Source Code and Artifact Directory Restructure

.github/workflows/content-artifacts.yml

@@ -12,8 +12,8 @@ on:
       - master
 name: Process Content
 env:
-  OSCAL_DIR_PATH: oscal
-  CICD_DIR_PATH: oscal/build/ci-cd
+  OSCAL_DIR_PATH: vendor/oscal
+  CICD_DIR_PATH: vendor/oscal/build/ci-cd
   CONTENT_CONFIG_PATH: src/config
   SAXON_VERSION: 9.9.0-1
   HOME_REPO: GSA/fedramp-automation
@@ -26,6 +26,10 @@ jobs:
         with:
           path: git-content
           submodules: recursive
+          # Only update `fetch-depth` for debugging on branches.
+          # If not, this action cannot see other branches for names for the PR to push back changes.
+          # So, on PR branches without this, you will have errors.
+          # fetch-depth: 0
       # job-validate-content
       - name: Update APT package metadata
         run: |
@@ -56,10 +60,11 @@ jobs:
       # job-copy-and-convert-content
       - name: Auto-convert Content
         run:
-          bash "${GITHUB_WORKSPACE}/git-content/${CICD_DIR_PATH}/copy-and-convert-content.sh" -v -o "${GITHUB_WORKSPACE}/git-content/${OSCAL_DIR_PATH}" -a "${GITHUB_WORKSPACE}/git-content" -c "${GITHUB_WORKSPACE}/git-content/${CONTENT_CONFIG_PATH}" -w "${GITHUB_WORKSPACE}/git-content" --resolve-profiles
+          bash "${GITHUB_WORKSPACE}/git-content/${CICD_DIR_PATH}/copy-and-convert-content.sh" -v -o "${GITHUB_WORKSPACE}/git-content/${OSCAL_DIR_PATH}" -a "${GITHUB_WORKSPACE}/git-content" -c "${GITHUB_WORKSPACE}/git-content/${CONTENT_CONFIG_PATH}" -w "${GITHUB_WORKSPACE}/git-content/dist" --resolve-profiles
       # job-deploy-artifacts
       - name: Setup SSH key
         # only do this on master
+        # Comment the below `if` conditional if you need to debug this on PR branches.
         if: github.repository == env.HOME_REPO && github.ref == 'refs/heads/master'
         run: |
           eval "$(ssh-agent -s)"

.github/workflows/xspecRunner.yml

@@ -34,10 +34,10 @@ jobs:
       - name: Run XSpec
         run: |
           echo "Running XSpec"
-          cd $GITHUB_WORKSPACE/resources/validations
+          cd $GITHUB_WORKSPACE/src/validations
           export SAXON_CP=/tmp/saxon/Saxon-HE-10.2.jar
           export TEST_DIR=$(pwd)/report/test
-          lib/xspec/bin/xspec.sh -s -j test/test_all.xspec
+          $GITHUB_WORKSPACE/vendor/xspec/bin/xspec.sh -s -j test/test_all.xspec
 
       # Sets the test report path for visibility
       - name: Publish XSpec Test Results
@@ -62,6 +62,6 @@ jobs:
         with:
           name: fedramp-automation-validation-unit-tests-${{ github.sha }}
           path: |
-            ./resources/validations/report/schematron/**/*.*
-            ./resources/validations/report/test/**/*.*
+            ./src/validations/report/schematron/**/*.*
+            ./src/validations/report/test/**/*.*
           if-no-files-found: error

.gitignore

@@ -4,10 +4,10 @@ _site
 *.DS_Store
 documents/source
 NOTES.md
-resources/validations/lib/**.jar
-resources/validations/report
-resources/validations/src/ssp.xsl
-resources/validations/target
-resources/validations/test/xspec/*
-resources/validations/ui/coverage/
+src/validations/lib/**.jar
+src/validations/report
+src/validations/src/ssp.xsl
+src/validations/target
+src/validations/test/*
+src/validations/ui/coverage/
 utils

.gitmodules

@@ -1,17 +1,17 @@
 [submodule "oscal"]
-	path = oscal
+	path = vendor/oscal
 	url = https://github.com/usnistgov/OSCAL.git
 	branch = main
 	ignore = dirty
 
