update-external-components.yml

name: Transform and update OSCAL content

on:
  workflow_dispatch:
    inputs:
      cac-reference:
        description: 'Compliance as Code git reference'
        required: true
        default: 'master'

jobs:
  create:
    name: Create content
    runs-on: ubuntu-latest
    container:
      image: fedora:latest
    steps:
      -   name: Install Deps
          run: dnf install -y cmake make openscap-utils python3-pyyaml bats ansible python3-pip ShellCheck git gcc gcc-c++ python3-devel
      -   name: Checkout
          uses: actions/checkout@v4
          with:
            repository: ComplianceAsCode/content
            ref: ${{ github.event.inputs.cac-reference }}
      -   name: Install deps python
          run: pip install pcre2 -r requirements.txt -r test-requirements.txt
      -   name: Build
          run: |-
              ./build_product ocp4
              ./utils/rule_dir_json.py
              ./utils/oscal/build_cd_from_policy.py -o build/ocp4.json -p fedramp_rev5_high -pr ocp4 -c nist_ocp4:high
          env:
            PYTHONPATH: ${{ github.workspace }}
      - name: Create artifacts
        uses: actions/upload-artifact@v4
        with:
          name: trestle-content
          path: build/ocp4.json

  update:
    name: Update content
    needs: create
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    container:
      image: quay.io/continuouscompliance/trestle-bot:v0.10.1
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: trestle-content
          path: /tmp
      - name: Import Trestle content
        run: |
            rm -rf component-definitions/ocp4/
            trestle import -f /tmp/ocp4.json -o ocp4
      - name: Update content
        uses: peter-evans/create-pull-request@v5.0.2
        with:
          base: main
          branch: "oscal-update-${{ github.run_id }}"
          delete-branch: true
          commit-message: "Update OSCAL content from CaC"
          title: "Update OSCAL content from CaC"
          body: |
            Updates to transformed OCP4 component definitions from CaC.

            Auto-generated by GitHub Actions.
          add-paths: |
            component-definitions/