StackGuardian/tirith

Problem The tirith ui playground ships five examples and none is a security check beyond S3 and tags. October is Cybersecurity Awareness Month; a concrete, runnable security policy makes a good addition. What to change Add src/tirith/tui/examples/06-rds-not-public/ with about.md, policy.json and input.json, following 02-no-public-buckets/. The policy fails when any aws_db_instance has publicly_accessible = true The input is a trimmed Terraform plan JSON with one public and one private instance Done when tests/tui/test_examples.py passes and the example appears in tirith ui. Comment to claim this issue and wait to be assigned. Unclaimed or inactive for 3 days, it returns to the pool. Run pytest tests/ and black --line-length 120 before opening the PR.

Problem Workflows pin old action majors, which run on deprecated Node runtimes: actions/checkout@v2/@v3, actions/setup-python@v2/@v4, actions/setup-node@v3. What to change In .github/workflows/build_test.yml, coverage.yml, deploy_docs.yml, lint.yml and pydosctyle.yml, move to actions/checkout@v4, actions/setup-python@v5 and actions/setup-node@v4. Leave third-party actions alone. Done when All workflows pass on the PR and no workflow references checkout@v2/@v3 or setup-python@v2/@v4. Comment to claim this issue and wait to be assigned. Unclaimed or inactive for 3 days, it returns to the pool. Run pytest tests/ and black --line-length 120 before opening the PR.

Problem test_greater_than.py, test_greater_than_equal_to.py, test_less_than.py and test_less_than_equal_to.py in tests/core/evaluators/ each test one pass and one fail with integers. Nothing covers None, floats, equal values or mixed types, where > raises and the evaluator falls back to the exception message. What to change Tests only; no evaluator code changes. If a case exposes a wrong verdict, note it in the PR and we'll open a follow-up. Done when Each of the four files covers: equal values, floats, None input, and a string compared with a number. Comment to claim this issue and wait to be assigned. Unclaimed or inactive for 3 days, it returns to the pool. Run pytest tests/ and black --line-length 120 before opening the PR.

Problem Prefix and suffix checks ("bucket names start with acme-", "AMI names end with -hardened") need a RegexMatch with anchors today, which is easy to get wrong. What to change Add starts_with.py and ends_with.py under src/tirith/core/evaluators/ Register both in EVALUATORS_DICT in src/tirith/core/evaluators/__init__.py and in src/tirith/tui/schema.py Add a row and a section for each in documentation/docs/tirith-reference/evaluators.md Non-string input returns passed: false with a message naming the type Done when One test file per evaluator under tests/core/evaluators/ covers pass, fail, empty string and non-string input. Comment to claim this issue and wait to be assigned. Unclaimed or inactive for 3 days, it returns to the pool. Run pytest tests/ and black --line-length 120 before opening the PR.

Most functions in the project still lack docstrings. Contributions welcome — a good starting point is src/tirith/core/ and each provider's handler.py. Rules for contributing Use the reST docstring format: """ Short description. :param param1: what it is :returns: what is returned :raises KeyError: when it raises """ One file per PR, so contributors don't collide on the same file. Mention this issue in your PR description (e.g. Related to #<this issue>). PR/commit title format: <name of the file>.py: Add docstring.