docs: add threat model document

.dockerignore

@@ -0,0 +1,6 @@
+# The container builds only consume files under .devcontainer/ (bind-mounted by
+# the Dockerfiles); all other build inputs are fetched from checksum-pinned URLs.
+# Exclude everything else from the build context so that no source, credentials,
+# caches, or test artifacts can ever be copied into an image layer.
+*
+!.devcontainer/

.github/workflows/vulnerability-scan.yml

@@ -14,7 +14,13 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        flavor: ["cpp", "embedded-cpp", "rust"]
+        include:
+          - flavor: cpp
+            dockerfile: .devcontainer/cpp/Dockerfile
+          - flavor: embedded-cpp
+            dockerfile: .devcontainer/cpp/Dockerfile
+          - flavor: rust
+            dockerfile: .devcontainer/rust/Dockerfile
     permissions:
       security-events: write # is needed by github/codeql-action/upload-sarif to upload sarif files
     steps:
@@ -25,7 +31,7 @@ jobs:
         id: scan
         with:
           image: ghcr.io/${{ github.repository }}-${{ matrix.flavor }}:latest
-          dockerfile: .devcontainer/Dockerfile
+          dockerfile: ${{ matrix.dockerfile }}
       - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         if: steps.scan.outputs.sarif != ''
         with:

.github/workflows/wc-document-generation.yml

@@ -28,7 +28,7 @@ jobs:
         run: |
           set -Eeuo pipefail
 
-          sudo apt-get update && sudo apt-get install --no-install-recommends -y plantuml
+          sudo apt-get update && sudo apt-get install --no-install-recommends -y graphviz plantuml
           python -m pip install sbdl==1.22.7
       - name: Build & Validate SBDL model
         run: sbdl -m compile test/cpp/integration-tests.bats test/cpp/features/*.feature test/embedded-cpp/integration-tests.bats test/embedded-cpp/features/*.feature > amp-devcontainer.sbdl
@@ -41,15 +41,15 @@ jobs:
 
           cat > document-control.sbdl <<SBDL
           #!sbdl
-          doc_control is aspect {
+          doc-control is aspect {
             description is "Document control metadata"
             custom:version is "$(jq -r '.["."]' .release-please-manifest.json)"
-            custom:generated_at is "[@DATE]"
-            custom:git_sha is "[@GIT_COMMIT_HASH]"
-            custom:git_ref is "${GITHUB_REF_NAME}"
-            custom:sbdl_compiler_version is "[@COMPILER_VERSION]"
-            custom:sbdl_dsl_version is "[@DSL_VERSION]"
-            custom:is_release is "${IS_RELEASE}"
+            custom:generated-at is "[@DATE]"
+            custom:git-sha is "[@GIT_COMMIT_HASH]"
+            custom:git-ref is "${GITHUB_REF_NAME}"
+            custom:sbdl-compiler-version is "[@COMPILER_VERSION]"
+            custom:sbdl-dsl-version is "[@DSL_VERSION]"
+            custom:is-release is "${IS_RELEASE}"
           }
           SBDL
       - name: 📄 Generate SRS document
@@ -58,6 +58,10 @@ jobs:
         run: sbdl -m template-fill --set-config template_extensions_file docs/templates/jinja-extensions.py --template docs/templates/software-test-plan.md.j2 amp-devcontainer.sbdl document-control.sbdl > software-test-plan.md
       - name: 🧩 Generate RTM document
         run: sbdl -m template-fill --set-config template_extensions_file docs/templates/jinja-extensions.py --template docs/templates/requirements-traceability-matrix.md.j2 amp-devcontainer.sbdl document-control.sbdl > requirements-traceability-matrix.md
+      - name: 🛡️ Generate Threat Model document
+        run: sbdl -m template-fill --set-config template_extensions_file docs/templates/jinja-extensions.py --template docs/templates/threat-model.md.j2 docs/threat-model.sbdl document-control.sbdl > threat-model.md
+      - name: 📊 Generate Threat Model diagram
+        run: sbdl -m aspect-diagram docs/threat-model.sbdl -o threat-model-dfd.png
       - name: 📄 Generate SRS PDF
         uses: docker://pandoc/extra:3.9.0.0-ubuntu@sha256:72afa9c8d3300e5f10c9c4330e101725687f2179bffd912fb859c6d2ae85de62
         with:
@@ -70,6 +74,10 @@ jobs:
         uses: docker://pandoc/extra:3.9.0.0-ubuntu@sha256:72afa9c8d3300e5f10c9c4330e101725687f2179bffd912fb859c6d2ae85de62
         with:
           args: --template eisvogel --syntax-highlighting idiomatic --number-sections --output requirements-traceability-matrix.pdf requirements-traceability-matrix.md
+      - name: 🛡️ Generate Threat Model PDF
+        uses: docker://pandoc/extra:3.9.0.0-ubuntu@sha256:72afa9c8d3300e5f10c9c4330e101725687f2179bffd912fb859c6d2ae85de62
+        with:
+          args: --template eisvogel --syntax-highlighting idiomatic --number-sections --output threat-model.pdf threat-model.md
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: documents

