Integrate profile checker Schematron into CI/CD

[wendellpiez]

User Story:

Responding to usnistgov/OSCAL#534 we implemented a simple profile link checker that reports when profiles call controls that can't be found in an imported catalog. It doesn't work on profiles importing profiles but it is better than nothing for detecting simple pointer errors.

The Schematron is in this branch: https://github.com/wendellpiez/OSCAL/tree/Issue534-profile-validation. The PR is usnistgov/OSCAL#539.

(Link to commit: wendellpiez/OSCAL@aa223f3#diff-ae6cae8616ab5f465e28e103376e036e )

Goals:

Help ensure profiles committed to the repo are correct.

This Schematron can also be the basis for other checks to be run on profiles.

Dependencies:

• fixing build breaking from JSON Schema Generation Yields Undesired Allowed Values metaschema#240 and updated submodule commit when Bump actions/upload-artifact from 3.1.3 to 4.3.0 #240 has been merged into OSCAL.

Acceptance Criteria

• All OSCAL website and readme documentation affected by the changes in this issue have been updated. Changes to the OSCAL website can be made in the docs/content directory of your branch.
• A Pull Request (PR) is submitted that fully addresses the goals of this User Story. This issue is referenced in the PR.
• The CI-CD build process runs without any reported errors on the PR. This can be confirmed by reviewing that all checks have passed in the PR.

{The items above are general acceptance criteria for all User Stories. Please describe anything else that must be completed for this issue to be considered resolved.}

[wendellpiez]

Revamping this Schematron in working branch behind usnistgov/OSCAL#970.

[wendellpiez]

See WIP cited above.

Also compare to this and possibly consolidate: https://github.com/wendellpiez/oscal-content/blob/master/src/nist.gov/SP800-53/rev5/xml/validate-profiles_SP800-53B-baselines.sch

[wendellpiez]

See PR usnistgov/OSCAL#1013 for updated Schematron.

It is located in the OSCAL repo here: src/utils/schematron/oscal-profile.sch

It does basic testing of profiles importing catalogs, confirming that controls and parameters that are addressed by the profile are actually present in the imported catalog.

[aj-stein-nist]

Heads up to @david-waltermire-nist and @wendellpiez. I thought I would do a quick one to clear my head. Hit some minor speedbumps.

1. Not urgent, will not block this work: we want to figure out the path forward for tech debt items on supporting XSLT 3 for any Schematron or Schematron that imports util XSLT functions from a stylesheet using XSLT3 features.
2. More urgent, and I will file a bug: it seems the Saxon-executed use of a command-line invocated XPath essentially looking for any sad path Schematron result in the SVRL, even with intentionally crafted bad profiles do not bubble up an error. This code seems to evaluate a 0 even in the existence of a bad profile with a non-existent control-id inserted (one of the clear-cut assertions in the profile checker): https://github.com/usnistgov/metaschema/blob/675d385d65c85639d0e2d8e395cb80e4d66d63d3/scripts/include/init-schematron.sh#L60-L81 Will file a bug around this later in the evening.

[aj-stein-nist]

Heads up to @david-waltermire-nist and @wendellpiez. I thought I would do a quick one to clear my head. Hit some minor speedbumps.

1. Not urgent, will not block this work: we want to figure out the path forward for tech debt items on supporting XSLT 3 for any Schematron _or_ Schematron that imports util XSLT functions from a stylesheet using XSLT3 features.

2. More urgent, and I will file a bug: it seems the Saxon-executed use of a command-line invocated XPath essentially looking for any sad path Schematron result in the SVRL, even with intentionally crafted bad profiles do not bubble up an error. This code seems to evaluate a 0 even in the existence of a bad profile with a non-existent control-id inserted (one of the clear-cut assertions in the profile checker): https://github.com/usnistgov/metaschema/blob/675d385d65c85639d0e2d8e395cb80e4d66d63d3/scripts/include/init-schematron.sh#L60-L81 Will file a bug around this later in the evening.

Most of this content has been handled in the interim, but I updated to properly identify the blocker around CI/CD failures rooted in usnistgov/metaschema#240. There may be other issues, but I will need to update accordingly by end of week.

[aj-stein-nist]

Moving to Sprint 61, and leaving open until the updated CI/CD code is merged into the oscal-content repo where it will actually validate profiles.

[aj-stein-nist]

This can be merged with very limited effort once CI/CD configuration is resolved. Moving to Sprint 63 as it very close to complete.