StackGuardian / StackGuardian/tirith
feat(cli): policy packs — a manifest that selects and tags a policy set
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 165
- Forks
- 42
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 11
Description
A pack file lists policies (paths or git sources) with tags (meta.compliance: [cis-1.4, pci]) and
default severity handling. tirith --pack cis.json -input-path plan.json runs the subset; with
--fail-on-severity that is "run the CIS pack at high+". Coverage claims on a pack must exclude
never-firing stubs — stub inflation is universal in upstream compliance content (thousands of
framework requirements ship with zero executable checks) — so the pack format should carry a
"can this check ever fail?" bit.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the CLI entry points for --pack, -input-path, and --fail-on-severity, then inspect how policies and git or path sources are currently loaded. The work is done when a pack manifest can select and tag policies, apply default and severity handling, and represent whether checks can ever fail for coverage purposes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100