 [submodule "resources/validations/lib/xspec"]
-	path = resources/validations/lib/xspec
+	path = vendor/xspec
 	url = https://github.com/xspec/xspec.git
 	branch = master
 	ignore = dirty
 
 [submodule "resources/validations/src/schematron"]
-	path = resources/validations/lib/schematron
+	path = vendor/schematron
 	url = https://github.com/schematron/schematron.git
 	branch = master
 	ignore = dirty

baselines/rev4/json/FedRAMP_rev4_HIGH-baseline-resolved-profile_catalog.json → dist/content/baselines/rev4/json/FedRAMP_rev4_HIGH-baseline-resolved-profile_catalog.json

@@ -1,10 +1,10 @@
 {
   "catalog": {
-    "uuid": "537be948-a9f2-46fe-bca8-da20e761127e",
+    "uuid": "120c5adf-9c91-4bec-9dae-2294d201c596",
     "metadata": {
       "title": "FedRAMP Rev 4 High Baseline",
       "published": "2021-02-05T00:00:00.000-04:00",
-      "last-modified": "2021-07-13T15:41:45.243631Z",
+      "last-modified": "2021-07-19T15:08:10.553924Z",
       "version": "fedramp1.0.0-oscal1.0.0",
       "oscal-version": "1.0.0",
       "links": [

baselines/rev4/json/FedRAMP_rev4_LI-SaaS-baseline-resolved-profile_catalog.json → dist/content/baselines/rev4/json/FedRAMP_rev4_LI-SaaS-baseline-resolved-profile_catalog.json

@@ -1,10 +1,10 @@
 {
   "catalog": {
-    "uuid": "e3c607be-265d-4136-a90e-fa7079c3432b",
+    "uuid": "ad675854-2bfe-47cf-acbd-f8b73c0f2164",
     "metadata": {
       "title": "FedRAMP Rev 4 Tailored Low Impact Software as a Service (LI-SaaS) Baseline",
       "published": "2021-02-17T00:00:00.000-04:00",
-      "last-modified": "2021-07-13T15:41:59.131135Z",
+      "last-modified": "2021-07-19T15:08:24.847963Z",
       "version": "fedramp1.0.0-oscal1.0.0",
       "oscal-version": "1.0.0",
       "links": [

baselines/rev4/json/FedRAMP_rev4_LOW-baseline-resolved-profile_catalog.json → dist/content/baselines/rev4/json/FedRAMP_rev4_LOW-baseline-resolved-profile_catalog.json

@@ -1,10 +1,10 @@
 {
   "catalog": {
-    "uuid": "639c44a7-7907-4f6e-bc7e-216f04c4468c",
+    "uuid": "88d14d88-c5c5-4168-88e5-9f7eb4d9fecf",
     "metadata": {
       "title": "FedRAMP Rev 4 Low Baseline",
       "published": "2021-02-05T00:00:00.000-04:00",
-      "last-modified": "2021-07-13T15:42:09.48829Z",
+      "last-modified": "2021-07-19T15:08:35.288666Z",
       "version": "fedramp1.0.0-oscal1.0.0",
       "oscal-version": "1.0.0",
       "links": [

baselines/rev4/json/FedRAMP_rev4_MODERATE-baseline-resolved-profile_catalog.json → dist/content/baselines/rev4/json/FedRAMP_rev4_MODERATE-baseline-resolved-profile_catalog.json

@@ -1,10 +1,10 @@
 {
   "catalog": {
-    "uuid": "70383d81-010f-4ede-8f54-2279e5e7f2e3",
+    "uuid": "8c65d6c4-aa1c-45c9-b387-f1c5ec14dcc2",
     "metadata": {
       "title": "FedRAMP Rev 4 Moderate Baseline",
       "published": "2021-02-05T00:00:00.000-04:00",
-      "last-modified": "2021-07-13T15:42:20.893597Z",
+      "last-modified": "2021-07-19T15:08:47.235378Z",
       "version": "fedramp1.0.0-oscal1.0.0",
       "oscal-version": "1.0.0",
       "links": [

baselines/rev4/xml/FedRAMP_rev4_HIGH-baseline-resolved-profile_catalog.xml → dist/content/baselines/rev4/xml/FedRAMP_rev4_HIGH-baseline-resolved-profile_catalog.xml

