Upgrade GitHub CI/CD Workflows to Current Stable Version

.github/dependabot.yml

@@ -0,0 +1,15 @@
+
+version: 2
+updates:
+
+  - package-ecosystem: "gitsubmodule"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    target-branch: "develop"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    target-branch: "develop"

.github/workflows/content-artifacts.yml

@@ -15,60 +15,79 @@ env:
   OSCAL_DIR_PATH: oscal
   CICD_DIR_PATH: oscal/build/ci-cd
   CONTENT_CONFIG_PATH: src/config
+  JAVA_CLASSPATH: ${{ github.workspace}}/lib
   SAXON_VERSION: 9.9.0-1
   HOME_REPO: usnistgov/oscal-content
 jobs:
   validate-and-publish-content:
     name: Check, Convert and Validate Content
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-20.04
     steps:
       # use this if checkout needs to be authenticated
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
         if: github.repository == env.HOME_REPO && github.ref == 'refs/heads/main'
         with:
           path: git-content
           submodules: recursive
           token: ${{ secrets.COMMIT_TOKEN }}
       # use this if checkout is anonymous
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
         if: github.repository != env.HOME_REPO || github.ref != 'refs/heads/main'
         with:
           path: git-content
           submodules: recursive
-      # job-validate-content
+      - name: Set env
+        run: |
+          echo "SAXON_HOME=${JAVA_CLASSPATH}" >> $GITHUB_ENV
+          echo "CALABASH_HOME=${JAVA_CLASSPATH}" >> $GITHUB_ENV
       - name: Update APT package metadata
         run: |
           sudo rm -rf /var/lib/apt/lists/* && sudo apt-get update
       - name: Install APT dependencies
         run: |
           sudo apt-get install libxml2-utils
-      - name: Install NPM dependencies
+      - name: Set up NodeJS
+        uses: actions/setup-node@8c91899e586c5b171469028077307d293428b516
+        with:
+          node-version-file: git-content/${{ env.OSCAL_DIR_PATH }}/build/.nvmrc
+          cache: 'npm'
+          cache-dependency-path: '**/package-lock.json'
+      - name: Setup Dependencies
         run: |
-          sudo npm install --loglevel verbose -g yargs ajv-formats@"^1.5.x" ajv-cli@"^4.0.x" yaml-convert@"^1.0.x"
-      - name: Set up JDK 11
-        uses: actions/setup-java@v1
+          # NodeJS
+          # If you are a developer and need to modify the workflow, be sure to review
+          # the package.json and package-lock.json to ensure the following deps are
+          # at least installed (they will be updated by dependabot):
+          # - ajv-cli
+          # - ajv-formats
+          # - markdown-link-check
+          # - yaml-convert
+          npm ci
+          echo "$PWD/node_modules/.bin/" >> $GITHUB_PATH
+        working-directory: git-content/${{ env.OSCAL_DIR_PATH }}/build
+      - name: Set up JDK
+        uses: actions/setup-java@de1bb2b0c5634f0fc4438d7aa9944e68f9bf86cc
         with:
           java-version: 11
-      - name: Cache Maven packages
-        uses: actions/cache@v2
-        with:
-          path: ~/.m2
-          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
-          restore-keys: ${{ runner.os }}-m2
-      - name: Get Saxon-HE
+          distribution: 'temurin'
+          cache: 'maven'
+      - name: Install JDK Deps Saxon and XML Calabash
         run: |
-          mvn org.apache.maven.plugins:maven-dependency-plugin:2.10:get -DartifactId=Saxon-HE -DgroupId=net.sf.saxon -Dversion=$SAXON_VERSION
+          mkdir -p "${JAVA_CLASSPATH}"
+          mvn dependency:copy-dependencies -DoutputDirectory="${JAVA_CLASSPATH}"
+        working-directory: git-content/${{ env.OSCAL_DIR_PATH }}/build
       - name: Set up Python 3.x
-        uses: actions/setup-python@98f2ad02fd48d057ee3b4d4f66525b231c3e52b6 # current release v3.1.2
+        uses: actions/setup-python@98f2ad02fd48d057ee3b4d4f66525b231c3e52b6
         with:
           python-version: '3.8'
           architecture: 'x64'
           cache: 'pip'
           cache-dependency-path: |
-            git-content/${{ env.CICD_DIR_PATH }}/python/requirements.txt
+           git-content/${{ env.CICD_DIR_PATH }}/python/requirements.txt
       - name: Install Python dependencies
         run: |
-          pip install -r "${GITHUB_WORKSPACE}/git-content/${CICD_DIR_PATH}/python/requirements.txt"
+          pip install -r requirements.txt
+        working-directory: git-content/${{ env.CICD_DIR_PATH }}/python
       - name: Validate Content
         run:
           # mkdir -p "${OSCAL_BUILD_DIR_PATH}"
@@ -80,7 +99,7 @@ jobs:
       - name: Publish Artifacts
         # only do this on main
         if: github.repository == env.HOME_REPO && github.ref == 'refs/heads/main'
-        uses: stefanzweifel/git-auto-commit-action@v4.5.1
+        uses: stefanzweifel/git-auto-commit-action@0049e3fa4059ca715255fbbcb7dea4516f02ce0a
         with:
           repository: git-content
           push_options: --force

.github/workflows/issue-triage.yml

@@ -11,15 +11,15 @@ jobs:
     if: github.event.action == 'opened'
     steps:
       - name: Add New Issues to Issue Triage Board
-        uses: peter-evans/create-or-update-project-card@866533e2ae61f13c35fd1d374049713fab43c729 # current tag: v2
+        uses: peter-evans/create-or-update-project-card@5eacbbd224b7814354861b555cc18a8359e2cebe
         with:
           project-name: Issue Triage
           column-name: Needs Triage
   removeCard:
     runs-on: ubuntu-latest
     if: github.event.action == 'closed'
     steps:
-      - uses: alex-page/github-project-automation-plus@bb266ff4dde9242060e2d5418e120a133586d488 #current tag: v0.8.1
+      - uses: alex-page/github-project-automation-plus@1f8873e97e3c8f58161a323b7c568c1f623a1c4d
         with:
           project: Issue Triage
           column: Done

.github/workflows/labels.yml

@@ -12,7 +12,7 @@ jobs:
     name: DefaultLabelsActions
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@1.0.0
-      - uses: lannonbr/issue-label-manager-action@2.0.0
+      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
+      - uses: lannonbr/issue-label-manager-action@7890981d0e8f2922211a7fe2c391c53cb3037cb4
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}