You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The Accessibility workshop includes a workshop-specific Copilot agent that provides guided assistance during lab exercises, along with governance instructions that enforce coding standards within the workshop codebase. The FinOps workshop does not have equivalent Copilot artifacts. Adding a workshop agent and governance instructions to the FinOps workshop would bring AI-assisted lab guidance to parity. See [Gaps Identified](#gaps-identified) for remediation details.
95
+
96
+
#### Screenshot Script Comparison
97
+
98
+
Both workshops include automated screenshot capture scripts with comparable capabilities:
| Playwright helpers | Separate `playwright-helpers.js` with 3 functions | Inline Playwright usage |
107
+
| Lab and phase filtering | Yes | Yes |
108
+
| Theme and font customization | Yes | Yes |
109
+
| Environment modes | local/azure | local/azure |
110
+
111
+
New domains should follow this pattern and create a `capture-screenshots.ps1` script covering all labs, with phase filtering and both local and Azure environment support.
112
+
94
113
### Power BI Report (`advsec-pbi-report-ado`)
95
114
96
115
| Aspect | Current State | Gap |
@@ -114,6 +133,34 @@ Making Azure DevOps a first-class citizen means every GitHub Actions workflow ha
114
133
|**FinOps**|`finops-scan.yml`, `finops-cost-gate.yml`| None | Not implemented |
115
134
|**APM Security**|`apm-security.yml`| Inline pattern in docs | Not implemented |
116
135
136
+
## Gaps Identified
137
+
138
+
Research across both domains reveals four specific parity gaps where FinOps does not match Accessibility capabilities.
139
+
140
+
### Gap 1: FinOps Workshop Has No Copilot Artifacts
141
+
142
+
The Accessibility workshop repository includes a workshop-specific agent and governance instructions. The FinOps workshop repository contains zero Copilot artifacts: no agents, prompts, instructions, or skills.
143
+
144
+
To close this gap, create a FinOps workshop agent in `.github/agents/` and add governance instructions to `.github/instructions/` in the `finops-scan-workshop` repository, following the patterns established in the Accessibility workshop.
145
+
146
+
### Gap 2: FinOps Demo App Has No ADO Pipelines
147
+
148
+
The Accessibility demo app repository includes 8 Azure DevOps pipelines covering CI/CD, deployment orchestration, scan variants, and reusable templates. The FinOps demo app repository has none.
149
+
150
+
To close this gap, create equivalent ADO pipelines in `.azuredevops/pipelines/` in the `finops-scan-demo-app` repository. Reference the Accessibility pipeline templates for structure and task mapping.
151
+
152
+
### Gap 3: No Domain-Specific Power BI Pages Exist
153
+
154
+
The Power BI report (`advsec-pbi-report-ado`) contains only 3 security-focused pages (Overview, Alerts by Type, Trend Analysis). Neither Accessibility nor FinOps has domain-specific pages in the report, though FinOps has detailed design specifications for 6 dashboard pages documented in its `docs/` directory.
155
+
156
+
To close this gap, add domain-specific pages to the Power BI report. Start with FinOps pages because full design specifications already exist, then create equivalent pages for Accessibility.
157
+
158
+
### Gap 4: SARIF Generation Approach Differs Between Domains
159
+
160
+
The Accessibility scanner generates SARIF v2.1.0 natively through a built-in TypeScript generator (`src/lib/report/sarif-generator.ts`). The FinOps domain requires 2 Python converter scripts (`custodian-to-sarif.py` and `infracost-to-sarif.py`) because Cloud Custodian and Infracost do not produce SARIF natively. PSRule and Checkov produce SARIF natively without converters.
161
+
162
+
This is a design difference driven by tool capabilities rather than a gap requiring remediation. New domains should evaluate SARIF capabilities during tool selection (Step 2 of the contribution guide) and document any converters needed.
163
+
117
164
## Contributing a New Domain
118
165
119
166
This section provides a step-by-step guide for adding a new scanning domain to the framework. We use **Code Quality** as a concrete example.
@@ -255,9 +302,17 @@ Copy the agent patterns from `agentic-accelerator-framework/agents/`:
Skills can exist in two locations: the domain's demo-app repository (for scanner-specific knowledge, as in the FinOps `finops-scan` skill) and the framework repository (for cross-domain reference, as in the `a11y-scan` and `security-scan` skills in `agentic-accelerator-framework/skills/`). Create the skill in the demo-app repo first, then consider adding a corresponding skill to the framework repo if the knowledge benefits users working across domains.
306
+
258
307
### Step 6: Implement SARIF Integration
259
308
260
-
All findings must output SARIF v2.1.0 for GitHub Security Overview and ADO Advanced Security:
309
+
All findings must output SARIF v2.1.0 for GitHub Security Overview and ADO Advanced Security. Each SARIF file must include:
310
+
311
+
*`partialFingerprints` for deduplication across runs
312
+
*`automationDetails.id` set to the domain category prefix (e.g., `code-quality/coverage/`)
313
+
*`runs[].tool.driver.name` populated with the scanner or agent name
314
+
*`runs[].tool.driver.rules[]` with unique `ruleId` values per finding type
315
+
*`runs[].results[].level` mapped from severity (CRITICAL/HIGH → `error`, MEDIUM → `warning`, LOW → `note`)
261
316
262
317
```text
263
318
SARIF Flow:
@@ -377,6 +432,8 @@ Use this checklist when contributing a new domain:
377
432
378
433
-[ ] Create repository `{domain}-scan-demo-app`
379
434
-[ ] Add 5 sample apps with intentional violations in different languages
435
+
-[ ] Add Dockerfile per sample app
436
+
-[ ] Add `start-local.ps1` and `stop-local.ps1` per sample app
380
437
-[ ] Implement or integrate 3–5 open source scanning tools
381
438
-[ ] Write SARIF converters for tools without native SARIF output
0 commit comments