chore: Release

.github/actions/snyk-test/action.yaml

@@ -0,0 +1,37 @@
+name: 'Run Snyk Test'
+description: 'Run tests with synk test'
+
+inputs:
+  token:
+    description: 'Snyk Token'
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - uses: snyk/actions/setup@cdb760004ba9ea4d525f2e043745dfe85bb9077e
+
+    - name: Set environment variable
+      run: echo "PATH=${PATH}:/root/.local/bin" >> $GITHUB_ENV
+      shell: bash
+
+    - name: Run Snyk Test
+      env:
+        SNYK_TOKEN: ${{ inputs.token }}
+      run: |
+        echo "::group::Running synk test ..."
+        pipx install pip-tools
+        python -m venv venv-test
+        source ./venv-test/bin/activate
+        pip-compile pyproject.toml -o requirements.txt
+        pip install -r requirements.txt
+        snyk test --file=requirements.txt
+        echo "::endgroup::"
+      shell: bash
+
+    - name: Cleanup
+      if: success() || failure()
+      run: |
+        rm requirements.txt
+        rm -rf ./venv-test
+      shell: bash

.github/workflows/actionlint.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Add problem matcher
         run: echo "::add-matcher::.github/actionlint-matcher.json"
       - name: Check workflow files

.github/workflows/codeql-analysis.yml

@@ -59,11 +59,11 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13
+      uses: github/codeql-action/init@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3.30.1
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -91,6 +91,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13
+      uses: github/codeql-action/analyze@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3.30.1
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/conventional-pr.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
     - name: Install dependencies
       run: npm install @commitlint/cli @commitlint/config-conventional

.github/workflows/docs-update.yml

@@ -15,7 +15,7 @@ jobs:
       min: ${{ steps.versions.outputs.min }}
       max: ${{ steps.versions.outputs.max }}
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - id: versions
       run: |
         min_version=$(jq '.PYTHON_MIN' -r version.json)
@@ -30,7 +30,7 @@ jobs:
     outputs:
       mver: ${{ steps.versions.outputs.mver }}
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - name: Set up Python ${{ needs.set-versions.outputs.max }}
       uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       # This is deliberately not using a custom credential as it relies on native github actions token to have push rights.
@@ -46,12 +46,12 @@ jobs:
     runs-on: ubuntu-latest
     needs: [ mike-version, set-versions ]
     steps:
-    - uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
+    - uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2.1.1
       id: app-token
       with:
         app-id: ${{ secrets.APP_ID }}
         private-key: ${{ secrets.PRIVATE_KEY }}
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         submodules: true
         fetch-depth: 0

.github/workflows/python-push.yml

@@ -18,7 +18,7 @@ jobs:
       min: ${{ steps.versions.outputs.min }}
       max: ${{ steps.versions.outputs.max }}
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - id: versions
       run: |
         min_version=$(jq '.PYTHON_MIN' -r version.json)
@@ -46,14 +46,14 @@ jobs:
     - name: Don't mess with  line endings
       run: |
         git config --global core.autocrlf false
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         submodules: true
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: ${{ matrix.python-version }}
-    - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+    - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
       with:
         path: ${{ matrix.path }}
         key: ${{ matrix.os }}-${{ matrix.python-version }}-pip-${{ hashFiles('setup.cfg') }}
@@ -116,12 +116,12 @@ jobs:
       url: https://pypi.org/p/compliance-trestle
     if: github.ref == 'refs/heads/main' && github.repository == 'oscal-compass/compliance-trestle'
     steps:
-    - uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
+    - uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2.1.1
       id: app-token
       with:
         app-id: ${{ secrets.APP_ID }}
         private-key: ${{ secrets.PRIVATE_KEY }}
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         submodules: true
         fetch-depth: 0
@@ -137,12 +137,12 @@ jobs:
     # This action uses Python Semantic Release v8
     - name: Python Semantic Release
       id: release
-      uses: python-semantic-release/python-semantic-release@fe6b271e942115b528c85e42bc19611b01dcea59 # v9.8.8
+      uses: python-semantic-release/python-semantic-release@5b9d941d5b29da138b933660ce1a9df75b54ce25 # v10.3.1
       with:
         github_token: ${{ steps.app-token.outputs.token }}
 
