From 977e61a5db7782315139ec042625abcb0d3aaf93 Mon Sep 17 00:00:00 2001 From: David Waltermire Date: Sun, 19 Apr 2026 11:42:23 -0400 Subject: [PATCH 1/3] build: bump aquasecurity/trivy-action from v0.33.1 to v0.35.0 Upgrade the Trivy security scanner action from v0.33.1 to v0.35.0. The v0.33.1 version's Trivy installation step has been failing in CI since February 2026 (exit code 1 immediately after fetching the Trivy binary version), blocking all PRs regardless of code changes. --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index eea6f0f2..42b1eb8a 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -203,7 +203,7 @@ jobs: # ------------------------- - name: Run Trivy security scanner if: ${{ !inputs.skip_code_scans }} - uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 + uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0 with: scan-type: 'fs' scan-ref: '.' From 15c57a046858a9962668cbca9d6012e60dff1892 Mon Sep 17 00:00:00 2001 From: David Waltermire Date: Sun, 19 Apr 2026 11:46:51 -0400 Subject: [PATCH 2/3] test: update FedRAMP profile URL to OSCAL-Foundation repository The GSA/fedramp-automation repository is no longer publicly accessible, causing OscalValidationTest.testValidateOscalProfileXml to fail with FileNotFound on every CI run. Point the test at the equivalent profile in the OSCAL-Foundation/fedramp-automation repository (rev5 MODERATE baseline), which is the current home for the FedRAMP automation work. --- .../metaschema/oscal/lib/validation/OscalValidationTest.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/test/java/dev/metaschema/oscal/lib/validation/OscalValidationTest.java b/src/test/java/dev/metaschema/oscal/lib/validation/OscalValidationTest.java index 733470c8..813614ca 100644 --- a/src/test/java/dev/metaschema/oscal/lib/validation/OscalValidationTest.java +++ b/src/test/java/dev/metaschema/oscal/lib/validation/OscalValidationTest.java @@ -80,7 +80,7 @@ void testValidateOscalProfileXml() IValidationResult validationResult = bindingContext.validate( new URI( - "https://raw.githubusercontent.com/GSA/fedramp-automation/refs/heads/develop/src/validations/constraints/content/fedramp-tailoring-profile.xml"), + "https://raw.githubusercontent.com/OSCAL-Foundation/fedramp-automation/refs/heads/master/src/content/rev5/baselines/xml/FedRAMP_rev5_MODERATE-baseline_profile.xml"), Format.XML, new ValidationProvider(module), null); From 2c4ffb3b1294a0c5caa1d9795b196f52abe0e8a6 Mon Sep 17 00:00:00 2001 From: David Waltermire Date: Sun, 19 Apr 2026 11:54:39 -0400 Subject: [PATCH 3/3] test: hash-pin FedRAMP profile URL to specific commit Pin the FedRAMP profile URL to a specific commit SHA rather than the master branch ref, so the test is not sensitive to upstream changes. --- .../metaschema/oscal/lib/validation/OscalValidationTest.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/test/java/dev/metaschema/oscal/lib/validation/OscalValidationTest.java b/src/test/java/dev/metaschema/oscal/lib/validation/OscalValidationTest.java index 813614ca..ababfb1c 100644 --- a/src/test/java/dev/metaschema/oscal/lib/validation/OscalValidationTest.java +++ b/src/test/java/dev/metaschema/oscal/lib/validation/OscalValidationTest.java @@ -80,7 +80,7 @@ void testValidateOscalProfileXml() IValidationResult validationResult = bindingContext.validate( new URI( - "https://raw.githubusercontent.com/OSCAL-Foundation/fedramp-automation/refs/heads/master/src/content/rev5/baselines/xml/FedRAMP_rev5_MODERATE-baseline_profile.xml"), + "https://raw.githubusercontent.com/OSCAL-Foundation/fedramp-automation/c784140bc6d1ac9fa159aabc0e8a29e9aa2c63a9/src/content/rev5/baselines/xml/FedRAMP_rev5_MODERATE-baseline_profile.xml"), Format.XML, new ValidationProvider(module), null);