From 4170ad0d68246f79938dc701ce0be7329601beff Mon Sep 17 00:00:00 2001 From: Alexander Stein Date: Tue, 1 Nov 2022 14:50:00 -0400 Subject: [PATCH] Add possible Schematron documentation checks (#1501) * Add possible Schematron documentation checks This is the product of the meeting and spike where we pair-programmed and came up with example Schematron rules for tentative editorial standards that can be used for reviews of models and embedded docs as part of usnistgov/OSCAL#801. Co-authored-by: Chris Compton Co-authored-by: Rene Rene Tshiteya Co-authored-by: Wendell Piez Add CI/CD checking of Schematron doc standards checking. Always zip and upload Schematron validation results for potential debug. * After, show the Schematron checks passing after Metaschema def fixes. * Revert validate-metaschema.sh changes. * Revert refactored Schematron and remove from PR. * Update metaschema module to include updated Schematron in usnistgov/metaschema#246. Co-authored-by: David Waltermire --- .../workflow-generate-metaschema-resources.yml | 12 ++++++++++++ src/metaschema/oscal_control-common_metaschema.xml | 2 +- src/metaschema/oscal_ssp_metaschema.xml | 14 +++++--------- 3 files changed, 18 insertions(+), 10 deletions(-) diff --git a/.github/workflows/workflow-generate-metaschema-resources.yml b/.github/workflows/workflow-generate-metaschema-resources.yml index 6e93effc60..e8a3c118af 100644 --- a/.github/workflows/workflow-generate-metaschema-resources.yml +++ b/.github/workflows/workflow-generate-metaschema-resources.yml @@ -119,12 +119,24 @@ jobs: run: | zip ${{ runner.temp }}/metaschema-artifacts.zip -r xml/schema/*.xsd json/schema/*.json xml/convert/*.xsl json/convert/*.xsl working-directory: ${{ env.CHECKOUT_PATH }} + - name: Zip Schematron Validation Results for Debugging + if: always() + run: | + zip ${{ runner.temp }}/schematron-validations.zip -r ${{ runner.temp }} build/metaschema/toolchains/xslt-M4/validate/metaschema-composition-check-compiled.xsl + working-directory: ${{ env.CHECKOUT_PATH }} - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb with: name: schemas-and-converters path: | ${{ runner.temp }}/metaschema-artifacts.zip retention-days: 5 + - uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 + if: always() + with: + name: schematron-validation-reports + path: | + ${{ runner.temp }}/schematron-validations.zip + retention-days: 5 # Store Built Artifacts # --------------- - name: Publish Schemas and Converters diff --git a/src/metaschema/oscal_control-common_metaschema.xml b/src/metaschema/oscal_control-common_metaschema.xml index 2e56d06954..68fcc07a66 100644 --- a/src/metaschema/oscal_control-common_metaschema.xml +++ b/src/metaschema/oscal_control-common_metaschema.xml @@ -6,7 +6,7 @@ ]> - OSCAL Control Catalog Format -- Common Models 1.0.4 diff --git a/src/metaschema/oscal_ssp_metaschema.xml b/src/metaschema/oscal_ssp_metaschema.xml index e98fbf64d0..5de374351d 100644 --- a/src/metaschema/oscal_ssp_metaschema.xml +++ b/src/metaschema/oscal_ssp_metaschema.xml @@ -30,7 +30,7 @@ System Security Plan (SSP) - A system security plan, such as those described in NIST SP 800-18 + A system security plan, such as those described in NIST SP 800-18. system-security-plan System Security Plan Universally Unique Identifier @@ -106,8 +106,7 @@ Security Sensitivity Level - The overall information system sensitivity categorization, such as defined by FIPS-199. - + The overall information system sensitivity categorization, such as defined by FIPS-199.

Often, organizations require the security sensitivity level to correspond with the highest confidentiality, integrity, or availability level identified by security-impact-level.

@@ -181,8 +180,7 @@ System Information - Contains details about all information types that are stored, processed, or transmitted by the system, such as privacy information, and those defined in NIST SP 800-60. - + Contains details about all information types that are stored, processed, or transmitted by the system, such as privacy information, and those defined in NIST SP 800-60. @@ -192,8 +190,7 @@ Information Type - Contains details about one information type that is stored, processed, or transmitted by the system, such as privacy information, and those defined in NIST SP 800-60. - + Contains details about one information type that is stored, processed, or transmitted by the system, such as privacy information, and those defined in NIST SP 800-60. Information Type Universally Unique Identifier @@ -535,8 +532,7 @@ Leveraged Authorization - A description of another authorized system from which this system inherits capabilities that satisfy security requirements. Another term for this concept is a common control provider. - + A description of another authorized system from which this system inherits capabilities that satisfy security requirements. Another term for this concept is a common control provider. Leveraged Authorization Universally Unique Identifier