Merge branch 'develop' into feat/xlsx-to-oscal-poam-clean

Author: allanilya

.github/actions/snyk-test/action.yaml

@@ -19,19 +19,13 @@ runs:
       env:
         SNYK_TOKEN: ${{ inputs.token }}
       run: |
-        echo "::group::Running synk test ..."
-        python -m venv venv-test
-        source ./venv-test/bin/activate
+        echo "::group::Running snyk test ..."
+        # latest pip-tools incompatible with pip 26.0
+        pip install --force-reinstall 'pip<26.0'
         pip install pip-tools
         pip-compile pyproject.toml -o requirements.txt
         pip install -r requirements.txt
         snyk test --file=requirements.txt
-        echo "::endgroup::"
-      shell: bash
-
-    - name: Cleanup
-      if: success() || failure()
-      run: |
         rm requirements.txt
-        rm -rf ./venv-test
+        echo "::endgroup::"
       shell: bash

.github/security-insights.yml

@@ -1,7 +1,7 @@
 header:
   schema-version: 2.0.0
-  last-updated: '2025-03-20'
-  last-reviewed: '2025-03-20'
+  last-updated: '2026-04-17'
+  last-reviewed: '2026-04-17'
   url: https://github.com/oscal-compass/compliance-trestle/blob/develop/.github/security-insights.yml
   project-si-source: https://raw.githubusercontent.com/oscal-compass/.github/refs/heads/main/.github/security-insights.yml
   comment: |
@@ -17,21 +17,16 @@ repository:
   # From the complaince-trestle MAINTAINER.md file
   # https://github.com/oscal-compass/compliance-trestle/blob/develop/MAINTAINERS.md
   core-team:
-  - name:        Alejandro Jose Leiva Palomo
-    primary:     true
   - name:        Christopher Butler
     primary:     true
   - name:        Lou Degenaro
     primary:     true
-  - name:        Jennifer Power
-    primary:     true
-  - name:        Manjiree Gadgil
-    primary:     true
   - name:        Vikas Agarwal
     primary:     true
   documentation:
     contributing-guide: https://github.com/oscal-compass/compliance-trestle/blob/develop/CONTRIBUTING.md
     security-policy: https://github.com/oscal-compass/community/blob/main/SECURITY.md
+    review-policy: https://github.com/oscal-compass/compliance-trestle/blob/develop/docs/code-review-policy.md
   license:
     url: https://github.com/oscal-compass/compliance-trestle/blob/develop/LICENSE
     expression: Apache-2.0

.github/workflows/act-test.yml

@@ -0,0 +1,40 @@
+name: Test workflows with act
+
+on:
+  pull_request:
+    types: [labeled, synchronize, opened]
+    paths:
+      - '.github/**'
+
+permissions: read-all
+
+jobs:
+  act-dry-run:
+    if: contains(github.event.pull_request.labels.*.name, 'github_actions')
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        submodules: true
+
+    - name: Install act
+      run: |
+        curl -fsSL https://raw.githubusercontent.com/nektos/act/36add66f6520c77c15dfce4715ba6c689d427981/install.sh | sudo bash -s -- -b /usr/local/bin v0.2.87
+        mkdir -p ~/.config/act
+        printf -- '-P ubuntu-latest=ghcr.io/catthehacker/ubuntu:act-latest\n' > ~/.config/act/actrc
+
+    - name: Dry-run actionlint workflow
+      run: |
+        act -n -W .github/workflows/actionlint.yml --container-architecture linux/amd64
+
+    - name: Dry-run PR test pipeline
+      run: |
+        act -n -W .github/workflows/python-test.yml --container-architecture linux/amd64
+
+    - name: Dry-run deploy pipeline
+      run: |
+        act -n -W .github/workflows/python-push.yml --container-architecture linux/amd64
+
+    - name: Dry-run conventional PR pipeline
+      run: |
+        act -n -W .github/workflows/conventional-pr.yml --container-architecture linux/amd64

.github/workflows/actionlint.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Add problem matcher
         run: echo "::add-matcher::.github/actionlint-matcher.json"
       - name: Check workflow files

.github/workflows/codeql-analysis.yml

@@ -59,11 +59,11 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
+      uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -91,6 +91,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
+      uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/conventional-pr.yml

@@ -9,6 +9,7 @@ on:
     branches:
       - 'main'
       - 'develop'
+      - 'v[0-9]*'
 permissions:
   contents: read
 
@@ -18,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Install dependencies
       run: npm install @commitlint/cli @commitlint/config-conventional
@@ -27,3 +28,14 @@ jobs:
       run: |
         PR_TITLE=$(jq -r '.pull_request.title' "$GITHUB_EVENT_PATH")
         echo "$PR_TITLE" | npx commitlint --config commitlint.config.js
+
+    - name: Validate commit type for maintenance branch
+      if: startsWith(github.base_ref, 'v')
+      run: |
+        PR_TITLE=$(jq -r '.pull_request.title' "$GITHUB_EVENT_PATH" | sed 's/^[[:space:]]*//')
+        ALLOWED_TYPES='^(fix|perf|chore|ci|docs|build|refactor|style|test|revert)(\(.*\))?:'
+        if ! echo "$PR_TITLE" | grep -qiE "$ALLOWED_TYPES"; then
+          echo "::error::PR title must use an allowed type for maintenance branches: fix, perf, chore, ci, docs, build, refactor, style, test, revert."
+          echo "::error::Got: $PR_TITLE"
+          exit 1
+        fi

.github/workflows/docs-update.yml

@@ -8,14 +8,17 @@ on:
     tags:
     - v*
 permissions: read-all
+concurrency:
+  group: docs-deploy-global  
+  cancel-in-progress: false
 jobs:
   set-versions:
     runs-on: ubuntu-latest
     outputs:
       min: ${{ steps.versions.outputs.min }}
       max: ${{ steps.versions.outputs.max }}
     steps:
-    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - id: versions
       run: |
         min_version=$(jq '.PYTHON_MIN' -r version.json)
@@ -30,9 +33,9 @@ jobs:
     outputs:
       mver: ${{ steps.versions.outputs.mver }}
     steps:
-    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - name: Set up Python ${{ needs.set-versions.outputs.max }}
-      uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       # This is deliberately not using a custom credential as it relies on native github actions token to have push rights.
       with:
         python-version: ${{ needs.set-versions.outputs.max }}
@@ -46,18 +49,18 @@ jobs:
     runs-on: ubuntu-latest
     needs: [ mike-version, set-versions ]
     steps:
-    - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
+    - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
       id: app-token
       with:
         app-id: ${{ secrets.APP_ID }}
         private-key: ${{ secrets.PRIVATE_KEY }}
-    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         submodules: true
         fetch-depth: 0
         token: ${{ steps.app-token.outputs.token }}
     - name: Set up Python ${{ needs.set-versions.outputs.max }}
-      uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       # This is deliberately not using a custom credential as it relies on native github actions token to have push rights.
       with:
         python-version: ${{ needs.set-versions.outputs.max }}