ComplianceAsCode / ComplianceAsCode/content
OSCAL Import/Update Job fails with OSCAL 1.1.1 content
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Description of problem:
##### Background
As described in the comment on https://github.com/ComplianceAsCode/content/pull/11286, the `compliance-trestle` tool does not yet support OSCAL 1.1.1. OSCAL 1.1.1 support is on the `compliance-trestle` [roadmap](https://github.com/oscal-compass/compliance-trestle/issues/1480). The NIST catalog reference was pinned to a commit until the newest content can be imported and continue to allow FedRAMP profile updates to be imported. The most recent commit on https://github.com/GSA/fedramp-automation/commit/6518de14df4552821ad17cc93f5eeaec4b46716b updates the FedRAMP Rev5 content to OSCAL v1.1.1 making it incompatible with `compliance-trestle` which is used in this job.
##### Possible Solutions (Short term)
- Add a comment to explain the failure. The FedRAMP Rev4 content is still supported.
- Temporarily remove the schedule trigger and add a comment.
#### SCAP Security Guide Version:
https://github.com/ComplianceAsCode/content/commit/45ab494e782a41144af256c54093a18dd10b89a5
#### Operating System Version:
`ubuntu-latest` - GitHub Action
#### Steps to Reproduce:
1. Let the job run or run the job manually
2. Observe the failure for the FedRAMP Rev 5 content only
#### Actual Results:
Job Failed with error `trestle.core.commands.import_:94 ERROR: Error while importing OSCAL file: OSCAL version: 1.1.1 is not supported, use 1.0.4 instead.`
#### Expected Results:
Job Passed
#### Additional Information/Debugging Steps:
https://github.com/ComplianceAsCode/content/actions/runs/7436163149
Contributor guide
Assessment
This issue has not been assessed yet.