docs/templates/partials/document-control.md.j2

@@ -1,7 +1,7 @@
-| Property          | Value                                                                                                                     |
-|-------------------|---------------------------------------------------------------------------------------------------------------------------|
-| Document version  | {{ sbdl['doc_control']['custom:version'] }}                                                                               |
-| Generation date   | {{ sbdl['doc_control']['custom:generated_at'] | strftime('%Y-%m-%d') }}                                                                          |
-| Source revision   | {{ sbdl['doc_control']['custom:git_sha'] }}                                                                               |
-| Source branch/tag | {{ sbdl['doc_control']['custom:git_ref'] }}                                                                               |
-| Model             | SBDL {{ sbdl['doc_control']['custom:sbdl_compiler_version'] }} (DSL {{ sbdl['doc_control']['custom:sbdl_dsl_version'] }}) |
+| Property                | Value                                                                                                                     |
+|-------------------------|---------------------------------------------------------------------------------------------------------------------------|
+| Document version        | {{ sbdl['doc-control']['custom:version'] }}                                                                               |
+| Generation date         | {{ sbdl['doc-control']['custom:generated-at'] | strftime('%Y-%m-%d') }}                                                   |
+| Source revision         | {{ sbdl['doc-control']['custom:git-sha'] }}                                                                               |
+| Source branch/tag       | {{ sbdl['doc-control']['custom:git-ref'] }}                                                                               |
+| Model                   | SBDL {{ sbdl['doc-control']['custom:sbdl-compiler-version'] }} (DSL {{ sbdl['doc-control']['custom:sbdl-dsl-version'] }}) |

docs/templates/requirements-traceability-matrix.md.j2

@@ -2,7 +2,7 @@
 title: "Requirements traceability matrix for amp-devcontainer"
 author: ["@rjaegers"]
 colorlinks: true
-date: "{{ sbdl['doc_control']['custom:generated_at'] | strftime('%Y-%m-%d') }}"
+date: "{{ sbdl['doc-control']['custom:generated-at'] | strftime('%Y-%m-%d') }}"
 keywords: [Traceability, Requirements, RTM, amp-devcontainer]
 lang: "en"
 titlepage: true
@@ -14,7 +14,7 @@ toc: true
 toc-own-page: true
 header-includes:
   - \AtEndDocument{\label{lastpage}}
-{%- if sbdl['doc_control']['custom:is_release'] != 'true' %}
+{%- if sbdl['doc-control']['custom:is-release'] != 'true' %}
 watermark: "DRAFT"
 {%- endif %}
 footer-right: "\\thepage \\hspace{1pt} of \\pageref*{lastpage}"

docs/templates/software-requirements-specification.md.j2

@@ -2,7 +2,7 @@
 title: "Software requirements specification for amp-devcontainer"
 author: ["@rjaegers"]
 colorlinks: true
-date: "{{ sbdl['doc_control']['custom:generated_at'] | strftime('%Y-%m-%d') }}"
+date: "{{ sbdl['doc-control']['custom:generated-at'] | strftime('%Y-%m-%d') }}"
 keywords: [Software, Requirements, SRS, amp-devcontainer]
 lang: "en"
 titlepage: true
@@ -14,7 +14,7 @@ toc: true
 toc-own-page: true
 header-includes:
   - \AtEndDocument{\label{lastpage}}
-{%- if sbdl['doc_control']['custom:is_release'] != 'true' %}
+{%- if sbdl['doc-control']['custom:is-release'] != 'true' %}
 watermark: "DRAFT"
 {%- endif %}
 footer-right: "\\thepage \\hspace{1pt} of \\pageref*{lastpage}"

docs/templates/software-test-plan.md.j2

@@ -2,7 +2,7 @@
 title: "Software test plan for amp-devcontainer"
 author: ["@rjaegers"]
 colorlinks: true
-date: "{{ sbdl['doc_control']['custom:generated_at'] | strftime('%Y-%m-%d') }}"
+date: "{{ sbdl['doc-control']['custom:generated-at'] | strftime('%Y-%m-%d') }}"
 keywords: [Software, Test, Plan, STP, amp-devcontainer]
 lang: "en"
 titlepage: true
@@ -14,7 +14,7 @@ toc: true
 toc-own-page: true
 header-includes:
   - \AtEndDocument{\label{lastpage}}
-{%- if sbdl['doc_control']['custom:is_release'] != 'true' %}
+{%- if sbdl['doc-control']['custom:is-release'] != 'true' %}
 watermark: "DRAFT"
 {%- endif %}
 footer-right: "\\thepage \\hspace{1pt} of \\pageref*{lastpage}"