Please describe the enhancement
In #5376 and #2248 , we'd like to have a better mechanism for creating (discovering) entities which are derived from some sort of enclosing entity -- think releases (or PRs) related to a source control repository, or OCI artifacts related to an OCI repository. The derived entities should be cleaned up when the parent is deleted, but they should also be deleted when they are no longer relevant (think: "I care about the last 3 releases" type rules).
Solution Proposal
We should add a "entity" remediation type which accepts some ruletype output keys to generate corresponding Minder entities originating from the current entity. A few open questions:
- What are the semantics of "entity" remediations -- how to clean up previous entities created by the rule? One option is that the operation is effectively "replace the previously-created entity set with the new one" (we'd need to make sure to avoid actual delete-and-recreate for entities in the old and new sets).
- What happens if there are multiple "entity" remediations for the same "parent" object and the same type of derived entity? Do they "fight" or is there some way they cooperate? (e.g. maybe you have a "last 3 patch releases" and "last 2 major releases" policies)
- Can a single "entity" remediation create more than one entity type?
- What happens / when is it checked that the derived entities are "valid"?
- Can you create derived entities across providers? e.g. if I have a CircleCI provider, can I create CircleCI entities based on files found in the GitHub repo? (Probably not for v1, but this would be attractive longer-term.)
Describe alternatives you've considered
Using CEL or other selectors for these objects on the rule evaluation side, and enrolling all of them. This seems like it could be excessive, particularly for e.g. projects with hundreds of historical releases that are mostly of historical interest at this point.
Additional context
No response
Acceptance Criteria
No response
Please describe the enhancement
In #5376 and #2248 , we'd like to have a better mechanism for creating (discovering) entities which are derived from some sort of enclosing entity -- think releases (or PRs) related to a source control repository, or OCI artifacts related to an OCI repository. The derived entities should be cleaned up when the parent is deleted, but they should also be deleted when they are no longer relevant (think: "I care about the last 3 releases" type rules).
Solution Proposal
We should add a "entity" remediation type which accepts some ruletype output keys to generate corresponding Minder entities originating from the current entity. A few open questions:
Describe alternatives you've considered
Using CEL or other selectors for these objects on the rule evaluation side, and enrolling all of them. This seems like it could be excessive, particularly for e.g. projects with hundreds of historical releases that are mostly of historical interest at this point.
Additional context
No response
Acceptance Criteria
No response