Merge branch 'develop' into fix/merge-cleanup-distributed-subdirs

Author: degenaro

.github/actions/snyk-test/action.yaml

@@ -20,9 +20,7 @@ runs:
         SNYK_TOKEN: ${{ inputs.token }}
       run: |
         echo "::group::Running snyk test ..."
-        # latest pip-tools incompatible with pip 26.0
-        pip install --force-reinstall 'pip<26.0'
-        pip install pip-tools
+        pip install "pip-tools>=7.6.1"
         pip-compile pyproject.toml -o requirements.txt
         pip install -r requirements.txt
         snyk test --file=requirements.txt

.github/dependabot.yml

@@ -7,6 +7,11 @@ updates:
     commit-message:
       prefix: fix
       include: scope
+    groups:
+      codeql-action:
+        patterns:
+          - "github/codeql-action/init"
+          - "github/codeql-action/analyze"
 
   - package-ecosystem: "pip"
     directory: "/"

.github/security-insights.yml

@@ -1,7 +1,7 @@
 header:
   schema-version: 2.0.0
-  last-updated: '2025-03-20'
-  last-reviewed: '2025-03-20'
+  last-updated: '2026-05-28'
+  last-reviewed: '2026-05-28'
   url: https://github.com/oscal-compass/compliance-trestle/blob/develop/.github/security-insights.yml
   project-si-source: https://raw.githubusercontent.com/oscal-compass/.github/refs/heads/main/.github/security-insights.yml
   comment: |
@@ -17,21 +17,16 @@ repository:
   # From the complaince-trestle MAINTAINER.md file
   # https://github.com/oscal-compass/compliance-trestle/blob/develop/MAINTAINERS.md
   core-team:
-  - name:        Alejandro Jose Leiva Palomo
-    primary:     true
   - name:        Christopher Butler
     primary:     true
   - name:        Lou Degenaro
     primary:     true
-  - name:        Jennifer Power
-    primary:     true
-  - name:        Manjiree Gadgil
-    primary:     true
   - name:        Vikas Agarwal
     primary:     true
   documentation:
     contributing-guide: https://github.com/oscal-compass/compliance-trestle/blob/develop/CONTRIBUTING.md
     security-policy: https://github.com/oscal-compass/community/blob/main/SECURITY.md
+    review-policy: https://github.com/oscal-compass/compliance-trestle/blob/develop/docs/code-review-policy.md
   license:
     url: https://github.com/oscal-compass/compliance-trestle/blob/develop/LICENSE
     expression: Apache-2.0
@@ -45,6 +40,12 @@ repository:
         comment: |
           This attestation communicates the Trusted Publisher identity
           used to publish the project.
+      - name: SLSA Build Provenance
+        location: https://github.com/oscal-compass/compliance-trestle/releases
+        predicate-uri: https://slsa.dev/provenance/v1
+        comment: |
+          SLSA build provenance attestation generated automatically
+          for all release distribution artifacts via actions/attest.
     distribution-points:
       - uri: https://github.com/oscal-compass/compliance-trestle/releases
         comment: GitHub Release Page

.github/workflows/act-test.yml

@@ -0,0 +1,40 @@
+name: Test workflows with act
+
+on:
+  pull_request:
+    types: [labeled, synchronize, opened]
+    paths:
+      - '.github/**'
+
+permissions: read-all
+
+jobs:
+  act-dry-run:
+    if: contains(github.event.pull_request.labels.*.name, 'github_actions')
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        submodules: true
+
+    - name: Install act
+      run: |
+        curl -fsSL https://raw.githubusercontent.com/nektos/act/36add66f6520c77c15dfce4715ba6c689d427981/install.sh | sudo bash -s -- -b /usr/local/bin v0.2.87
+        mkdir -p ~/.config/act
+        printf -- '-P ubuntu-latest=ghcr.io/catthehacker/ubuntu:act-latest\n' > ~/.config/act/actrc
+
+    - name: Dry-run actionlint workflow
+      run: |
+        act -n -W .github/workflows/actionlint.yml --container-architecture linux/amd64
+
+    - name: Dry-run PR test pipeline
+      run: |
+        act -n -W .github/workflows/python-test.yml --container-architecture linux/amd64
+
+    - name: Dry-run deploy pipeline
+      run: |
+        act -n -W .github/workflows/python-push.yml --container-architecture linux/amd64
+
+    - name: Dry-run conventional PR pipeline
+      run: |
+        act -n -W .github/workflows/conventional-pr.yml --container-architecture linux/amd64

