Bump actions/upload-artifact from 4.6.2 to 7.0.1

.github/workflows/content-artifacts.yml

@@ -52,7 +52,7 @@ jobs:
         run: |
           zip ${{ runner.temp }}/generated-content.zip -r README.md examples/ nist.gov/
         working-directory: ${{ github.workspace }}
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         if: always()
         with:
           name: generated-content

.gitmodules

@@ -1,3 +1,4 @@
 [submodule "build/oscal"]
 	path = build/oscal
 	url = https://github.com/usnistgov/OSCAL.git
+	branch = v1.2.1

build/Makefile

@@ -190,9 +190,14 @@ validate-xml-by-cli: $(OSCAL_CLI_INSTALL_PATH) ## Validate XML files by director
 	@echo "Validating OSCAL content with $(OSCAL_CLI_INSTALL_PATH)/bin/oscal-cli version $(OSCAL_CLI_VERSION)"
 	@find $(SRC_DIR)/examples -mindepth 1 -maxdepth 1 -type d | while read example_dir; do \
 		example_type=$$(basename "$$example_dir"); \
-		echo "Processing example type: $$example_type"; \
 		find "$$example_dir" -name '*.xml' | while read xml_file; do \
-			echo "Validating $$xml_file with OSCAL CLI as $$example_type"; \
+		if [[ "$$xml_file" == *"resolved-profile_catalog.xml" ]]; then \
+			example_type="catalog"; \
+		fi; \
+		if [[ "$$xml_file" == *"profile.xml" ]]; then \
+			example_type="profile"; \
+		fi; \
+		echo "=== Validating $$xml_file with OSCAL CLI as $$example_type"; \
 			$(OSCAL_CLI_INSTALL_PATH)/bin/oscal-cli "$$example_type" validate "$$xml_file"; \
 		done \
 	done

src/examples/catalog/xml/basic-catalog.xml → src/examples/catalog/xml/basic_catalog.xml

@@ -39,13 +39,13 @@
                <p>A cross link has been established with a choppy syntax: <a href="#s1.1.2">(choppy)</a>.</p>
             </part>
             <part id="s1.1.1_gdn" name="guidance">
-               <part id="s1.1.1_gdn.1" name="objective">
+               <part id="s1.1.1_gdn.1" name="assessment-objective">
                   <p>Allocation of information security responsibilities should be done in accordance with the information security policies. Responsibilities for the protection of individual assets and for carrying out specific information security processes should be identified. Responsibilities for information security risk management activities and in particular for acceptance of residual risks should be defined. These responsibilities should be supplemented, where necessary, with more detailed guidance for specific sites and information processing facilities. Local responsibilities for the protection of assets and for carrying out specific security processes should be defined.</p>
                </part>
-               <part id="s1.1.1_gdn.2" name="objective">
+               <part id="s1.1.1_gdn.2" name="assessment-objective">
                   <p>Individuals with allocated information security responsibilities may delegate security tasks to others. Nevertheless they remain accountable and should determine that any delegated tasks have been correctly performed.</p>
                </part>
-               <part id="s1.1.1_gdn.3" name="objective">
+               <part id="s1.1.1_gdn.3" name="assessment-objective">
                   <p>Areas for which individuals are responsible should be stated. In particular the following should take place:</p>
                   <ol>
                      <li>the assets and information security processes should be identified and defined;</li>

src/examples/profile/xml/basic-profile.xml → src/examples/profile/xml/basic_profile.xml

@@ -10,7 +10,7 @@
       <p>The following document is used in the OSCAL Profile Tutorial and builds on the catalog created for the OSCAL Catalog Tutorial</p>
     </remarks>
   </metadata>
-  <import href="../../catalog/xml/basic-catalog.xml">
+  <import href="../../catalog/xml/basic_catalog.xml">
     <include-controls>
       <matching pattern="s1.1.*"/>
     </include-controls>

src/examples/profile/xml/basic-profile-resolved.xml → src/examples/profile/xml/basic_resolved-profile_catalog.xml

