Skip to content

Close the Content Library 5391 schema gaps - #128

Merged
splunkenizer merged 1 commit into
distributionfrom
dist/content-library-schema
Oct 28, 2026
Merged

splunkenizer merged 1 commit into
distributionfrom
dist/content-library-schema

Conversation

@splunkenizer

Copy link
Copy Markdown
Collaborator

Summary

Enforces a closed schema for the ITSI Content Library entry. The entry is either Splunkbase app_id: 5391 (any name) or source: local named DA-ITSI-ContentLibrary. Pack names and playbook paths stay flexible.

Follows the independent review of the change set.

Rules now enforced

  • install_all_apps must be a bool when set. A quoted "true" is rejected.
  • install_all_apps: true with content_pack_apps present (even empty) is rejected.
  • content_pack_install and force_run_playbook_after_restart reject null and non-bool values.
  • DA-ITSI-ContentLibrary is reserved for the library. Any other entry is rejected.
  • A local library rejects app_id, and path must be a non-empty string.
  • Pack names are compared without surrounding whitespace.
  • update_mode is accepted on the library entry. Other unknown keys are rejected, and deployment_target stays rejected.
  • install_all_apps is a catalog key, so spa config explain resolves it.

Other

  • spa apps add 5391 --install-all-content-packs writes top-level install_all_apps: true, the key the apps_itsi_content_pack role reads.
  • CHANGELOG entry under Unreleased > Changed.

Test plan

  • Each rule has a test that failed first (red), then passed.
  • ./tests/run_local_tests.sh passes on the committed state (1508 passed). One test fails only in the exported archive used for that check, because it had no .git directory.
  • tests/test_docs.py drift checks pass. docs/commands.md and docs/config.md did not need regenerating.

The Content Library entry is either Splunkbase app_id 5391 (any name) or
a local entry named DA-ITSI-ContentLibrary. Validation now enforces the
closed structure from the review:

- install_all_apps must be a bool when set; a quoted "true" is rejected.
- install_all_apps: true with content_pack_apps present (even empty) is
  rejected, so the either/or rule checks key presence.
- content_pack_install and force_run_playbook_after_restart reject null
  as well as non-bool values; a null would make the role skip the pack.
- DA-ITSI-ContentLibrary is reserved for the library; any other entry
  (Splunkbase or local, with or without itsi_content_pack) is rejected.
- Local library entries reject app_id, and path must be a non-empty string.
- Pack names are compared without surrounding whitespace.
- update_mode is accepted on the library entry (the role honors it).
- install_all_apps is a catalog key, so spa config explain resolves it.

Tests cover each rule; guard tests pin the non-object pack item and the
default splunkbase source.

Co-authored-by: Cursor <cursoragent@cursor.com>
@splunkenizer
splunkenizer merged commit ca15835 into distribution Oct 28, 2026
1 check passed
@splunkenizer
splunkenizer deleted the dist/content-library-schema branch October 28, 2026 23:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant