Adding MASVS requirements to the cards

.github/workflows/pre-release.yml

@@ -47,6 +47,8 @@
               pipenv run coverage xml -o converter/coverage/cobertura.xml
           - name: Check test coverage - Report
             run: pipenv run coverage report --fail-under 85 scripts/convert*
+          - name: Check Mobile App enrichment coverage - Report
+            run: pipenv run coverage report --fail-under 95 scripts/enrich_mobileapp_mappings/*.py
           - name: Check PDF generation test coverage - Report
             run: pipenv run coverage report --fail-under 52 scripts/pdf_generation/*.py
           # Upload Code Coverage for Codeclimate

.github/workflows/run-tests.yaml

@@ -42,6 +42,8 @@ jobs:
         run: pipenv run coverage xml
       - name: Check test coverage - Report
         run: pipenv run coverage report --fail-under 95 scripts/convert*
+      - name: Check Mobile App enrichment coverage - Report
+        run: pipenv run coverage report --fail-under 95 scripts/enrich_mobileapp_mappings/*.py
       - name: Check PDF generation test coverage - Report
         run: pipenv run coverage report --fail-under 52 scripts/pdf_generation/*.py
       # Check formatting of files

scripts/README.md

@@ -273,40 +273,20 @@ pipenv run python scripts/convert_mastg_map.py -i ../mastg --maswe-input-path ..
 
 ### Enriching Mobile App Mappings
 
-The `scripts/enrich_mobileapp_mappings.py` script adds MASTG, MASWE, threat, and attack-vector metadata to Mobile App Edition card mappings.
+The [`scripts/enrich_mobileapp_mappings/`](enrich_mobileapp_mappings/) module adds MASTG, MASWE, MASVS, threat, and attack-vector metadata to Mobile App Edition card mappings. Its package README documents the module layout, enrichment rules, and validation commands.
 
 ```bash
-python scripts/enrich_mobileapp_mappings.py --help
-usage: enrich_mobileapp_mappings.py [-h] [-e EDITION] [-v VERSION] [-s SOURCE_DIR] [-i INPUT_PATH]
-                                    [--mastg-path MASTG_PATH] [--maswe-path MASWE_PATH] [-o OUTPUT_PATH]
-
-Enrich Mobile card mappings with MASTG and MASWE metadata
-
-options:
-  -h, --help            show this help message and exit
-  -e EDITION, --edition EDITION
-                        Cornucopia edition, for example mobileapp
-  -v VERSION, --version VERSION
-                        Cornucopia version, for example 2.0
-  -s SOURCE_DIR, --source-dir SOURCE_DIR
-  -i INPUT_PATH, --input-path INPUT_PATH
-                        Card mapping YAML to enrich
-  --mastg-path MASTG_PATH
-                        Generated MASTG metadata YAML
-  --maswe-path MASWE_PATH
-                        Generated MASWE metadata YAML
-  -o OUTPUT_PATH, --output-path OUTPUT_PATH
-                        Enriched mapping YAML; defaults to input
+python -m scripts.enrich_mobileapp_mappings --help
 ```
 
 **Example usage:**
 
 ```bash
 # Enrich the default Mobile App Edition mapping file in place
-pipenv run python scripts/enrich_mobileapp_mappings.py
+pipenv run python -m scripts.enrich_mobileapp_mappings
 
 # Enrich an explicit mapping file and write to a new path
-pipenv run python scripts/enrich_mobileapp_mappings.py -i source/mobileapp-mappings-2.0.yaml \
+pipenv run python -m scripts.enrich_mobileapp_mappings -i source/mobileapp-mappings-2.0.yaml \
   --mastg-path source/mobileapp-mastg-2.0.yaml --maswe-path source/mobileapp-maswe-2.0.yaml \
   -o source/mobileapp-mappings-2.0-enriched.yaml
 ```
@@ -318,6 +298,11 @@ pipenv run python scripts/enrich_mobileapp_mappings.py -i source/mobileapp-mappi
 - MASWE metadata: `source/mobileapp-maswe-2.0.yaml`
 - Output: overwrites the input mapping file
 
