Background
openedx-core is adding the Competency-Based Education (CBE) data models under its openedx_learning
app. openedx/openedx-core#641 adds the criteria definition models, openedx/openedx-core#642 adds the
mastery status lookup and the learner progress models, and openedx/openedx-core#613 is the parent
issue covering both.
This repo runs a PII annotation check that requires every active Django model to be labelled as
containing personal data or not. That check only scans this repo's own tree: .pii_annotations.yml
sets source_path: ./, so it never reads models inside installed site-packages. Every openedx-core
model is therefore listed by hand in this repo's .annotation_safe_list.yml, even where the
annotation is already written in openedx-core's own source. #38958 added the
first entry for this app, openedx_learning.CompetencyTaxonomy, for exactly that reason, and the
same file already carries dozens of entries for openedx_content and openedx_catalog models.
openedx_learning is already in INSTALLED_APPS for both LMS and CMS. So the moment the
openedx-core pin moves to a version containing #641 and #642, ten new models become active with no
safelist entry here, and make pii_check drops below its 100% coverage target.
What to do
Add ten entries to .annotation_safe_list.yml, each annotated as containing no PII, in the same
shape as the existing openedx_learning.CompetencyTaxonomy entry:
openedx_learning.CompetencyCriteriaGroup:
".. no_pii:": "No PII"
The ten models, by the openedx-core issue that creates them:
From openedx/openedx-core#641, the criteria definition models:
openedx_learning.CompetencyCriteriaGroupopenedx_learning.CompetencyRuleProfileopenedx_learning.CompetencyCriterionopenedx_learning.HistoricalCompetencyCriteriaGroupopenedx_learning.HistoricalCompetencyRuleProfileopenedx_learning.HistoricalCompetencyCriterion
From openedx/openedx-core#642, the mastery status lookup and learner progress models:
openedx_learning.CompetencyMasteryStatusesopenedx_learning.StudentCompetencyCriteriaStatusopenedx_learning.StudentCompetencyCriteriaGroupStatusopenedx_learning.StudentCompetencyStatus
The three Historical* models are generated by django-simple-history, which openedx-core applies
to its criteria definition models. They are real Django models and the annotation scan counts them.
This repo's safelist already carries Historical* entries for many other apps, so they are routine
rather than a special case.
None of the ten stores personal data of its own. The three StudentCompetency*Status models hold a
user foreign key and a status value, which is how every existing openedx-core model with a user
foreign key is annotated here, openedx_content.PublishableEntity and openedx_content.Collection
among them. pii_retirement: consumer_api is not used, because it asserts a consumer-facing
retirement API that openedx-core does not have.
Ordering constraint
This has to land in the same pull request as the openedx-core pin bump that brings in #641 and
#642. Bumping the pin without these entries breaks pii_check; adding the entries without the pin
bump names models that do not exist yet.
Acceptance criteria
Out of scope
Any INSTALLED_APPS or import-linter change. #38958 already registered
openedx_learning and added it to the isolated_apps contract, and both of those cover the whole
app rather than being per-model.
Blocked by
openedx/openedx-core#641 and openedx/openedx-core#642 must merge and be released first.
Background
openedx-core is adding the Competency-Based Education (CBE) data models under its
openedx_learningapp. openedx/openedx-core#641 adds the criteria definition models, openedx/openedx-core#642 adds the
mastery status lookup and the learner progress models, and openedx/openedx-core#613 is the parent
issue covering both.
This repo runs a PII annotation check that requires every active Django model to be labelled as
containing personal data or not. That check only scans this repo's own tree:
.pii_annotations.ymlsets
source_path: ./, so it never reads models inside installed site-packages. Every openedx-coremodel is therefore listed by hand in this repo's
.annotation_safe_list.yml, even where theannotation is already written in openedx-core's own source. #38958 added the
first entry for this app,
openedx_learning.CompetencyTaxonomy, for exactly that reason, and thesame file already carries dozens of entries for
openedx_contentandopenedx_catalogmodels.openedx_learningis already inINSTALLED_APPSfor both LMS and CMS. So the moment theopenedx-corepin moves to a version containing #641 and #642, ten new models become active with nosafelist entry here, and
make pii_checkdrops below its 100% coverage target.What to do
Add ten entries to
.annotation_safe_list.yml, each annotated as containing no PII, in the sameshape as the existing
openedx_learning.CompetencyTaxonomyentry:The ten models, by the openedx-core issue that creates them:
From openedx/openedx-core#641, the criteria definition models:
openedx_learning.CompetencyCriteriaGroupopenedx_learning.CompetencyRuleProfileopenedx_learning.CompetencyCriterionopenedx_learning.HistoricalCompetencyCriteriaGroupopenedx_learning.HistoricalCompetencyRuleProfileopenedx_learning.HistoricalCompetencyCriterionFrom openedx/openedx-core#642, the mastery status lookup and learner progress models:
openedx_learning.CompetencyMasteryStatusesopenedx_learning.StudentCompetencyCriteriaStatusopenedx_learning.StudentCompetencyCriteriaGroupStatusopenedx_learning.StudentCompetencyStatusThe three
Historical*models are generated bydjango-simple-history, which openedx-core appliesto its criteria definition models. They are real Django models and the annotation scan counts them.
This repo's safelist already carries
Historical*entries for many other apps, so they are routinerather than a special case.
None of the ten stores personal data of its own. The three
StudentCompetency*Statusmodels hold auser foreign key and a status value, which is how every existing openedx-core model with a user
foreign key is annotated here,
openedx_content.PublishableEntityandopenedx_content.Collectionamong them.
pii_retirement: consumer_apiis not used, because it asserts a consumer-facingretirement API that openedx-core does not have.
Ordering constraint
This has to land in the same pull request as the
openedx-corepin bump that brings in #641 and#642. Bumping the pin without these entries breaks
pii_check; adding the entries without the pinbump names models that do not exist yet.
Acceptance criteria
.annotation_safe_list.ymlmake pii_checkpasses at 100% coverageopenedx-corepin inrequirements/edx/kernel.inandrequirements/edx/base.txtresolves to a version containing Competency criteria models (authoring/definition layer) openedx-core#641 and Mastery status lookup + learner progress models openedx-core#642
make check_migrationspasses and the new migrations apply cleanlyOut of scope
Any
INSTALLED_APPSor import-linter change. #38958 already registeredopenedx_learningand added it to theisolated_appscontract, and both of those cover the wholeapp rather than being per-model.
Blocked by
openedx/openedx-core#641 and openedx/openedx-core#642 must merge and be released first.