     - name: Publish package distributions to PyPI
-      uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # release/v1
+      uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
       # NOTE: DO NOT wrap the conditional in ${{ }} as it will always evaluate to true.
       # See https://github.com/actions/runner/issues/1173
       if: steps.release.outputs.released == 'true'
@@ -162,12 +162,12 @@ jobs:
       cancel-in-progress: true
     if: github.ref == 'refs/heads/main'
     steps:
-    - uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
+    - uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2.1.1
       id: app-token
       with:
         app-id: ${{ secrets.APP_ID }}
         private-key: ${{ secrets.PRIVATE_KEY }}
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         submodules: true
         ref: main

.github/workflows/python-test.yml

@@ -13,7 +13,7 @@ jobs:
       min: ${{ steps.versions.outputs.min }}
       max: ${{ steps.versions.outputs.max }}
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - id: versions
       run: |
         min_version=$(jq '.PYTHON_MIN' -r version.json)
@@ -27,14 +27,14 @@ jobs:
     - name: Don't mess with line endings
       run: |
         git config --global core.autocrlf false
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         submodules: true
     - name: Set up Python
       uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: ${{ needs.set-versions.outputs.max }}
-    - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+    - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
       with:
         path: ~/.cache/pip
         key: ubuntu-latest-${{ needs.set-versions.outputs.max }}-pip-${{ hashFiles('setup.cfg') }}
@@ -84,14 +84,14 @@ jobs:
     - name: Don't mess with line endings
       run: |
         git config --global core.autocrlf false
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         submodules: true
     - name: Set up Python
       uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: ${{ needs.set-versions.outputs.max }}
-    - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+    - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
       with:
         path: ~/.cache/pip
         key: ubuntu-latest-${{ needs.set-versions.outputs.max }}-pip-${{ hashFiles('setup.cfg') }}
@@ -123,15 +123,15 @@ jobs:
     - name: Don't mess with line endings
       run: |
         git config --global core.autocrlf false
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         fetch-depth: 0
         submodules: true
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: ${{ matrix.python-version }}
-    - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+    - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
       with:
         path: ${{ matrix.path }}
         key: ${{ matrix.os }}-${{ matrix.python-version }}-pip-${{ hashFiles('setup.cfg') }}
@@ -170,14 +170,14 @@ jobs:
     - name: Don't mess with line endings
       run: |
         git config --global core.autocrlf false
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         submodules: true
     - name: Set up Python
       uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: ${{ needs.set-versions.outputs.max }}
-    - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+    - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
       with:
         path: ~/.cache/pip
         key: ubuntu-latest-${{ needs.set-versions.outputs.max }}-pip-${{ hashFiles('setup.cfg') }}
@@ -187,11 +187,11 @@ jobs:
       run: |
         make develop
     - name: Get coverage
-      uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
       with:
         name: coverage
     - name: SonarCloud Scan
-      uses: SonarSource/sonarcloud-github-action@b42848bfdabac7fefc656c08af7a7864240124a3 # master
+      uses: SonarSource/sonarcloud-github-action@ba3875ecf642b2129de2b589510c81a8b53dbf4e # master
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
         SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
@@ -211,3 +211,31 @@ jobs:
       timeout-minutes: 5
       env:
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+
+  snyk:
+    if: ${{ (github.event.pull_request.base.repo.url == github.event.pull_request.head.repo.url && github.triggering_actor != 'dependabot[bot]' ) }}
+    runs-on: ubuntu-latest
+    needs: [ set-versions ]
+    steps:
+      - name: Don't mess with line endings
+        run: |
+          git config --global core.autocrlf false
+      - name: Don't mess with line endings
+        run: |
+          git config --global core.autocrlf false
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          submodules: true
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: ${{ needs.set-versions.outputs.max }}
+      - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        with:
+          path: ~/.cache/pip
+          key: ubuntu-latest-${{ needs.set-versions.outputs.max }}-pip-${{ hashFiles('setup.cfg') }}
+          restore-keys: |
+            ubuntu-latest-${{ needs.set-versions.outputs.max }}-pip-
+      - uses: ./.github/actions/snyk-test
+        with:
+          token: ${{ secrets.SNYK_TOKEN }}