@@ -1,14 +1,14 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<catalog xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="3e580e28-a4b3-48a0-96bd-38f3429de413">
+<catalog xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="bb89b98c-2fe4-46be-9b26-7b4a8b476107">
     <metadata>
         <title>Sample Security Profile
             <em>For Demonstration</em> and Testing
         </title>
-        <last-modified>2025-08-26T22:08:53.936316Z</last-modified>
+        <last-modified>2026-02-08T01:25:19.668313Z</last-modified>
         <version>1.0</version>
         <oscal-version>1.1.3</oscal-version>
         <prop name="resolution-tool" value="libOSCAL-Java"/>
-        <link href="file:///Users/miorga/Desktop/ALL_PROJECTS/GH/_usnistgov/oscal-content/src/examples/profile/xml/basic-profile.xml" rel="source-profile"/>
+        <link href="basic_profile.xml" rel="source-profile"/>
     </metadata>
     <control id="s1.1.1">
         <title>Information security roles and responsibilities</title>
@@ -38,13 +38,13 @@
             </p>
         </part>
         <part id="s1.1.1_gdn" name="guidance">
-            <part id="s1.1.1_gdn.1" name="objective">
+            <part id="s1.1.1_gdn.1" name="assessment-objective">
                 <p>Allocation of information security responsibilities should be done in accordance with the information security policies. Responsibilities for the protection of individual assets and for carrying out specific information security processes should be identified. Responsibilities for information security risk management activities and in particular for acceptance of residual risks should be defined. These responsibilities should be supplemented, where necessary, with more detailed guidance for specific sites and information processing facilities. Local responsibilities for the protection of assets and for carrying out specific security processes should be defined.</p>
             </part>
-            <part id="s1.1.1_gdn.2" name="objective">
+            <part id="s1.1.1_gdn.2" name="assessment-objective">
                 <p>Individuals with allocated information security responsibilities may delegate security tasks to others. Nevertheless they remain accountable and should determine that any delegated tasks have been correctly performed.</p>
             </part>
-            <part id="s1.1.1_gdn.3" name="objective">
+            <part id="s1.1.1_gdn.3" name="assessment-objective">
                 <p>Areas for which individuals are responsible should be stated. In particular the following should take place:</p>
                 <ol>
                     <li>the assets and information security processes should be identified and defined;</li>
@@ -54,7 +54,7 @@
                     <li>coordination and oversight of information security aspects of supplier relationships should be identified and documented.</li>
                 </ol>
             </part>
-            <part id="s1.1.1_gdn.4" name="item">
+            <part id="s1.1.1_gdn.4" name="assessment-objective">
                 <p>Users of devices running Gnome can adjust the inactivity timeout using the following link: https://help.gnome.org/admin/system-admin-guide/stable/desktop-lockscreen.html.en</p>
             </part>
         </part>

src/nist.gov/SP800-171/rev3/xml/NIST_SP800-171_rev3_catalog.xml

@@ -60,10 +60,10 @@
             <party-uuid>98c78f9b-5d50-4b01-b47f-d16801e8d0ab</party-uuid>
         </responsible-party>
         <responsible-party role-id="publisher">
-            <party-uuid>985fea3e-a6e5-4a57-ba3d-74f063bc8fa2</party-uuid>
+            <party-uuid>4809f9d2-fdb1-47b0-b444-11271f09ff22</party-uuid>
         </responsible-party>
         <responsible-party role-id="contact-publisher">
-            <party-uuid>985fea3e-a6e5-4a57-ba3d-74f063bc8fa2</party-uuid>
+            <party-uuid>4809f9d2-fdb1-47b0-b444-11271f09ff22</party-uuid>
         </responsible-party>
                 <responsible-party role-id="contact-creator">
             <party-uuid>98c78f9b-5d50-4b01-b47f-d16801e8d0ab</party-uuid>
@@ -982,7 +982,7 @@
             </param>
             <param id="A.03.01.08.ODP.04">
                 <prop name="label" value="A.03.01.08.ODP[04]" />
-                <label></label>
+                <label>time period</label>
                 <usage>
                     <p>organization-defined time period</p>
                 </usage>
@@ -1130,7 +1130,7 @@
             </param>
             <param id="A.03.01.10.ODP.02">
                 <prop name="label" value="A.03.01.10.ODP[02]" />
-                <label></label>
+                <label>time period</label>
                 <usage>
                     <p>organization-defined time period</p>
                 </usage>