+For each card, the module matches `owasp_maswe` values against MASWE codes in
+`mobileapp-maswe-2.0.yaml` and writes the source-ordered, deduplicated union of
+their `owasp_masvs` values. Missing legacy MASWE codes are reported as
+warnings and do not create invented mappings.
+
 ## Contributing to Development
 
 ### LibreOffice Installation

scripts/enrich_mobileapp_mappings/README.md

@@ -0,0 +1,81 @@
+# Mobile App Mapping Enrichment
+
+This module enriches Mobile App Edition card mappings with metadata generated
+from the OWASP MASTG and MASWE data:
+
+- MASTG test, knowledge, and best-practice mappings
+- MASWE weakness mappings
+- MASVS values associated with each referenced MASWE weakness
+- MAS threat and attack-vector descriptions
+
+## Usage
+
+Run the module from the repository root:
+
+```bash
+python -m scripts.enrich_mobileapp_mappings --help
+```
+
+Enrich the default Mobile App Edition mapping in place:
+
+```bash
+python -m scripts.enrich_mobileapp_mappings
+```
+
+Use explicit input and output paths:
+
+```bash
+python -m scripts.enrich_mobileapp_mappings \
+  --input-path source/mobileapp-mappings-2.0.yaml \
+  --mastg-path source/mobileapp-mastg-2.0.yaml \
+  --maswe-path source/mobileapp-maswe-2.0.yaml \
+  --output-path source/mobileapp-mappings-2.0-enriched.yaml
+```
+
+The default paths are:
+
+| File | Default |
+|---|---|
+| Card mappings | `source/mobileapp-mappings-2.0.yaml` |
+| MASTG metadata | `source/mobileapp-mastg-2.0.yaml` |
+| MASWE metadata | `source/mobileapp-maswe-2.0.yaml` |
+| Output | The card mappings input file |
+
+For each card, `owasp_maswe` values are matched against the root MASWE codes
+in the MASWE metadata file. The card's `owasp_masvs` list is the
+source-ordered, deduplicated union of the matching MASWE `owasp_masvs` lists.
+It is recomputed on every run, so obsolete values from a previous generated
+mapping are removed.
+Missing legacy MASWE codes are reported as warnings and do not create
+invented mappings.
+
+## Module layout
+
+| File | Responsibility |
+|---|---|
+| `__init__.py` | Public API and command orchestration |
+| `__main__.py` | `python -m scripts.enrich_mobileapp_mappings` entry point |
+| `arguments.py` | CLI argument parsing and filename validation |
+| `card.py` | Enrichment of one card |
+| `document.py` | Validation and enrichment of the card document |
+| `mastg.py` | MASTG-derived mappings |
+| `maswe.py` | MASWE threat and attack references |
+| `masvs.py` | MASVS mappings derived from MASWE |
+| `yaml_loader.py` | Safe YAML loading and duplicate-key detection |
+| `yaml_output.py` | Stable YAML serialization |
+| `utils.py` | Shared list validation and deduplication |
+
+## Validation
+
+From the repository root:
+
+```bash
+python -m unittest discover --start-directory tests/scripts \
+  --pattern enrich_mobileapp_mappings_utest.py
+python -m black --line-length=120 --check .
+python -m flake8 --max-line-length=120 --max-complexity=10 \
+  --ignore=E203,W503 scripts/enrich_mobileapp_mappings
+python -m mypy --namespace-packages --strict scripts/enrich_mobileapp_mappings
+python -m coverage run --branch -m unittest tests/scripts/enrich_mobileapp_mappings_utest.py
+python -m coverage report --fail-under 95 scripts/enrich_mobileapp_mappings/*.py
+```