still wip for lint

.github/actions/lint-oscal/action.yaml

@@ -0,0 +1,10 @@
+# action.yml
+name: "lint-oscal"
+description: "Lula Lint OSCAL"
+
+runs:
+  using: "composite"
+  steps:
+    - name: lint-oscal
+      run: |
+        uds run lint-oscal --set OSCALFILES=${{ inputs.OSCALFILES }}

.github/filters.yaml

@@ -25,3 +25,5 @@ tempo:
   - "src/tempo/**"
 velero:
   - "src/velero/**"
+oscal:
+  - "**/*oscal*.yaml"

.github/workflows/lint-oscal.yaml

@@ -0,0 +1,28 @@
+name: Lint OSCAL Files
+
+on:
+  push:
+    paths:
+      - '**/*oscal*.yaml'
+
+permissions:
+    contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+      - name: Identify changed OSCAL files
+        id: find_changed_files
+        run: |
+          CHANGED_FILES=$(git diff --name-only HEAD^ HEAD | grep 'oscal.*\.yaml$' || true)
+          echo "Changed OSCAL files: $CHANGED_FILES"
+          echo "::set-output name=oscal_files::$CHANGED_FILES"
+
+      - name: Run lint-oscal
+        uses: .github/actions/lint-oscal/action.yaml
+        with:
+          OSCALFILES: ${{ steps.find_changed_files.outputs.oscal_files }}

.github/workflows/pull-request-conditionals.yaml

@@ -39,8 +39,6 @@ jobs:
         run: brew install defenseunicorns/tap/[email protected]
       - name: Run Formatting Checks
         run: uds run lint-check --no-progress
-      - name: Setup Lula
-        uses: .github/actions/setup
 
   # This job checks if there are changes in specific paths source packages.
   check-paths:
@@ -61,7 +59,27 @@ jobs:
         with:
           filters: .github/filters.yaml
 
-  # This job triggers a separate workflow for each changed source package, if any.
+  run-lint-oscal:
+      needs: check-paths
+      if: needs.check-paths.outputs.oscal_changed == 'true'
+      runs-on: ubuntu-latest
+      steps:
+        - name: Checkout code
+          uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+        - name: Identify changed OSCAL files
+          id: find_changed_files
+          run: |
+            CHANGED_FILES=$(git diff --name-only HEAD^ HEAD | grep 'oscal.*\.yaml$' || true)
+            echo "Changed OSCAL files: $CHANGED_FILES"
+            echo "::set-output name=oscal_files::$CHANGED_FILES"
+
+        - name: Run lint-oscal
+          uses: ./.github/actions/lint-oscal/action.yaml
+          with:
+            OSCALFILES: ${{ steps.find_changed_files.outputs.oscal_files }}
+
+# This job triggers a separate workflow for each changed source package, if any.
   run-package-test:
     needs: check-paths
     name: Schedule