Skip to content

Commit 0630870

Browse files
mcdonnnjmcdonnnj
authored
Merge pull request #71 from cisagov/lineage/skeleton
⚠️ CONFLICT! Lineage pull request for: skeleton
2 parents b7a6c71 + e9e3cc7 commit 0630870

15 files changed

+466
-263
lines changed

‎.github/CODEOWNERS

+14
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,17 @@
88
# These folks own any files in the .github directory at the root of
99
# the repository and any of its subdirectories.
1010
/.github/ @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
11+
12+
# These folks own all linting configuration files.
13+
/.ansible-lint @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
14+
/.bandit.yml @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
15+
/.flake8 @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
16+
/.isort.cfg @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
17+
/.mdl_config.yaml @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
18+
/.pre-commit-config.yaml @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
19+
/.prettierignore @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
20+
/.yamllint @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
21+
/requirements.txt @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
22+
/requirements-dev.txt @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
23+
/requirements-test.txt @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
24+
/setup-env @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj

‎.github/dependabot.yml

+3-1
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ updates:
1919
- dependency-name: hashicorp/setup-terraform
2020
- dependency-name: mxschmitt/action-tmate
2121
- dependency-name: step-security/harden-runner
22+
# Managed by cisagov/skeleton-ansible-role
23+
- dependency-name: github/codeql-action
2224
# Managed by cisagov/skeleton-ansible-role-with-test-user
2325
- dependency-name: aws-actions/configure-aws-credentials
2426
package-ecosystem: github-actions
@@ -29,7 +31,7 @@ updates:
2931
ignore:
3032
# Managed by cisagov/skeleton-ansible-role
3133
- dependency-name: ansible
32-
- dependency-name: ansible-lint
34+
- dependency-name: ansible-core
3335
package-ecosystem: pip
3436
schedule:
3537
interval: weekly

‎.github/workflows/build.yml

+55-26
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,32 @@
22
name: build
33

44
on:
5-
push:
5+
merge_group:
6+
types:
7+
- checks_requested
68
pull_request:
9+
push:
710
repository_dispatch:
8-
types: [apb]
11+
types:
12+
- apb
13+
14+
# Set a default shell for any run steps. The `-Eueo pipefail` sets errtrace,
15+
# nounset, errexit, and pipefail. The `-x` will print all commands as they are
16+
# run. Please see the GitHub Actions documentation for more information:
17+
# https://docs.github.com/en/actions/using-jobs/setting-default-values-for-jobs
18+
defaults:
19+
run:
20+
shell: bash -Eueo pipefail -x {0}
921

1022
env:
1123
AWS_DEFAULT_REGION: us-east-1
1224
CURL_CACHE_DIR: ~/.cache/curl
1325
PIP_CACHE_DIR: ~/.cache/pip
1426
PRE_COMMIT_CACHE_DIR: ~/.cache/pre-commit
1527
RUN_TMATE: ${{ secrets.RUN_TMATE }}
28+
TERRAFORM_DOCS_REPO_BRANCH_NAME: improvement/support_atx_closed_markdown_headers
29+
TERRAFORM_DOCS_REPO_DEPTH: 1
30+
TERRAFORM_DOCS_REPO_URL: https://github.com/mcdonnnj/terraform-docs.git
1631

