feat: add source_url to framework_sources - #266
Merged
Conversation
Optional field alongside commit -- the resolved tree URL at that commit, so a reader can check a framework mapping's source directly without reconstructing it from repo and sha by hand. Mirrors specCommit/specSource, a shape BerkantACUN/guardmcp PR #3 independently designed for the same OWASP MCP Top 10 versioning gap OWASP/www-project-mcp-top-10#52 raised (not a comment posted in #52 itself -- a separate repo's own fix for the gap #52 describes). That PR's specCommit pins the identical commit sha AVE's own owasp_mcp backfill already used, 165fe0f78ef104459237b4a8e0f6e78db9b02391 -- independent convergence on the same fix from two unrelated projects. Additive: new optional field, no required-field change, no version bump. Per CONTRIBUTING.md's Schema changes section this is a standard PR, not an issue-first structural change. - schema/ave-record-1.1.0.schema.json, schema/ave-record.schema.json: add framework_sources.*.source_url (string, format: uri) - docs/terms-relationships.md: extend the existing framework_sources relationship note with the source_url addition and its real origin - docs/terms.md: regenerated via scripts/generate_terms.py
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
source_urlas a new optional field to everyframework_sources.<field>entry: the resolved tree URL atcommit, so a reader can check a framework mapping's source directly without reconstructing it from repo and sha by hand. Optional even whencommitis present.Why
BerkantACUN/guardmcpPR #3 ("Pin the OWASP spec commit the mapping was drafted against") independently designed the same shape -- aspecCommit/specSourcepair in its SARIF taxonomy properties -- for the same OWASP MCP Top 10 versioning gap thatOWASP/www-project-mcp-top-10#52raised and thatframework_sourcesitself exists to close. That PR is a separate repo's own fix for the gap #52 describes, not a comment posted in #52 -- worth being precise about since it's easy to conflate the two.Notably, guardmcp's
specCommitpins the exact same commit sha AVE's ownowasp_mcpbackfill already used:165fe0f78ef104459237b4a8e0f6e78db9b02391. Two unrelated projects independently converged on pinning the same commit to close the same gap --source_urlcloses the remaining gap between the two shapes (a resolved link, not just a bare sha).Why no issue
Per CONTRIBUTING.md's Schema changes section: additive changes (new optional field, no version bump, no new required field, no rename/removal, no changed validation rule) are a standard PR. This isn't a structural change, so it doesn't need the issue-first + 30-day comment period that applies to those.
Changes
schema/ave-record-1.1.0.schema.json,schema/ave-record.schema.json(kept byte-identical): addframework_sources.*.source_url(type: string,format: uri)docs/terms-relationships.md: extended the existingframework_sourcesrelationship note with thesource_urladdition and its real origin (appended, not rewritten)docs/terms.md: regenerated viascripts/generate_terms.py, confirmed withscripts/check_terms_sync.pyValidation
python3 scripts/validate_records.py-- all 80 records still validpytest tests/ -x -q-- 470 passedpython3 scripts/check_terms_sync.py-- docs/terms.md matches the live schema