@@ -1,10 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <catalog xmlns="http://csrc.nist.gov/ns/oscal/1.0"
-         uuid="537be948-a9f2-46fe-bca8-da20e761127e">
+         uuid="120c5adf-9c91-4bec-9dae-2294d201c596">
    <metadata>
       <title>FedRAMP Rev 4 High Baseline</title>
       <published>2021-02-05T00:00:00.000-04:00</published>
-      <last-modified>2021-07-13T15:41:45.243631Z</last-modified>
+      <last-modified>2021-07-19T15:08:10.553924Z</last-modified>
       <version>fedramp1.0.0-oscal1.0.0</version>
       <oscal-version>1.0.0</oscal-version>
       <link rel="resolution-source" href="FedRAMP_rev4_HIGH-baseline_profile.xml"/>

baselines/rev4/xml/FedRAMP_rev4_LI-SaaS-baseline-resolved-profile_catalog.xml → dist/content/baselines/rev4/xml/FedRAMP_rev4_LI-SaaS-baseline-resolved-profile_catalog.xml

@@ -1,10 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <catalog xmlns="http://csrc.nist.gov/ns/oscal/1.0"
-         uuid="e3c607be-265d-4136-a90e-fa7079c3432b">
+         uuid="ad675854-2bfe-47cf-acbd-f8b73c0f2164">
    <metadata>
       <title>FedRAMP Rev 4 Tailored Low Impact Software as a Service (LI-SaaS) Baseline</title>
       <published>2021-02-17T00:00:00.000-04:00</published>
-      <last-modified>2021-07-13T15:41:59.131135Z</last-modified>
+      <last-modified>2021-07-19T15:08:24.847963Z</last-modified>
       <version>fedramp1.0.0-oscal1.0.0</version>
       <oscal-version>1.0.0</oscal-version>
       <link rel="resolution-source"

baselines/rev4/xml/FedRAMP_rev4_LOW-baseline-resolved-profile_catalog.xml → dist/content/baselines/rev4/xml/FedRAMP_rev4_LOW-baseline-resolved-profile_catalog.xml

@@ -1,10 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <catalog xmlns="http://csrc.nist.gov/ns/oscal/1.0"
-         uuid="639c44a7-7907-4f6e-bc7e-216f04c4468c">
+         uuid="88d14d88-c5c5-4168-88e5-9f7eb4d9fecf">
    <metadata>
       <title>FedRAMP Rev 4 Low Baseline</title>
       <published>2021-02-05T00:00:00.000-04:00</published>
-      <last-modified>2021-07-13T15:42:09.48829Z</last-modified>
+      <last-modified>2021-07-19T15:08:35.288666Z</last-modified>
       <version>fedramp1.0.0-oscal1.0.0</version>
       <oscal-version>1.0.0</oscal-version>
       <link rel="resolution-source" href="FedRAMP_rev4_LOW-baseline_profile.xml"/>

baselines/rev4/xml/FedRAMP_rev4_MODERATE-baseline-resolved-profile_catalog.xml → dist/content/baselines/rev4/xml/FedRAMP_rev4_MODERATE-baseline-resolved-profile_catalog.xml

@@ -1,10 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <catalog xmlns="http://csrc.nist.gov/ns/oscal/1.0"
-         uuid="70383d81-010f-4ede-8f54-2279e5e7f2e3">
+         uuid="8c65d6c4-aa1c-45c9-b387-f1c5ec14dcc2">
    <metadata>
       <title>FedRAMP Rev 4 Moderate Baseline</title>
       <published>2021-02-05T00:00:00.000-04:00</published>
-      <last-modified>2021-07-13T15:42:20.893597Z</last-modified>
+      <last-modified>2021-07-19T15:08:47.235378Z</last-modified>
       <version>fedramp1.0.0-oscal1.0.0</version>
       <oscal-version>1.0.0</oscal-version>
       <link rel="resolution-source"

baselines/rev4/yaml/FedRAMP_rev4_HIGH-baseline-resolved-profile_catalog.yaml → dist/content/baselines/rev4/yaml/FedRAMP_rev4_HIGH-baseline-resolved-profile_catalog.yaml

