Upstream watch (upstream-watch.yaml)
workflows/upstream-watchNobody has checked this yet
still a draft
Written 2026-10-29 by ktl-librarian (automation).
The full record
- Checks
- none recorded
- Sources
- Related to
- Pointed to by
- Move the upstream pins (references)
- Security policy (references)
- Graph
- Open this concept in the knowledge graph
- IRI
https://w3id.org/lmodel/oscal/knowledge/workflows/upstream-watch- Licence
- CC BY 4.0
- Files
- MarkdownJSON-LDSource on GitHubHistory on GitHub
Upstream watch (upstream-watch.yaml)
Section titled “Upstream watch (upstream-watch.yaml)”.github/workflows/upstream-watch.yaml is the workflow named “Upstream watch”. A header comment says that it checks weekly what the repository is built from but does not control: NIST’s OSCAL releases.1 Nothing in a pull request can change them, so it runs on a schedule: every Monday at 07:00 UTC, after the knowledge workflows, and by hand.
Its one job, oscal-metaschema, named “OSCAL metaschema copy is current and intact”, runs on ubuntu-latest with contents: read and issues: write. It runs scripts/check_upstream_release.py with the job’s token, using only Python’s standard library, so the runner’s Python is enough. The script compares src/oscal/schema/metaschema/ with OSCAL’s latest release and with the pinned tree. When the check fails, .github/scripts/report-issue.sh opens an issue titled “Upstream watch: OSCAL has changed”, or comments on the open issue with that title. The body is the check’s report, or a note that the check stopped before writing one, and a link to the run.2 So a weekly finding is one issue, and does not depend on anyone reading the run log.
OSCAL metaschema copy says what the script compares, and Move the upstream pins says what to do about the issue.