feat: support OSCAL 1.2.2

.github/actions/snyk-test/action.yaml

@@ -20,8 +20,6 @@ runs:
         SNYK_TOKEN: ${{ inputs.token }}
       run: |
         echo "::group::Running snyk test ..."
-        # latest pip-tools incompatible with pip 26.0
-        pip install --force-reinstall 'pip<26.0'
         pip install pip-tools
         pip-compile pyproject.toml -o requirements.txt
         pip install -r requirements.txt

.github/workflows/act-test.yml

@@ -13,7 +13,7 @@ jobs:
     if: contains(github.event.pull_request.labels.*.name, 'github_actions')
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         submodules: true
 

.github/workflows/actionlint.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Add problem matcher
         run: echo "::add-matcher::.github/actionlint-matcher.json"
       - name: Check workflow files

.github/workflows/codeql-analysis.yml

@@ -59,7 +59,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/conventional-pr.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
     - name: Install dependencies
       run: npm install @commitlint/cli @commitlint/config-conventional

.github/workflows/docs-update.yml

@@ -18,7 +18,7 @@ jobs:
       min: ${{ steps.versions.outputs.min }}
       max: ${{ steps.versions.outputs.max }}
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
     - id: versions
       run: |
         min_version=$(jq '.PYTHON_MIN' -r version.json)
@@ -33,7 +33,7 @@ jobs:
     outputs:
       mver: ${{ steps.versions.outputs.mver }}
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
     - name: Set up Python ${{ needs.set-versions.outputs.max }}
       uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       # This is deliberately not using a custom credential as it relies on native github actions token to have push rights.
@@ -54,7 +54,7 @@ jobs:
       with:
         app-id: ${{ secrets.APP_ID }}
         private-key: ${{ secrets.PRIVATE_KEY }}
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         submodules: true
         fetch-depth: 0

.github/workflows/python-push.yml

@@ -17,7 +17,7 @@ jobs:
       min: ${{ steps.versions.outputs.min }}
       max: ${{ steps.versions.outputs.max }}
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
     - id: versions
       run: |
         min_version=$(jq '.PYTHON_MIN' -r version.json)
@@ -52,7 +52,7 @@ jobs:
     - name: Don't mess with line endings
       run: |
         git config --global core.autocrlf false
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         submodules: true
     - name: Set up Python ${{ matrix.python-version }}
@@ -134,7 +134,7 @@ jobs:
     - name: Don't mess with line endings
       run: |
         git config --global core.autocrlf false
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         fetch-depth: 0
         submodules: true
@@ -194,7 +194,7 @@ jobs:
       with:
         app-id: ${{ secrets.APP_ID }}
         private-key: ${{ secrets.PRIVATE_KEY }}
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         submodules: true
         fetch-depth: 0
@@ -318,7 +318,7 @@ jobs:
       with:
         app-id: ${{ secrets.APP_ID }}
         private-key: ${{ secrets.PRIVATE_KEY }}
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         submodules: true
         ref: main

.github/workflows/python-test.yml

@@ -14,7 +14,7 @@ jobs:
       min: ${{ steps.versions.outputs.min }}
       max: ${{ steps.versions.outputs.max }}
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
     - id: versions
       run: |
         min_version=$(jq '.PYTHON_MIN' -r version.json)
@@ -28,7 +28,7 @@ jobs:
     - name: Don't mess with line endings
       run: |
         git config --global core.autocrlf false
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         submodules: true
     - name: Set up Python
@@ -82,7 +82,7 @@ jobs:
     - name: Don't mess with line endings
       run: |
         git config --global core.autocrlf false
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         submodules: true
     - name: Set up Python
@@ -121,7 +121,7 @@ jobs:
     - name: Don't mess with line endings
       run: |
         git config --global core.autocrlf false
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         fetch-depth: 0
         submodules: true
@@ -177,7 +177,7 @@ jobs:
     - name: Don't mess with line endings
       run: |
         git config --global core.autocrlf false
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         fetch-depth: 0
         submodules: true
@@ -234,7 +234,7 @@ jobs:
     - name: Don't mess with line endings
       run: |
         git config --global core.autocrlf false
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         submodules: true
     - name: Set up Python
@@ -284,7 +284,7 @@ jobs:
       - name: Don't mess with line endings
         run: |
           git config --global core.autocrlf false
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           submodules: true
       - name: Set up Python