@@ -1,10 +1,10 @@
 ---
 catalog:
-  uuid: 537be948-a9f2-46fe-bca8-da20e761127e
+  uuid: 120c5adf-9c91-4bec-9dae-2294d201c596
   metadata:
     title: FedRAMP Rev 4 High Baseline
     published: 2021-02-05T00:00:00.000-04:00
-    last-modified: 2021-07-13T15:41:45.243631Z
+    last-modified: 2021-07-19T15:08:10.553924Z
     version: fedramp1.0.0-oscal1.0.0
     oscal-version: 1.0.0
     links:

baselines/rev4/yaml/FedRAMP_rev4_LI-SaaS-baseline-resolved-profile_catalog.yaml → dist/content/baselines/rev4/yaml/FedRAMP_rev4_LI-SaaS-baseline-resolved-profile_catalog.yaml

@@ -1,10 +1,10 @@
 ---
 catalog:
-  uuid: e3c607be-265d-4136-a90e-fa7079c3432b
+  uuid: ad675854-2bfe-47cf-acbd-f8b73c0f2164
   metadata:
     title: FedRAMP Rev 4 Tailored Low Impact Software as a Service (LI-SaaS) Baseline
     published: 2021-02-17T00:00:00.000-04:00
-    last-modified: 2021-07-13T15:41:59.131135Z
+    last-modified: 2021-07-19T15:08:24.847963Z
     version: fedramp1.0.0-oscal1.0.0
     oscal-version: 1.0.0
     links:

baselines/rev4/yaml/FedRAMP_rev4_LOW-baseline-resolved-profile_catalog.yaml → dist/content/baselines/rev4/yaml/FedRAMP_rev4_LOW-baseline-resolved-profile_catalog.yaml

@@ -1,10 +1,10 @@
 ---
 catalog:
-  uuid: 639c44a7-7907-4f6e-bc7e-216f04c4468c
+  uuid: 88d14d88-c5c5-4168-88e5-9f7eb4d9fecf
   metadata:
     title: FedRAMP Rev 4 Low Baseline
     published: 2021-02-05T00:00:00.000-04:00
-    last-modified: 2021-07-13T15:42:09.48829Z
+    last-modified: 2021-07-19T15:08:35.288666Z
     version: fedramp1.0.0-oscal1.0.0
     oscal-version: 1.0.0
     links:

baselines/rev4/yaml/FedRAMP_rev4_MODERATE-baseline-resolved-profile_catalog.yaml → dist/content/baselines/rev4/yaml/FedRAMP_rev4_MODERATE-baseline-resolved-profile_catalog.yaml

@@ -1,10 +1,10 @@
 ---
 catalog:
-  uuid: 70383d81-010f-4ede-8f54-2279e5e7f2e3
+  uuid: 8c65d6c4-aa1c-45c9-b387-f1c5ec14dcc2
   metadata:
     title: FedRAMP Rev 4 Moderate Baseline
     published: 2021-02-05T00:00:00.000-04:00
-    last-modified: 2021-07-13T15:42:20.893597Z
+    last-modified: 2021-07-19T15:08:47.235378Z
     version: fedramp1.0.0-oscal1.0.0
     oscal-version: 1.0.0
     links:

package.json

@@ -4,8 +4,8 @@
   "author": "",
   "license": "CC0-1.0",
   "scripts": {
-    "link:validation-ui": "ln -sf ./resources/validations/ui/build _site",
-    "build:validation-ui": "cd resources/validations/ui && npm install && npm run build && cd ../../..",
+    "link:validation-ui": "ln -sf ./src/web/build _site",
+    "build:validation-ui": "cd src/web && npm install && npm run build && cd ../..",
     "federalist": "npm run build:validation-ui && npm run link:validation-ui"
   }
 }