1732
jobs:
1833
diagnostics:
@@ -28,7 +43,7 @@ jobs:
2843
egress-policy: audit
2944
- id: github-status
3045
name: Check GitHub status
31-
uses: crazy-max/ghaction-github-status@v3
46+
uses: crazy-max/ghaction-github-status@v4
3247
- id: dump-context
3348
name: Dump context
3449
uses: crazy-max/ghaction-dump-context@v2
@@ -46,20 +61,20 @@ jobs:
4661
uses: cisagov/setup-env-github-action@develop
4762
- uses: actions/checkout@v4
4863
- id: setup-python
49-
uses: actions/setup-python@v4
64+
uses: actions/setup-python@v5
5065
with:
51-
python-version: "3.11"
66+
python-version: ${{ steps.setup-env.outputs.python-version }}
5267
# We need the Go version and Go cache location for the actions/cache step,
5368
# so the Go installation must happen before that.
5469
- id: setup-go
55-
uses: actions/setup-go@v4
70+
uses: actions/setup-go@v5
5671
with:
5772
# There is no expectation for actual Go code so we disable caching as
5873
# it relies on the existence of a go.sum file.
5974
cache: false
60-
go-version: "1.20"
61-
- name: Lookup Go cache directory
62-
id: go-cache
75+
go-version: ${{ steps.setup-env.outputs.go-version }}
76+
- id: go-cache
77+
name: Lookup Go cache directory
6378
run: |
6479
echo "dir=$(go env GOCACHE)" >> $GITHUB_OUTPUT
6580
- uses: actions/cache@v3
@@ -70,6 +85,10 @@ jobs:
7085
packer${{ steps.setup-env.outputs.packer-version }}-\
7186
tf${{ steps.setup-env.outputs.terraform-version }}-"
7287
with:
88+
key: "${{ env.BASE_CACHE_KEY }}\
89+
${{ hashFiles('**/requirements-test.txt') }}-\
90+
${{ hashFiles('**/requirements.txt') }}-\
91+
${{ hashFiles('**/.pre-commit-config.yaml') }}"
7392
# Note that the .terraform directory IS NOT included in the
7493
# cache because if we were caching, then we would need to use
7594
# the `-upgrade=true` option. This option blindly pulls down the
@@ -81,10 +100,6 @@ jobs:
81100
${{ env.PRE_COMMIT_CACHE_DIR }}
82101
${{ env.CURL_CACHE_DIR }}
83102
${{ steps.go-cache.outputs.dir }}
84-
key: "${{ env.BASE_CACHE_KEY }}\
85-
${{ hashFiles('**/requirements-test.txt') }}-\
86-
${{ hashFiles('**/requirements.txt') }}-\
87-
${{ hashFiles('**/.pre-commit-config.yaml') }}"
88103
restore-keys: |
89104
${{ env.BASE_CACHE_KEY }}
90105
- name: Setup curl cache
@@ -102,34 +117,46 @@ jobs:
102117
${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}"
103118
sudo mv /usr/local/bin/packer /usr/local/bin/packer-default
104119
sudo ln -s /opt/packer/packer /usr/local/bin/packer
105-
- uses: hashicorp/setup-terraform@v2
120+
- uses: hashicorp/setup-terraform@v3
106121
with:
107122
terraform_version: ${{ steps.setup-env.outputs.terraform-version }}
108123
- name: Install go-critic
109124
env:
110125
PACKAGE_URL: github.com/go-critic/go-critic/cmd/gocritic
111126
PACKAGE_VERSION: ${{ steps.setup-env.outputs.go-critic-version }}
112127
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
128+
- name: Install goimports
129+
env:
130+
PACKAGE_URL: golang.org/x/tools/cmd/goimports
131+
PACKAGE_VERSION: ${{ steps.setup-env.outputs.goimports-version }}
132+
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
113133
- name: Install gosec
114134
env:
115135
PACKAGE_URL: github.com/securego/gosec/v2/cmd/gosec
116136
PACKAGE_VERSION: ${{ steps.setup-env.outputs.gosec-version }}
117137
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
118-
- name: Install shfmt
119-
env:
120-
PACKAGE_URL: mvdan.cc/sh/v3/cmd/shfmt
121-
PACKAGE_VERSION: ${{ steps.setup-env.outputs.shfmt-version }}
122-
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
123138
- name: Install staticcheck
124139
env:
125140
PACKAGE_URL: honnef.co/go/tools/cmd/staticcheck
126141
PACKAGE_VERSION: ${{ steps.setup-env.outputs.staticcheck-version }}
127142
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
128-
- name: Install Terraform-docs
129-
env:
130-
PACKAGE_URL: github.com/terraform-docs/terraform-docs
131-
PACKAGE_VERSION: ${{ steps.setup-env.outputs.terraform-docs-version }}
132-
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
143+
# TODO: https://github.com/cisagov/skeleton-generic/issues/165
144+
# We are temporarily using @mcdonnnj's forked branch of terraform-docs
145+
# until his PR: https://github.com/terraform-docs/terraform-docs/pull/745
146+
# is approved. This temporary fix will allow for ATX header support when
147+
# terraform-docs is run during linting.
148+
- name: Clone ATX headers branch from terraform-docs fork
149+
run: |
150+
git clone \
151+
--branch $TERRAFORM_DOCS_REPO_BRANCH_NAME \
152+
--depth $TERRAFORM_DOCS_REPO_DEPTH \
153+
--single-branch \
154+
$TERRAFORM_DOCS_REPO_URL /tmp/terraform-docs
155+
- name: Build and install terraform-docs binary
156+
run: |
157+
go build \
158+
-C /tmp/terraform-docs \
159+
-o $(go env GOPATH)/bin/terraform-docs
133160
- name: Install dependencies
134161
run: |
135162
python -m pip install --upgrade pip setuptools wheel
@@ -156,11 +183,13 @@ jobs:
156183
uses: step-security/harden-runner@v2
157184
with:
158185
egress-policy: audit
186+
- id: setup-env
187+
uses: cisagov/setup-env-github-action@develop
159188
- uses: actions/checkout@v4
160189
- id: setup-python
161-
uses: actions/setup-python@v4
190+
uses: actions/setup-python@v5
162191
with:
163-
python-version: "3.10"
192+
python-version: ${{ steps.setup-env.outputs.python-version }}
164193
- uses: actions/cache@v3
165194
env:
166195
BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\

