Skip to content
oscal

Playbooks

  • Knowledge Sources checked by automation only
    The librarian’s scrape map: every repository location and external page this bundle derives concepts from (schema, metaschema copy, adapt copy, generated artefacts, tests and fixtures, workflows, website, governance files), the concepts each yields, how to re-check each on a refresh run, and the paths left out on purpose.

  • Move the upstream pins nobody has checked this yet, still a draft
    What to do when the upstream watch opens its issue because NIST released a newer OSCAL or the metaschema copy drifted: replace src/oscal/schema/metaschema/ whole from the new tag’s src/metaschema/, move PINNED_TAG and PINNED_COMMIT with the schema header’s version, source and annotations, run just test and update every enum that tests/test_schema_rules.py reports.

  • Regenerate and test the schema nobody has checked this yet, still a draft
    How to change the OSCAL schema: set up with uv and just, edit src/oscal/schema/ but never the metaschema copy, give each enum its oscal_allowed_values, regenerate with just gen-project, gen-doc and lokf-adapt, add examples, then run just test, just lint, just lokf-adapt-check and the pre-commit hooks, as the Build and test workflow does on Python 3.10 to 3.14.

  • Release the schema nobody has checked this yet, still a draft
    How a releasing commit merged to main makes semantic-release promote CHANGELOG.md’s Unreleased section, tag vX.Y.Z and publish a GitHub Release, then dispatch the Knowledge Release workflow once KNOWLEDGE_RELEASE_ENABLED is true; below 1.0.0 from a v0.0.0 baseline tag, with a breaking change as a minor bump, no file bumped and nothing published to PyPI.

  • Validate OSCAL data against the schema nobody has checked this yet, still a draft
    How to check an OSCAL document against the schema with linkml-validate, naming the module and the class (-s src/oscal/schema/oscal_catalog.yaml -C Catalog), after rewriting native OSCAL JSON’s hyphenated keys with underscores; what the generated JSON Schema and the dataclasses check, and the metaschema constraints no tool here checks.