src/config

@@ -1,6 +1,6 @@
 # path to source|format of source|model of source|format(s) to convert to
-src/templates/ssp/xml/FedRAMP-SSP-OSCAL-Template.xml|xml|ssp|json
-src/templates/sap/xml/FedRAMP-SAP-OSCAL-Template.xml|xml|assessment-plan|json
-src/templates/sar/xml/FedRAMP-SAR-OSCAL-Template.xml|xml|assessment-results|json
-src/templates/poam/xml/FedRAMP-POAM-OSCAL-Template.xml|xml|poam|json
-src/baselines/rev4/xml/*profile.xml|xml|profile|json
+src/content/templates/ssp/xml/FedRAMP-SSP-OSCAL-Template.xml|xml|ssp|json
+src/content/templates/sap/xml/FedRAMP-SAP-OSCAL-Template.xml|xml|assessment-plan|json
+src/content/templates/sar/xml/FedRAMP-SAR-OSCAL-Template.xml|xml|assessment-results|json
+src/content/templates/poam/xml/FedRAMP-POAM-OSCAL-Template.xml|xml|poam|json
+src/content/baselines/rev4/xml/*profile.xml|xml|profile|json

resources/validations/CONTRIBUTING.md → src/validations/CONTRIBUTING.md

@@ -2,7 +2,7 @@ Project Structure
 ---
 All directory references are local to the `fedramp-automation/resources/validations`
 
-`src` for the sch files
+`rules` for the sch files
 
 `lib` for toolchain dependencies (e.g. Schematron)
 

resources/validations/README.md → src/validations/README.md

@@ -17,7 +17,7 @@ At this time, FedRAMP is primarily focused on standardizing and extending the co
 
 For any error, the error message will be prefix with the section name and the check ID. For example, `[Section C Check 3.1a]` will be proceed the detailed explanation text. This validation suite does provide summary reporting information. As these are not errors in the report, if provided to help a reviewer, they will _not_ contain a section name and check ID.
 
-This format will allow for reviewers to collaborate and communicate improvements with the development team. Therefore, you can direct the development team to the `@organizational-id` in [the validation suite source code](https://github.com/18F/fedramp-automation/blob/master/resources/validations/src/ssp.sch) that maps to these check IDs.
+This format will allow for reviewers to collaborate and communicate improvements with the development team. Therefore, you can direct the development team to the `@organizational-id` in [the validation suite source code](https://github.com/18F/fedramp-automation/blob/master/resources/validations/rules/ssp.sch) that maps to these check IDs.
 ### Section B: Documents Provided Check
 
 - [ ]  1.0	 Initial Authorization Package Checklist

resources/validations/bin/format_xml.sh → src/validations/bin/format_xml.sh

@@ -3,5 +3,5 @@
 tidy \
     -config .tidyrc \
     -modify \
-    ./src/*.sch \
+    ./rules/*.sch \
     ./test/*.xspec

resources/validations/bin/validate_with_schematron.sh → src/validations/bin/validate_with_schematron.sh

@@ -19,8 +19,8 @@ usage() {
 
 # output root defaults to report folder relative to this script
 OUTPUT_ROOT="report/schematron"
-# schematron directory validate the file with each .sch found defaults to src/*.sch relative to this script
-SCHEMA_LOCATION_DIR="src"
+# schematron directory validate the file with each .sch found defaults to rules/*.sch relative to this script
+SCHEMA_LOCATION_DIR="rules"
 # whether or not to compile Schematron to XSLT (if false, will reuse previously-compiled XSLT)
 PREPROCESS_PIPELINE=true
 
@@ -108,7 +108,7 @@ elif command -v mvn &> /dev/null ;then
         -Dversion="${SAXON_VERSION}"
     SAXON_CP=~/.m2/repository/net/sf/${saxonLocation}
 elif command -v curl &> /dev/null; then
-    SAXON_CP="${BASE_DIR}"/lib/Saxon-HE-"${SAXON_VERSION}".jar
+    SAXON_CP="${BASE_DIR}"/../../vendor/Saxon-HE-"${SAXON_VERSION}".jar
     curl -H "Accept: application/zip" -o "${SAXON_CP}" https://repo1.maven.org/maven2/net/sf/"${saxonLocation}" &> /dev/null
 else
     echo "SAXON_CP environment variable is not set. mvn or curl is required to download dependencies, neither found, please install one and retry"
@@ -150,15 +150,15 @@ for qualifiedSchematronName in "${SCHEMA_LOCATION_DIR}"/*.sch; do
         java -cp "${SAXON_CP}" net.sf.saxon.Transform \
             -o:"${BASE_DIR}"/target/"${schematronRoot}-stage1.sch" \
             -s:"${qualifiedSchematronName}" \
-            "${BASE_DIR}"/lib/schematron/trunk/schematron/code/iso_dsdl_include.xsl \
+            "${BASE_DIR}"/../../vendor/schematron/trunk/schematron/code/iso_dsdl_include.xsl \
             $SAXON_OPTS
 
