create a validation for se packs (demisto#40993)

* create a validation for se packs

* change to accepts zero or more values in changed_files

Author: AviShakuri

.github/github_workflow_scripts/check_if_se_packs_approved_label_exists.py

@@ -0,0 +1,83 @@
+import sys
+from github import Github
+import argparse
+import urllib3
+from github.Repository import Repository
+from github.PullRequest import PullRequest
+from utils import timestamped_print
+
+urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
+print = timestamped_print
+
+SE_APPROVED_LABEL = "se-approved"
+SE_PACKS = {
+    "FortiGate",
+    "CheckpointFirewall",
+    "Zscaler",
+    "ZscalerZPA",
+    "CiscoASA",
+    "CorelightZeek",
+    "Okta",
+    "MicrosoftEntraID",
+    "GoogleCloudLogging",
+    "MicrosoftEntraID",
+    "AWS-CloudTrail",
+    "GoogleCloudLogging",
+    "Office365",
+    "Dropbox",
+    "DuoAdminApi",
+    "MicrosoftWindowsEvents",
+    "Box",
+    "OneLogin",
+}
+
+
+def arguments_handler():
+    """Validates and parses script arguments.
+    Returns:
+       Namespace: Parsed arguments object.
+    """
+    parser = argparse.ArgumentParser(description="Check if se-packs-approved label exists.")
+    parser.add_argument("-p", "--pr_number", help="The PR number to check if the label exists.")
+    parser.add_argument("-g", "--github_token", help="The GitHub token to authenticate the GitHub client.")
+    parser.add_argument("-c", "--changed_files", nargs="*", help="The path of modified files")
+    return parser.parse_args()
+
+
+def main():
+    """
+    This script is checking that "docs-approved" label exists for a PR in case
+    the label exists the workflow will pass, if the label is missing the workflow will fail.
+    """
+    org_name = "demisto"
+    repo_name = "content"
+    options = arguments_handler()
+    pr_number = options.pr_number
+    github_token = options.github_token
+    changed_files = options.changed_files
+
+    github_client: Github = Github(github_token, verify=False)
+    content_repo: Repository = github_client.get_repo(f"{org_name}/{repo_name}")
+    pr: PullRequest = content_repo.get_pull(int(pr_number))
+
+    pr_label_names = [label.name for label in pr.labels]
+    se_approved = SE_APPROVED_LABEL in pr_label_names
+
+    watched_folders = SE_PACKS
+    watched_folders = {folder.lower() for folder in watched_folders if folder}
+    # Detect if watched folder changed
+    folder_changed = any(file.split("/")[1].lower() in watched_folders for file in changed_files)
+    # Validation logic
+    if folder_changed and not se_approved:
+        print(f"❌ Missing {SE_APPROVED_LABEL} label: This pack has XSIAM content that is also available in SE, please verify.")
+        sys.exit(1)
+
+    if not folder_changed and se_approved:
+        print(f"❌ Label '{SE_APPROVED_LABEL}' added, but no changes found in SE packs")
+        sys.exit(1)
+
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

.github/workflows/check-se-approved-label.yml

@@ -0,0 +1,45 @@
+name: se-packs-approved label verification
+on:
+  pull_request:
+    types: [opened, synchronize, labeled, unlabeled]
+
+
+permissions:
+  contents: read
+
+jobs:
+  check_label_job:
+    runs-on: ubuntu-latest
+    if: github.repository == 'demisto/content'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"  # The Python version set here is the minimum supported by content, if you change it here, please change all the places containing this comment.
+      - name: Setup Poetry
+        uses: Gr1N/setup-poetry@v9
+      - name: Install python dependencies
+        run: |
+          poetry install --with github-actions
+      - name: set pythonpath
+        run: |
+          echo "PYTHONPATH=$GITHUB_WORKSPACE" >> $GITHUB_ENV
+      - name: Get changed files
+        id: changed-files
+        uses: tj-actions/changed-files@v46.0.1 # disable-secrets-detection
+        with:
+          files: |
+            Packs/**/ModelingRules/**
+          since_last_remote_commit: false
+      - name: Check if se-packs-approved label exists
+        id: check_label
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
+        run: |
+          echo "Checking label SE-packs-approved for: $PR_NUMBER"
+          cd .github/github_workflow_scripts
+          poetry run python check_if_se_packs_approved_label_exists.py --pr_number $PR_NUMBER --github_token $GITHUB_TOKEN --changed_files $CHANGED_FILES