Role permissions order tool and workflow

[peternied]

Description

Adds a NodeJS tool that can inspect yaml role definitions, check if they are in alphabetical order, correct them if required. Seems pretty useful to prevent manual inspection of changes to the roles definitions, but curious what other folks think.

Issues Resolved

• Related update security-analytics roles to add correlation engine apis #2732

Check List

• New functionality includes testing
• New functionality has been documented
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[DarshitChanpura]

Great addition @peternied !

[davidlago]

Is this something we were previously documenting and/or enforcing via PR review? Thanks for taking the humans out of the equation @peternied :)

[RyanL1997]

Could we rebase and re-run the CIs? It is kinda out of date for 34commits behind.

[stephen-crawford]

This just needs to have the new check rerun on it after the rebase and then it can be approved and merged.

[peternied]

Thanks for the reviews @RyanL1997 @DarshitChanpura @davidlago @scrawfor99

I've cleaned up the JavaScript code and reverted the roles files changed and then re-ran the tool to avoid any merge conflicts

[codecov]

Codecov Report

Merging #2733 (5f0f3e8) into main (d871af3) will decrease coverage by 0.03%.
The diff coverage is n/a.

@@             Coverage Diff              @@
##               main    #2733      +/-   ##
============================================
- Coverage     62.18%   62.15%   -0.03%     
+ Complexity     3402     3401       -1     
============================================
  Files           266      266              
  Lines         19653    19653              
  Branches       3330     3330              
============================================
- Hits          12221    12216       -5     
- Misses         5825     5828       +3     
- Partials       1607     1609       +2     

see 3 files with indirect coverage changes

[willyborankin]

Tests failures are relevant. e.g:
RoleBasedAccessTests L174

        Assert.assertEquals(
            new SecurityJsonNode(DefaultObjectMapper.readTree(response.getBody())).getDotted(
                "opendistro_security_role_starfleet_captains.cluster_permissions"
            ).get(0).asString(),
            "cluster:monitor*"
        );

expects get cluster_permissions at the first position in the index since it was in this position before sorting

before sorting:

    - "cluster:monitor*"
    - "*bulk*"

after sorting:

    - "*bulk*"
    - "cluster:monitor*"

[peternied]

Props to @willyborankin who figured this out so quickly I didn't even get a chance to look into it.

Upgraded this test to make sure both permissions are present instead of only the first one.

[cwperks]

Adding backport label to minimize conflicts when backporting to 2.x

[opensearch-trigger-bot]

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.x 2.x
# Navigate to the new working tree
cd .worktrees/backport-2.x
# Create a new branch
git switch --create backport/backport-2733-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 70424643f60f75ce484fcf2ad422239da01db293
# Push it to GitHub
git push --set-upstream origin backport/backport-2733-to-2.x
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-2733-to-2.x.