Initial proof of concept for lula actions

[brandtkeller]

Intent

Provide Lula GitHub actions with guardrails that account for possible default scenarios.

Real-world use

It may very well be possible that the setup action is the only useful action - but I figured it might be worthwhile to experiment with some other workflows that handled more of the complexity and added extra garudrails like checking for existence of artifacts when necessary.

[CloudBeard]

From a UDS perspective I would use all 3 setup, lint, and validate. I am picturing (once validations are setup/tested) the validate piece on new PRs would be a great way to have a compliance gate for changes. That in itself would let you know if a change would require a conversation about exceptions/POAMs or even lead to the creation/addition of it to the POAM.

I would also use Setup and Lint today in all UDS repos with OSCAL. I have a draft open for SWF that I could swap out for these. defenseunicorns/uds-package-software-factory#115

[brandtkeller]

From a UDS perspective I would use all 3 setup, lint, and validate. I am picturing (once validations are setup/tested) the validate piece on new PRs would be a great way to have a compliance gate for changes. That in itself would let you know if a change would require a conversation about exceptions/POAMs or even lead to the creation/addition of it to the POAM.

I would also use Setup and Lint today in all UDS repos with OSCAL. I have a draft open for SWF that I could swap out for these. defenseunicorns/uds-package-software-factory#115

Good to hear! My mention about usefulness of the other actions was a comparison on ROI. IE once Lula is installed with the setup action - you could just as easily call lula tools lint -f <file> vs using the lint action. But I tossed those workflows in here so that we can experiment and see. The lula commands can be augmented with the action which leads to better guardrails and possibly more functionality.

[brandtkeller]

Moving to ready for review - would like to see if we can spin-up a mock repository to use the actions simply based on commit-hash without any released versions (never tried this myself but feels reasonable).

[CloudBeard]

Initial actions look awesome! Look forward to testing.