.github/workflows/actionlint.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Add problem matcher
         run: echo "::add-matcher::.github/actionlint-matcher.json"
       - name: Check workflow files

.github/workflows/codeql-analysis.yml

@@ -59,11 +59,11 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+      uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -91,6 +91,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+      uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/conventional-pr.yml

@@ -9,6 +9,7 @@ on:
     branches:
       - 'main'
       - 'develop'
+      - 'v[0-9]*'
 permissions:
   contents: read
 
@@ -18,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install dependencies
       run: npm install @commitlint/cli @commitlint/config-conventional
@@ -27,3 +28,14 @@ jobs:
       run: |
         PR_TITLE=$(jq -r '.pull_request.title' "$GITHUB_EVENT_PATH")
         echo "$PR_TITLE" | npx commitlint --config commitlint.config.js
+
+    - name: Validate commit type for maintenance branch
+      if: startsWith(github.base_ref, 'v')
+      run: |
+        PR_TITLE=$(jq -r '.pull_request.title' "$GITHUB_EVENT_PATH" | sed 's/^[[:space:]]*//')
+        ALLOWED_TYPES='^(fix|perf|chore|ci|docs|build|refactor|style|test|revert)(\(.*\))?:'
+        if ! echo "$PR_TITLE" | grep -qiE "$ALLOWED_TYPES"; then
+          echo "::error::PR title must use an allowed type for maintenance branches: fix, perf, chore, ci, docs, build, refactor, style, test, revert."
+          echo "::error::Got: $PR_TITLE"
+          exit 1
+        fi

.github/workflows/docs-update.yml

@@ -9,7 +9,7 @@ on:
     - v*
 permissions: read-all
 concurrency:
-  group: docs-${{ github.sha }}  # Don't double up when tags are on develop
+  group: docs-deploy-global  
   cancel-in-progress: false
 jobs:
   set-versions:
@@ -18,7 +18,7 @@ jobs:
       min: ${{ steps.versions.outputs.min }}
       max: ${{ steps.versions.outputs.max }}
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - id: versions
       run: |
         min_version=$(jq '.PYTHON_MIN' -r version.json)
@@ -33,9 +33,9 @@ jobs:
     outputs:
       mver: ${{ steps.versions.outputs.mver }}
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Set up Python ${{ needs.set-versions.outputs.max }}
-      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       # This is deliberately not using a custom credential as it relies on native github actions token to have push rights.
       with:
         python-version: ${{ needs.set-versions.outputs.max }}
@@ -49,18 +49,18 @@ jobs:
     runs-on: ubuntu-latest
     needs: [ mike-version, set-versions ]
     steps:
-    - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
       id: app-token
       with:
         app-id: ${{ secrets.APP_ID }}
         private-key: ${{ secrets.PRIVATE_KEY }}
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         submodules: true
         fetch-depth: 0
         token: ${{ steps.app-token.outputs.token }}
     - name: Set up Python ${{ needs.set-versions.outputs.max }}
-      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       # This is deliberately not using a custom credential as it relies on native github actions token to have push rights.
       with:
         python-version: ${{ needs.set-versions.outputs.max }}
@@ -86,6 +86,8 @@ jobs:
         ID: ${{ steps.get-user-id.outputs.user-id }}
     - name: Create release
       shell: bash
+      env:
+        NO_MKDOCS_2_WARNING: '1'
       run: |
         mike deploy --push ${{ needs.mike-version.outputs.mver }}
     - name: Ensure latest is latest