build: fix CI infrastructure (Trivy action bump + FedRAMP test URL)

[david-waltermire]

Summary

Two CI infrastructure fixes that together unblock all PR builds:

1. Bump aquasecurity/trivy-action from v0.33.1 to v0.35.0 — The v0.33.1 pinned version's Trivy install step has been failing in CI since 2026-02-10 (exit code 1 immediately after fetching the Trivy binary), blocking every PR regardless of code content.
2. Update FedRAMP profile URL in OscalValidationTest.testValidateOscalProfileXml — The GSA/fedramp-automation repository is no longer publicly accessible, causing the test to fail with FileNotFound on every CI run. Point it at the equivalent profile in OSCAL-Foundation/fedramp-automation (rev5 MODERATE baseline), the current home for FedRAMP automation work.

Test plan

• CI "Build and Test Code" step completes successfully (FedRAMP test passes)
• CI "Run Trivy security scanner" step completes successfully
• SARIF results file is generated and uploaded

Summary by CodeRabbit

• Chores

  • Updated the CI security scanning configuration to use a different pinned version of the scanner, ensuring alignment with a newer scanner release.

• Tests

  • Adjusted a validation test to target an updated OSCAL FedRAMP profile, keeping the test's assertions and validation flow unchanged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c0378959-3473-4353-b8be-f1ea236984ac

📥 Commits

Reviewing files that changed from the base of the PR and between 15c57a0 and 2c4ffb3.

📒 Files selected for processing (1)

• src/test/java/dev/metaschema/oscal/lib/validation/OscalValidationTest.java

🚧 Files skipped from review as they are similar to previous changes (1)

• src/test/java/dev/metaschema/oscal/lib/validation/OscalValidationTest.java

---

📝 Walkthrough

Walkthrough

Updated the Trivy GitHub Action pin to a different commit (v0.35.0) and changed a test resource URI in OscalValidationTest to validate a different OSCAL FedRAMP XML profile; no other workflow logic or exported API changes were made.

Changes

Cohort / File(s)	Summary
CI: Trivy Action pin .github/workflows/build.yml	Replaced pinned aquasecurity/trivy-action commit reference with a different pinned commit indicating v0.35.0; no other workflow or Trivy configuration changed.
Tests: OSCAL profile input src/test/java/dev/metaschema/oscal/lib/validation/OscalValidationTest.java	Changed the test input URI to a different OSCAL FedRAMP XML resource (switched from a GSA/fedramp-automation tailoring profile to an OSCAL-Foundation FedRAMP rev5 MODERATE baseline profile). Test logic and assertions remain unchanged.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• feat: add detailed SARIF findings to security scan summaries oscal-cli#223: Also modifies the GitHub Actions Trivy step and action usage in the build workflow.
• feat: add detailed SARIF findings to security scan summaries metaschema-java#631: Adjusts Trivy-related configuration in .github/workflows/build.yml within the CI workflows.
• feat: add reusable build workflow and scheduled nightly build oscal-cli#221: Updates the pinned Trivy GitHub Action commit in the build workflow.

Poem

🐰 I nudged a pin, hopped through a test,
Swapped one URI, then took a rest.
Trivy’s version now sings anew,
I nibble code and munch a few 🥕

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the two main CI infrastructure fixes: the Trivy action version bump and the FedRAMP test URL change.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/test/java/dev/metaschema/oscal/lib/validation/OscalValidationTest.java`:
- Line 83: In OscalValidationTest update the external URIs that use
"refs/heads/master" and "refs/heads/main" (the FedRAMP profile and OSCAL
metaschema references found in the test URI strings) to point to immutable
commit SHAs or replace them with checked-in fixture paths; locate the URI
literals in the test (search for the strings "refs/heads/master" and
"refs/heads/main" in OscalValidationTest) and change them to fixed commit SHA
URLs or to local test resources so CI tests become deterministic.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 43ff219e-c163-4939-811f-3b71e74e890e

📥 Commits

Reviewing files that changed from the base of the PR and between 977e61a and 15c57a0.

📒 Files selected for processing (1)

• src/test/java/dev/metaschema/oscal/lib/validation/OscalValidationTest.java