.github/workflows/scorecard.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: "Checkout Code"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 

Makefile

@@ -160,7 +160,10 @@ act-conventional-dry: ## Dry-run the conventional PR pipeline locally with act
 # Utilities
 # ============================================================================
 
-.PHONY: gen-oscal simplified-catalog check-for-changes clean clean-env
+.PHONY: download-oscal gen-oscal gen-oscal-namespace simplified-catalog check-for-changes clean clean-env
+
+download-oscal: ## Download latest OSCAL release schemas
+	python3 scripts/download_oscal.py
 
 gen-oscal: clean-tmp ## Generate OSCAL Python models from JSON schemas
 	hatch run python ./scripts/gen_oscal.py

README.md

@@ -92,7 +92,7 @@ A collection of demos utilizing trestle can be found in the related project [com
 
 ### v4: stable (actively developed)
 
-- supports NIST OSCAL 1.2.1 as well as previous versions
+- supports NIST OSCAL 1.2.2 as well as previous versions
 - supports newly released Mapping Model
 
 ### v3: stable (maintenance mode)

docs/index.md

@@ -37,11 +37,11 @@ Trestle provides tooling to help orchestrate the compliance process across a num
 
 ## Important Note:
 
-The current version of trestle 4.x supports NIST OSCAL 1.2.1.
+The current version of trestle 4.x supports NIST OSCAL 1.2.2.
 Below shows trestle versions correspondence with OSCAL versions:
 
 ```
-trestle 4.x => OSCAL 1.2.1
+trestle 4.x => OSCAL 1.2.2
 trestle 3.x => OSCAL 1.1.3
 trestle 2.x => OSCAL 1.0.4
 trestle 1.x => OSCAL 1.0.2
@@ -61,7 +61,7 @@ python3.11 -m venv venv.trestle
 source venv.trestle/bin/activate
 pip install compliance-trestle
 trestle version
-Trestle version v4.0.0 based on OSCAL version 1.2.1
+Trestle version v4.1.0 based on OSCAL version 1.2.2
 ```
 
 #### Install of trestle 3.x
@@ -112,7 +112,7 @@ Trestle runs on most all python platforms (e.g. Linux, Mac, Windows) and is avai
 
 ## Development status
 
-Compliance trestle is currently stable and is based on NIST OSCAL version 1.2.1, with active development continuing.
+Compliance trestle is currently stable and is based on NIST OSCAL version 1.2.2, with active development continuing.
 
 ## Contributing to Trestle
 

docs/reference/API/trestle/tasks/xlsx_to_oscal_poam.md

@@ -0,0 +1,7 @@
+---
+title: trestle.tasks.xlsx_to_oscal_poam
+description: Documentation for trestle.tasks.xlsx_to_oscal_poam module
+---
+
+::: trestle.tasks.xlsx_to_oscal_poam
+handler: python

docs/tutorials/introduction_to_trestle.md

@@ -70,7 +70,7 @@ As a reminder, you could also have imported the file from a local directory on y
 
 The `import` command will also check the
 validity of the file including the presence of any duplicate uuid's.  If the file is manually created
-please be sure it conforms with the current OSCAL schema (OSCAL version 1.2.1) and has no defined uuid's that are duplicates.
+please be sure it conforms with the current OSCAL schema and has no defined uuid's that are duplicates.
 If there are any errors the Import will fail and the file must be corrected.
 
 <br>