.github/workflows/scorecard.yml

@@ -20,12 +20,12 @@ jobs:
 
     steps:
       - name: "Checkout Code"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
 
       - name: "Run Analysis"
-        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
+        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
         with:
           results_file: results.sarif
           results_format: sarif

.github/workflows/stale.yml

@@ -17,7 +17,7 @@ jobs:
         STALE_WARNING_DAYS: 90
         STALE_CLOSURE_DAYS: 30
     steps:
-    - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9
+    - uses: actions/stale@3a9db7e6a41a89f618792c92c0e97cc736e1b13f # v9
       with:
         stale-issue-label: stale
         exempt-issue-labels: good-first-issue, help-wanted, exempt-from-stale

.snyk

@@ -0,0 +1,20 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.25.1
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  'snyk:lic:pip:certifi:MPL-2.0':
+    - '*':
+        reason: 'Pending submitted exception to the CNCF GB #1091'
+        expires: 2025-12-11T14:24:35.014Z
+        created: 2025-08-12T14:24:35.017Z
+  'snyk:lic:pip:pathspec:MPL-2.0':
+    - '*':
+        reason: 'Pending submitted exception to the CNCF GB #1090'
+        expires: 2025-12-11T14:30:53.420Z
+        created: 2025-08-12T14:30:53.423Z
+  'snyk:lic:pip:paramiko:LGPL-2.1':
+    - '*':
+        reason: 'Pending submitted exception to the CNCF GB #1108'
+        expires: 2025-12-11T14:30:53.420Z
+        created: 2025-08-12T14:33:58.233Z
+patch: {}

CONTRIBUTING.md

@@ -243,8 +243,8 @@ This is a general guide on how to go about upgrading compliance-trestle to suppo
 The steps are as follows:
 
 <ol>
-<li> Create  in GitHub repo <i style="color:darkgrey;">(remote)</i>
-<li> Clone upgrade branch into <span style="color:darkgreen;">/trestle-upgrade</span> folder <i style="color:darkgrey;">(local <- remote)</i>
+<li> Create feat/trestle-upgrade branch in GitHub repo <i style="color:darkgrey;">(remote)</i>
+<li> Clone feat/trestle-upgrade branch into <span style="color:darkgreen;">/trestle-upgrade</span> folder <i style="color:darkgrey;">(local <- remote)</i>
 <li> Download revised and new OSCAL models into folder <span style="color:darkgreen;">/trestle-upgrade/release-schemas</span> <i style="color:darkgrey;">(local <- remote)</i>
 <ul>
 <li> See <a href="https://github.com/usnistgov/OSCAL/releases">https://github.com/usnistgov/OSCAL/releases</a>

mkdocs.yml

@@ -39,6 +39,10 @@ plugins:
       # This is to remove some false positives for links which work.
       # Anchors are validated again by core mkdocs
       404: [ '*#trestle.*' ]
+    # These URLs work from the browser but fail when accesssed via htmlproofer:
+    ignore_urls:
+        - 'https://www.fedramp.gov/documents-templates/'
+        - 'https://www.cncf.io/wp-content/uploads/2022/07/cncf-color-bg.svg'
 - mkdocstrings:
     default_handler: python
     handlers:

pyproject.toml

@@ -35,13 +35,13 @@ requires-python = ">=3.9"
 dependencies = [
     "attrs",
     "ilcli",
-    "cryptography==44.0.2",
-    "paramiko==3.5.0",
+    "cryptography==45.0.7",
+    "paramiko==4.0.0",
     "ruamel.yaml",
     "furl",
     "pydantic[email]>=2.0.0",
     "python-dotenv>=0.10.4",
-    "datamodel-code-generator[http] == 0.25.3",
+    "datamodel-code-generator[http] == 0.33.0",
     "python-frontmatter",
     "pywin32 >= 1.0;platform_system=='Windows'",
     "defusedxml",
@@ -60,7 +60,7 @@ dev = [
     "pytest-xdist",
     "pre-commit>=2.4.0",
     "setuptools>=61",
-    "urllib3==1.26.19",
+    "urllib3==2.5.0",
     "wheel",
     "yapf",
     "python-semantic-release>=9.8.0",