Add stability to network.interface.name and event fields, add temp policy check (#1781)

Author: lmolkova

model/device/events.yaml

@@ -37,24 +37,29 @@ groups:
               value: 'active'
               brief: >
                 The app has become `active`. Associated with UIKit notification `applicationDidBecomeActive`.
+              stability: development
             - id: inactive
               value: 'inactive'
               brief: >
                 The app is now `inactive`. Associated with UIKit notification `applicationWillResignActive`.
+              stability: development
             - id: background
               value: 'background'
               brief: >
                 The app is now in the background.
                 This value is associated with UIKit notification `applicationDidEnterBackground`.
+              stability: development
             - id: foreground
               value: 'foreground'
               brief: >
                 The app is now in the foreground.
                 This value is associated with UIKit notification `applicationWillEnterForeground`.
+              stability: development
             - id: terminate
               value: 'terminate'
               brief: >
                 The app is about to terminate. Associated with UIKit notification `applicationWillTerminate`.
+              stability: development
         - id: android.state
           stability: experimental
           requirement_level:
@@ -72,13 +77,16 @@ groups:
               brief: >
                 Any time before Activity.onResume() or, if the app has no Activity, Context.startService()
                 has been called in the app for the first time.
+              stability: development
             - id: background
               value: 'background'
               brief: >
                 Any time after Activity.onPause() or, if the app has no Activity,
                 Context.stopService() has been called when the app was in the foreground state.
+              stability: development
             - id: foreground
               value: 'foreground'
               brief: >
                 Any time after Activity.onResume() or, if the app has no Activity,
                 Context.startService() has been called when the app was in either the created or background states.
+              stability: development

model/gen-ai/events.yaml

@@ -111,6 +111,7 @@ groups:
                 - id: function
                   value: 'function'
                   brief: Function
+                  stability: development
               stability: experimental
               brief: >
                 The type of the tool.
@@ -275,6 +276,7 @@ groups:
                 - id: function
                   value: 'function'
                   brief: Function
+                  stability: development
               stability: experimental
               brief: >
                 The type of the tool.

model/network/registry.yaml

@@ -236,6 +236,7 @@ groups:
         type: string
         brief: 'The network interface name.'
         examples: [ 'lo', 'eth0' ]
+        stability: development
       - id: network.connection.state
         type:
           members:

policies/registry.rego

@@ -70,6 +70,25 @@ deny contains attr_registry_violation(description, group.id, attr.id) if {
     description := sprintf("Attribute definition '%s' has requirement_level set to %s. Only attribute references can set requirement_level.", [attr.id, attr.requirement_level])
 }
 
+# We require attribute definitions to have stability
+deny contains attr_registry_violation(description, group.id, attr.id) if {
+    group := input.groups[_]
+    attr := group.attributes[_]
+    not attr.stability
+    description := sprintf("Attribute definition '%s' does not contain stability field. All attribute definitions must include stability level.", [attr.id])
+}
+
+# We require span, metrics, events, resources definitions to have stability
+deny contains attr_registry_violation(description, group.id, "") if {
+    semconv_types := {"span", "metric", "event", "resource"}
+    group := input.groups[_]
+
+    semconv_types[group.type] != null
+
+    not group.stability
+    description := sprintf("Semconv group '%s' does not contain stability field. All semconv definitions must include stability level.", [group.id])
+}
+
 get_attribute_name(attr, group) := name if {
     full_name := concat(".", [group.prefix, attr.id])
 

policies_test/registry_test.rego

@@ -11,20 +11,55 @@ test_registry_attribute_groups if {
 
 test_attribute_ids if {
 	# This requires a prefix for use with opa, but weaver will fill in.
-	count(before_resolution.deny) > 0 with input as {"groups": [{"id": "not_registry", "prefix": "", "attributes": [{"id": "foo.bar"}]}]}
+	count(before_resolution.deny) > 0 with input as {"groups": [{"id": "not_registry", "prefix": "", "attributes": [{"id": "foo.bar", "stability": "rc"}]}]}
 	count(before_resolution.deny) == 0 with input as {"groups": [
-		{"id": "registry.test", "prefix": "", "attributes": [{"id": "foo.bar"}]},
-		{"id": "not_registry", "prefix": "", "attributes": [{"ref": "foo.bar"}]},
+		{"id": "registry.test", "prefix": "", "attributes": [{"id": "foo.bar", "stability": "rc"}]},
+		{"id": "not_registry", "prefix": "", "attributes": [{"ref": "foo.bar", "stability": "rc"}]},
 	]}
 }
 
