Finding filters via Phase 1 of .weaver.toml config file#1256
Conversation
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #1256 +/- ##
=======================================
- Coverage 81.9% 81.8% -0.1%
=======================================
Files 115 119 +4
Lines 9850 9938 +88
=======================================
+ Hits 8069 8137 +68
- Misses 1781 1801 +20 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
jsuereth
left a comment
There was a problem hiding this comment.
I love the direction, but soft-blocking.
- I think we need to understand what
WeaverConfigof today is meant to do vs. this. - We should figure out if
tomlvs.yamlis ok - It's possible we want a formal split between
WeaverPackageConfigandWeaverRuntimeConfig. I can buy that, but let's not use confusing names between crates here.
|
TBH, I've never read the comment at the top of the weaver_forge config.rs - I totally didn't realise it was meant to be used for weaver configuration in general! My bad!
Yes! I would like to understand that. I've always seen the
We can do
This is much better than my confusing reuse of the name, and follows my thoughts on "what the config belongs to". We would have to clarify both. But, now I've read the weaver_forge config.rs in more detail I'm not sure what we should be doing. 😕 |
|
I just looked deeper at the weaver_forge config.rs. It uses a merging strategy walking up the dir tree from the template directory and merging any weaver.yaml it finds up to root. Then it adds the one from home dir. The merge happens in reverse order of the walk, therefore the weaver.yaml in the template dir takes precedence. However, if your templates are remote (not in your local filesystem) then ONLY the weaver.yaml in the remote location is loaded. Not even your home-dir weaver.yaml is merged. Merging configs would be error-prone for runtime/CLI type settings versus the first-wins strategy. I can see how it makes sense for templates - but we seem to have a mix within the template world anyway with local versus remote. |
|
...and... |
Yeah - I think we probably want to consistently differentiate between "package" config which lives with the template / rego policy package and "project / local" config, where walking the home directory makes sense. I can clearly understand a world where templates have their own configuration. We likely need the ability to influence that configuration, even for remote templates, which is what @lquerel was tyring to do, e.g. I use a shared template package, but I want to set certain Woudl it be worth putting together a quick proposal PR @jerbly on what you think we should do? |
…emented properly in phase 2.
…Overrides pattern
| /// The field-mapping methods (`config_only_fields`, `cli_only_args`, | ||
| /// `field_mappings`) enable a generic consistency test that verifies every | ||
| /// config field has a CLI arg and vice versa, with no per-command test code. | ||
| pub trait CliOverrides { |
There was a problem hiding this comment.
Should we have CliOverrides<T: "Config"> here?
E.g. do we envision overriding different config types via the same CLI argument?
| #[derive(Debug, Clone, Default, Deserialize, PartialEq, JsonSchema)] | ||
| #[serde(default)] | ||
| #[schemars(inline)] | ||
| pub struct RegistryConfig { |
There was a problem hiding this comment.
Note: This is a non-blocking comment, but something that's been noodling in my head for a while.
If we moved live-check to a mode where it dynamically downloaded schema_url on-demand based on what it sees in telemetry - what would this config look like?
Would this instead be some kind of a schema-url -> config map? Curious on your thoughts - I was toying around with trying to get AI to make this change and it started floundering with complexity, so I think this is one we'd need to talk through our architecture for.
| /// - `override_if_set!(dst, src)` — for `Option<T> → T` (clone into existing value) | ||
| /// - `override_if_set!(dst, src, optional)` — for `Option<T> → Option<T>` (wrap in `Some`) | ||
| #[macro_export] | ||
| macro_rules! override_if_set { |
There was a problem hiding this comment.
There's a lot of this in the attribute/signal inheritance code - I wonder if we should move this to common eventually to share?
jsuereth
left a comment
There was a problem hiding this comment.
Approving this as a good first start - caveat I do think the weaver.yoml syntax is somethign I'm worried about. I think we should issue a warning that the schema is not stable if folks use it for now, until we're happy with how it handles things.
You can see my comments on things I'm worried about breaking in the future.
Closes #1247, #1248.
Adds
.weaver.tomlproject-level config, completing Phase 1 of the package-vs-project config proposal. Discovery walks up from CWD;--config <path>overrides. Precedence: defaults ->.weaver.toml-> CLI flags.Phase 1 (live-check)
[live_check]covers everylive-checkCLI flag, including[live_check.otlp]and[live_check.emit]sub-tables.[[live_check.finding_filters]]drops findings by id, sample name, level, or signal type.Phase 2 PoC
Partial shared sections (
[registry],[policy],[diagnostics]) included so live-check is end-to-end usable. Wired through a temporary heuristic and marked with a TODO — the proper rework converts the shared*Argsstructs toOption<T>and adopts the standardCliOverridespattern uniformly.Infrastructure
weaver_configcrate split intolive_check,registry, andoverridesmodules.CliOverridestrait +override_if_set!macro: generic IoC pattern subcommands can adopt with one impl.schemas/weaver-config.json. Use the#:schemadirective at the top of.weaver.tomlfor editor autocomplete. Regenerate viaweaver registry json-schema --json-schema weaver-config.See the Finding Modification section in the live-check README for usage details.