avg merge
1d 7h
Merged PRs (30d)
104

Description

**Is your feature request related to a problem? Please describe.**

Onboarding a new deck still needs manual steps beyond dropping in the cards YAML:

1. `data/cards/{edition}-cards-{version}-{lang}/{suit}/{id}/technical-note.md`+`explanation.md` must exist or the card fails silently. the `scripts/scaffold_cards.py` script generates these but has to be run by hand, per file.
2. `source/eop-card-images-5.0.yaml` hand-lists an image path per card (`SP2: { image: "/images/eop-cards/spoofing-2.png" }`) even though the path is derivable from suit+value.
3. Images are placed directly in `cornucopia.owasp.org/static/images/...` by hand. There's no source-side location or copy step.

**Describe the solution you'd like**

- Auto-generate missing `en` content files for browsable decks as part of the build; other languages keep falling back to `en` as it is currently handled. Adding a language's own content folder stays a manual, deliberate step.

- Default image paths to a suit+value naming convention, but keep the explicit per-card YAML as an optional override for cards that don't fit the convention.
- Add a source-side images folder per deck and make copying it into `static/images/{edition}-cards/` part of the build's scaffolding step too.

**Describe alternatives you've considered**

- Auto-generating for every discovered language instead of just `en`: but this is not the current implemenation, since translations without their own content intentionally fall back to `-en`, and generating stubs for them would silently override that fallback.
- Verifying scaffolding exists and failing the build instead of generating it: simpler, no cross-language build step, but doesn't self-heal.
- Reimplementing the scaffolding logic in JS instead of calling the Python script: avoids adding Python to CI, but duplicates already-tested logic.

**Additional context**

Related to the broader idea of automating new-deck onboarding, so a new deck can be dropped in with minimal manual wiring. Reusing `scripts/scaffold_cards.py` for the `en` auto-generation means adding a Python setup step to the website's build/deploy CI workflows, which currently only provision pnpm/Node.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.