From dbfdb7f804ca01a4bc6f4e4318a2fda4fe37f134 Mon Sep 17 00:00:00 2001 From: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Date: Fri, 7 Jun 2024 19:24:36 +0530 Subject: [PATCH] Test deprecated rule modification (#3727) (cherry picked from commit f9b3534cdd62f1a639d17b50523dfcc40f4db946) --- .github/workflows/pythonpackage.yml | 10 ++++++++-- tests/test_all_rules.py | 15 ++++++++++++++- 2 files changed, 22 insertions(+), 3 deletions(-) diff --git a/.github/workflows/pythonpackage.yml b/.github/workflows/pythonpackage.yml index be19fbd46..8b3b919c9 100644 --- a/.github/workflows/pythonpackage.yml +++ b/.github/workflows/pythonpackage.yml @@ -12,8 +12,14 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 - + - uses: actions/checkout@v4 + with: + fetch-depth: 1 + + - name: Fetch main branch + run: | + git fetch origin main:refs/remotes/origin/main + - name: Set up Python 3.12 uses: actions/setup-python@v5 with: diff --git a/tests/test_all_rules.py b/tests/test_all_rules.py index f73dcd8f4..9a6ffc0e3 100644 --- a/tests/test_all_rules.py +++ b/tests/test_all_rules.py @@ -29,7 +29,7 @@ from detection_rules.rule import (AlertSuppressionMapping, QueryRuleData, QueryV from detection_rules.rule_loader import FILE_PATTERN from detection_rules.rule_validators import EQLValidator, KQLValidator from detection_rules.schemas import definitions, get_min_supported_stack_version, get_stack_schemas -from detection_rules.utils import INTEGRATION_RULE_DIR, PatchedTemplate, get_path, load_etc_dump +from detection_rules.utils import INTEGRATION_RULE_DIR, PatchedTemplate, get_path, load_etc_dump, make_git from detection_rules.version_lock import default_version_lock from rta import get_available_tests @@ -626,6 +626,19 @@ class TestRuleMetadata(BaseRuleTest): rule_str = f'{rule_id} - {entry["rule_name"]} ->' self.assertIn(rule_id, deprecated_rules, f'{rule_str} is logged in "deprecated_rules.json" but is missing') + def test_deprecated_rules_modified(self): + """Test to ensure deprecated rules are not modified.""" + + rules_path = get_path("rules", "_deprecated") + + # Use git diff to check if the file(s) has been modified in rules/_deprecated directory + detection_rules_git = make_git() + result = detection_rules_git("diff", "--diff-filter=M", "origin/main", "--name-only", rules_path) + + # If the output is not empty, then file(s) have changed in the directory + if result: + self.fail(f"Deprecated rules {result} has been modified") + @unittest.skipIf(PACKAGE_STACK_VERSION < Version.parse("8.3.0"), "Test only applicable to 8.3+ stacks regarding related integrations build time field.") def test_integration_tag(self):