         # Step 2
         echo "preprocessing stage 2: ${BASE_DIR}/target/${schematronRoot}-stage1.sch to: ${BASE_DIR}/target/${schematronRoot}-stage2.sch"
         java -cp "${SAXON_CP}" net.sf.saxon.Transform \
             -o:"${BASE_DIR}"/target/"${schematronRoot}-stage2.sch" \
             -s:"${BASE_DIR}"/target/"${schematronRoot}-stage1.sch" \
-            "${BASE_DIR}"/lib/schematron/trunk/schematron/code/iso_abstract_expand.xsl \
+            "${BASE_DIR}"/../../vendor/schematron/trunk/schematron/code/iso_abstract_expand.xsl \
             $SAXON_OPTS
 
         # Use Saxon XSL transform to convert our Schematron to pure XSL 2.0 stylesheet
@@ -167,7 +167,7 @@ for qualifiedSchematronName in "${SCHEMA_LOCATION_DIR}"/*.sch; do
         java -cp "${SAXON_CP}" net.sf.saxon.Transform \
             -o:"${BASE_DIR}"/target/"${schematronRoot}".xsl \
             -s:"${BASE_DIR}"/target/"${schematronRoot}-stage2.sch" \
-            "${BASE_DIR}"/lib/schematron/trunk/schematron/code/iso_svrl_for_xslt2.xsl \
+            "${BASE_DIR}"/../../vendor/schematron/trunk/schematron/code/iso_svrl_for_xslt2.xsl \
             $SAXON_OPTS
     fi
 
@@ -192,7 +192,7 @@ for qualifiedSchematronName in "${SCHEMA_LOCATION_DIR}"/*.sch; do
         java -cp "${SAXON_CP}" net.sf.saxon.Transform \
             -o:"${htmlReportName}" \
             -s:"${reportName}"  \
-            "${BASE_DIR}"/lib/svrl2html.xsl \
+            "${BASE_DIR}"/../../vendor/svrl2html.xsl \
             $SAXON_OPTS
     fi
 done

resources/validations/src/ssp.sch → src/validations/rules/ssp.sch

@@ -21,10 +21,10 @@
                 method="xml" />
     <xsl:param as="xs:string"
                name="registry-base-path"
-               select="'../../xml'" />
+               select="'../../content/resources/xml'" />
     <xsl:param as="xs:string"
                name="baselines-base-path"
-               select="'../../../baselines/rev4/xml'" />
+               select="'../../../dist/content/baselines/rev4/xml'" />
     <sch:let name="registry"
              value="doc(concat($registry-base-path, '/fedramp_values.xml')) | doc(concat($registry-base-path, '/fedramp_threats.xml')) | doc(concat($registry-base-path, '/information-types.xml'))" />
     <!--xsl:variable name="registry">

resources/validations/test/ssp.xspec → src/validations/test/ssp.xspec

@@ -1,4 +1,4 @@
-<x:description schematron="../src/ssp.sch"
+<x:description schematron="../rules/ssp.sch"
                xmlns:f="https://fedramp.gov/ns/oscal"
                xmlns:lv="local-validations"
                xmlns:o="http://csrc.nist.gov/ns/oscal/1.0"

resources/validations/test/test_all.xspec → src/validations/test/test_all.xspec

@@ -1,4 +1,4 @@
-<x:description schematron="../src/ssp.sch"
+<x:description schematron="../rules/ssp.sch"
                xmlns:x="http://www.jenitennison.com/xslt/xspec">
     <x:import href="ssp.xspec" />
 </x:description>