Conversation
feat: disable submit for review button if object is not in any track
Saving a relationship resets its source and target objects to work-in-progress through PUT again instead of creating new revisions. Workflow state is workspace metadata, not STIX content, so the in-place update never touches a sealed revision, and the two extra object revisions (and the snapshot churn they triggered) per relationship save are gone. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Align the release-track page with sealed content manifests: every snapshot now seals its content when members are written, so the bundle cache controls, cache status, and cache statistics are removed. Cards show content statistics; released snapshots show their stable bundle id and SHA-256 hashes; notes are editable on drafts only. Add a Publication section to track configuration: the publishing identity and collection markings inherit from organization settings unless overridden, with the resolved value and its source displayed, and collection id and created overrides that lock after the first release. Virtual tracks save publication settings after their composition. Rename the History tab to Releases, drop the per-snapshot Sealed chip, remove the dead Secondary Objects configuration section, and let administrators delete the most recent release from its card with a typed version confirmation. The release preview shows relationships sealed, added, dropped, and authored against other endpoint revisions. Fix Edit Config crashing on virtual tracks: the connector's identity and marking getters return functions that must be invoked as methods. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Release-track bundles only ship a relationship when both endpoints are members of the same track, so a relationship whose objects share no domain can never be published, and nothing in the UI pointed editors at such content. The Data Quality page now lists cross-domain relationships (source, target, their domains, and links to each object) and domain-bearing objects that declare no domain, backed by GET /api/reports/domain-consistency. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The release-track page had three overlapping ways to act on a draft: the header's Preview & Release (tag the latest draft), each draft card's Preview & Tag, and an Export Latest that duplicated the card export and was sending `include=all` to the bundle endpoint, which now rejects it. Track deletion sat beside them in the header. The page now follows one linear flow. The Board tab (formerly Details) manages what the next draft contains; the header keeps only Create Draft for virtual tracks; a draft is previewed and tagged from its card on the Releases tab; and deleting the track moves to a danger zone at the bottom of Config. Bundle exports send only the STIX version. Preview & Tag no longer downloads the whole object catalogue to label tier entries — the workbench snapshot carries each entry's type and version — and the buttons show a "Preparing preview" state while the preview loads. Only the most recent release offers Delete release, since any other card would always be refused. Tracks can carry an alias: the Config tab's Address card edits it (validated slug with a URL preview, saved through the metadata endpoint before the config write), track cards navigate by alias, and the page adopts the canonical id from the loaded snapshot so confirmations never see the alias. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Disabling a button for the duration of a multi-second request (creating a virtual draft, preparing or committing a release, deleting a release or the track, saving the configuration) read as a frozen page rather than work in progress, and the release commit had no indicator at all. A page-level activity bar — an indeterminate progress bar with a message naming what the server is doing — now appears under the header for every such operation, and the triggering button shows a spinner with a "Creating draft" / "Preparing preview" label. One getter derives the message from the existing busy flags so new operations have a single place to plug in. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Add bulk and individual release-track review dialogs
Feat/sealed content manifests
Map selected phrases to UTC schedules and avoid invalid composition updates during schedule-only saves.
…ng-ui feat(release-tracks): add guided schedule autocomplete
Show each virtual snapshot’s recorded component versions, timestamps, filters, and contribution counts in a responsive list. Preserve provenance independently of the current track head and live schedule.
Merge feat/rollback-tagged-snapshot-ui while preserving virtual scheduling and snapshot composition provenance. Reconcile usage guidance for rollback, release version corrections, schedules, and historical provenance. Validation: 100 focused tests and all 416 tests pass; changed-file lint and production build pass, with existing bundle and style budget warnings.
Expose distinct release conversion and draft deletion controls with confirmation and dependency feedback.
Separate snapshot identity and status from controls, remove redundant draft subtitles, and present snapshot and tagging timestamps as metadata pills.
Display snapshot-local creator names and initials, with explicit automation and historical-attribution fallbacks on Releases cards.
|
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## next #959 +/- ##
==========================================
- Coverage 48.05% 47.98% -0.08%
==========================================
Files 205 208 +3
Lines 27110 27966 +856
Branches 2132 2082 -50
==========================================
+ Hits 13028 13419 +391
- Misses 14037 14455 +418
- Partials 45 92 +47 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
🎉 This PR is included in version 4.12.0 🎉 The release is available on:
Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related to mitre-attack/attack-workbench-rest-api#496
Features
• Release Track tabs changed to "Board", "Releases", and "Config".
• The ability to delete release tracks is moved to the bottom of the Config tab.
• Metadata for the x-mitre-collection object emitted in STIX 2.1 bundles is now more steerable. Users can select the publishing identity (created_by_ref), collection markings (which appears in the collection's object_marking_refs list), collection ID, and the collection's created timestamp. The latter two cannot be changed after the first snapshot is persisted because it would break the provenance/lineage of snapshots. We hope this will make the x-mitre-collection object less opaque to Workbench editors..
• The publishing identity can optionally be set to inherit from the organization/global identity. Otherwise, users can select from any available STIX identity in the object library..
• Similarly, the collection marking can be set to inherit from the organization/global marking definition. Otherwise, users can select from any available marking definition in the object library..
• Users can now configure custom aliases for their release track ID which maps to a valid URL slug. For example, rather than reach the release track via /api/release-tracks/release-track-${uuid}, users can set alias to something like defense-team and route to the track via /api/release-tracks/defense-team..
• The snapshot cards visible on the Releases tab have been visually overhauled..
• The user workflows for creating snapshots is more simpler and more intuitive. For standard tracks, the "preview and release" button as well as the "create draft" button have been removed. We realized that these were unnecessary because the Workbench automatically creates a new draft whenever a change occurs — now, that draft is always shown at the top of the Releases tab, and it's marked accordingly with a label that says "latest". Thus, users need not think about creating standard track snapshots. Instead, they just need to think about whether and when the latest (draft) snapshot is ready to be tagged and released. For virtual tracks, the "create draft" button still exists..
• Each snapshot card now shows which user identity was causally associated with its creation..
• Each snapshot card now shows the causal operation that triggered the snapshot to be created. For example, "candidates added" indicates that a draft was created as a result of a new candidate being added; "scheduled snapshot" indicates that a snapshot was created through the track's cron-based scheduling mechanism; etc..
• The frontend now fully supports configuring virtual track cron schedules..
• Users can now convert snapshots between tagged and draft status..
• Users can delete draft snapshots. Guardrails exist to ensure that delete operations do not result in fragmented snapshot lineages..
• Users can now change the semver release value of a tagged snapshot after the tagging operation..
• In all such cases where the x-mitre-collection object may be effected, the STIX 2.1 SHA-256 hash will be recomputed..
• Two new data quality dashboards have been added: "Cross-Domain Relationships" and "Objects Without Domains"..
Bugs
• Various bugs were resolved effecting the accuracy of snapshot graph provenance. In some cases, data leaks were occurring whereby unreleased objects in the staged tier were being observed in emitted STIX bundles. These issues have been resolved..
• Fixed an issue with the "Duplicate Relationships" dashboard function that was causing the backend to crash when the Data Quality page was opened.