‎.github/workflows/codeql-analysis.yml

+25-3
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@
77
name: CodeQL
88

99
on:
10+
merge_group:
11+
types:
12+
- checks_requested
1013
push:
1114
# Dependabot triggered push events have read-only access, but uploading code
1215
# scanning requires write access.
@@ -20,8 +23,27 @@ on:
2023
- cron: '0 2 * * 6'
2124

2225
jobs:
26+
diagnostics:
27+
name: Run diagnostics
28+
runs-on: ubuntu-latest
29+
steps:
30+
# Note that a duplicate of this step must be added at the top of
31+
# each job.
32+
- id: harden-runner
33+
name: Harden the runner
34+
uses: step-security/harden-runner@v2
35+
with:
36+
egress-policy: audit
37+
- id: github-status
38+
name: Check GitHub status
39+
uses: crazy-max/ghaction-github-status@v3
40+
- id: dump-context
41+
name: Dump context
42+
uses: crazy-max/ghaction-dump-context@v2
2343
analyze:
2444
name: Analyze
45+
needs:
46+
- diagnostics
2547
runs-on: ubuntu-latest
2648
permissions:
2749
# required for all workflows
@@ -48,15 +70,15 @@ jobs:
4870

4971
# Initializes the CodeQL tools for scanning.
5072
- name: Initialize CodeQL
51-
uses: github/codeql-action/init@v2
73+
uses: github/codeql-action/init@v3
5274
with:
5375
languages: ${{ matrix.language }}
5476

5577
# Autobuild attempts to build any compiled languages (C/C++, C#, or
5678
# Java). If this step fails, then you should remove it and run the build
5779
# manually (see below).
5880
- name: Autobuild
59-
uses: github/codeql-action/autobuild@v2
81+
uses: github/codeql-action/autobuild@v3
6082

6183
# ℹ️ Command-line programs to run using the OS shell.
6284
# 📚 https://git.io/JvXDl
@@ -70,4 +92,4 @@ jobs:
7092
# make release
7193

7294
- name: Perform CodeQL Analysis
73-
uses: github/codeql-action/analyze@v2
95+
uses: github/codeql-action/analyze@v3

‎.github/workflows/sync-labels.yml

+24
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,38 @@ permissions:
1111
contents: read
1212

1313
jobs:
14+
diagnostics:
15+
name: Run diagnostics
16+
runs-on: ubuntu-latest
17+
steps:
18+
# Note that a duplicate of this step must be added at the top of
19+
# each job.
20+
- id: harden-runner
21+
name: Harden the runner
22+
uses: step-security/harden-runner@v2
23+
with:
24+
egress-policy: audit
25+
- id: github-status
26+
name: Check GitHub status
27+
uses: crazy-max/ghaction-github-status@v3
28+
- id: dump-context
29+
name: Dump context
30+
uses: crazy-max/ghaction-dump-context@v2
1431
labeler:
32+
needs:
33+
- diagnostics
1534
permissions:
1635
# actions/checkout needs this to fetch code
1736
contents: read
1837
# crazy-max/ghaction-github-labeler needs this to manage repository labels
1938
issues: write
2039
runs-on: ubuntu-latest
2140
steps:
41+
- id: harden-runner
42+
name: Harden the runner
43+
uses: step-security/harden-runner@v2
44+
with:
45+
egress-policy: audit
2246
- uses: actions/checkout@v4
2347
- name: Sync repository labels
2448
if: success()

0 commit comments

Comments
 (0)