+test_attribute_without_stability if {
+	count(before_resolution.deny) > 0 with input as {"groups": [{"id": "registry.text", "attributes": [{"id": "foo.bar"}]}]}
+	count(before_resolution.deny) == 0 with input as {"groups": [
+		{"id": "registry.test", "attributes": [{"id": "foo.bar", "stability": "alpha"}]},
+	]}
+}
+
+test_span_without_stability if {
+	count(before_resolution.deny) > 0 with input as {"groups": [{"id": "span.group", "type": "span"}]}
+	count(before_resolution.deny) == 0 with input as {"groups": [
+		{"id": "span.group", "type": "span", "stability": "alpha"}]
+    }
+}
+
+test_event_without_stability if {
+	count(before_resolution.deny) > 0 with input as {"groups": [{"id": "event.foo", "type": "event", "name": "foo"}]}
+	count(before_resolution.deny) == 0 with input as {"groups": [
+		{"id": "event.foo", "name": "foo", "type": "event", "stability": "alpha"}]
+    }
+}
+
+test_metric_without_stability if {
+	count(before_resolution.deny) > 0 with input as {"groups": [{"id": "metric.foo", "type": "metric", "name": "foo"}]}
+	count(before_resolution.deny) == 0 with input as {"groups": [
+		{"id": "metric.foo", "name": "foo", "type": "metric", "stability": "development"}]
+    }
+}
+
+test_resource_without_stability if {
+	count(before_resolution.deny) > 0 with input as {"groups": [{"id": "resource.foo", "type": "resource", "name": "foo"}]}
+	count(before_resolution.deny) == 0 with input as {"groups": [
+		{"id": "resource.foo", "name": "foo", "type": "resource", "stability": "stable"}]
+    }
+}
+
 test_attribute_refs if {
 	count(before_resolution.deny) > 0 with input as {"groups": [{"id": "registry.foo", "attributes": [{"ref": "foo"}]}]}
 	count(before_resolution.deny) == 0 with input as {"groups": [{"id": "not_registry", "attributes": [{"ref": "foo"}]}]}
 }
 
 test_attribute_requirement_levels if {
-	count(before_resolution.deny) > 0 with input as {"groups": [{"id": "registry.foo", "attributes": [{"id": "foo", "requirement_level": "required"}]}]}
-	count(before_resolution.deny) > 0 with input as {"groups": [{"id": "registry.foo", "attributes": [{"id": "foo", "requirement_level": {"recommended": "if available"}}]}]}
+	count(before_resolution.deny) > 0 with input as {"groups": [{"id": "registry.foo", "attributes": [{"id": "foo", "requirement_level": "required", "stability": "rc"}]}]}
+	count(before_resolution.deny) > 0 with input as {"groups": [{"id": "registry.foo", "attributes": [{"id": "foo", "requirement_level": {"recommended": "if available"}, "stability": "rc"}]}]}
 	count(before_resolution.deny) == 0 with input as {"groups": [{"id": "not_registry", "attributes": [{"ref": "foo", "requirement_level": "required"}]}]}
 }

policies_test/yaml_schema_test.rego

@@ -52,6 +52,7 @@ test_fails_on_referenced_event_name_on_event if {
     event := [{ "id": "event.foo",
                 "type": "event",
                 "name": "foo",
+                "stability": "rc",
                 "attributes": [{"ref": "event.name"}]}]
     count(deny) == 1 with input as {"groups": event}
 }
@@ -101,22 +102,22 @@ test_fails_on_invalid_resource_id if {
 }
 
 create_attribute_group(attr) = json if {
-    json := [{"id": "yaml_schema.test", "attributes": [{"id": attr}]}]
+    json := [{"id": "yaml_schema.test", "attributes": [{"id": attr, "stability": "rc"}]}]
 }
 
 create_metric(name) = json if {
     id := sprintf("metric.%s", [name])
-    json := [{"id": id, "type": "metric", "metric_name": name}]
+    json := [{"id": id, "type": "metric", "metric_name": name, "stability": "rc"}]
 }
 
 create_event(name) = json if {
     id := sprintf("event.%s", [name])
-    json := [{"id": id, "type": "event", "name": name}]
+    json := [{"id": id, "type": "event", "name": name, "stability": "rc"}]
 }
 
 create_resource(name) = json if {
     id := sprintf("resource.%s", [name])
-    json := [{"id": id, "type": "resource", "name": name}]
+    json := [{"id": id, "type": "resource", "name": name, "stability": "rc"}]
 }
 
 invalid_names := [

templates/registry/markdown/stability.j2

@@ -4,6 +4,8 @@
 {%- elif stability == "stable" %}![Stable](https://img.shields.io/badge/-stable-lightgreen)
 {%- elif stability == "release_candidate" %}![Release Candidate](https://img.shields.io/badge/-rc-mediumorchid)
 {%- elif stability == "deprecated" %}![Deprecated](https://img.shields.io/badge/-deprecated-red)
-{%- else %}![Experimental](https://img.shields.io/badge/-experimental-blue)
+{%- elif stability == "experimental" %}![Experimental](https://img.shields.io/badge/-experimental-blue)
+{%- elif stability == "development" %}![Experimental](https://img.shields.io/badge/-experimental-blue)
+{%- else %}{{ "Unknown stability." }}
 {%- endif %}
 {%- endmacro %}