-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Schubert Anselme <[email protected]>
- Loading branch information
Showing
18 changed files
with
469 additions
and
109 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,16 +1,15 @@ | ||
| // For format details, see https://aka.ms/devcontainer.json. For config options, see the | ||
| // README at: https://github.com/devcontainers/templates/tree/main/src/ubuntu | ||
| { | ||
| "name": "Dev Container", | ||
| "name": "DevOS", | ||
| // Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile | ||
| // "image": "mcr.microsoft.com/devcontainers/base:dev-ubuntu", | ||
| // "build": {"dockerfile": "${localWorkspaceFolder}/build/package/Dockerfile"}, | ||
| "dockerComposeFile": [ | ||
| "${localWorkspaceFolder}/compose-dev.yaml" | ||
| ], | ||
| "service": "devcontainer", | ||
| "service": "devos", | ||
| "workspaceFolder": "/workspace", | ||
| // Use 'postCreateCommand' to run commands after the container is created. | ||
| "postCreateCommand": "${containerWorkspaceFolder}/scripts/setup-devcontainer.sh" | ||
| // Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root. | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| name: Workflow Gate | ||
| description: Gate workflow based on Trivy scan results | ||
|
|
||
| inputs: | ||
| generate-sbom: | ||
| default: "false" | ||
| description: Generate SBOM and submit results to Dependency Graph | ||
| upload-scan-result: | ||
| default: "false" | ||
| description: Upload scan results to GitHub Security tab | ||
|
|
||
| runs: | ||
| using: composite | ||
| steps: | ||
| - name: Run Trivy vulnerability scanner in repo mode | ||
| uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # v0.24.0 https://github.com/aquasecurity/trivy-action/commit/6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 | ||
| with: | ||
| exit-code: 1 | ||
| format: sarif | ||
| hide-progress: false | ||
| ignore-unfixed: true | ||
| output: trivy-results.sarif | ||
| scan-type: fs | ||
|
|
||
| - name: Upload Trivy scan results to GitHub Security tab | ||
| uses: github/codeql-action/upload-sarif@b8efe4dc6ab6d31abe3ec159420d2a4916880800 # v3.26.6 https://github.com/github/codeql-action/commit/b8efe4dc6ab6d31abe3ec159420d2a4916880800 | ||
| if: ${{ inputs.upload-scan-result == 'true' }} | ||
| with: | ||
| sarif_file: trivy-results.sarif | ||
|
|
||
| - name: Run Trivy SBOM and submit results to Dependency Graph | ||
| uses: aquasecurity/trivy-action@fbd16365eb88e12433951383f5e99bd901fc618f # v0.24.0 https://github.com/aquasecurity/trivy-action/commit/6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 | ||
| if: ${{ inputs.generate-sbom == 'true' }} | ||
| with: | ||
| format: github | ||
| github-pat: ${{ github.token }} | ||
| image-ref: . | ||
| output: dependency-results.sbom.json | ||
| scan-type: fs |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,24 +1,61 @@ | ||
| # Add 'repo' label to any root file changes | ||
| repo: | ||
| - "*" | ||
| - changed-files: | ||
| - any-glob-to-any-file: "*" | ||
|
|
||
| # Add 'github-actions' label to any changes in the '.github' directory | ||
| github-actions: | ||
| - changed-files: | ||
| - any-glob-to-any-file: | ||
| - .github/actions/* | ||
| - .github/actions/*/** | ||
| - .github/auto_assign.yml | ||
| - .github/auto_assign.yml/** | ||
| - .github/dependabot.yml | ||
| - .github/dependabot.yml/** | ||
| - .github/workflows/* | ||
| - .github/workflows/*/** | ||
|
|
||
| # Add 'devcontainer' label to any changes in the '.devcontainer' directory | ||
| # Add 'devcontainer' label to any changes in the '.docker' directory | ||
| # Add 'devcontainer' label to any changes in the 'docker-compose.yml' file | ||
| devcontainer: | ||
| - .devcontainer/* | ||
| - .devcontainer/*/** | ||
| - .devcontainer/devcontainer.json | ||
| - .devcontainer/devcontainer.json/** | ||
| - .docker/* | ||
| - .docker/*/** | ||
| - .docker/Dockerfile | ||
| - .docker/Dockerfile/** | ||
| - .docker/docker-compose.yml | ||
| - .docker/docker-compose.yml/** | ||
| - changed-files: | ||
| - any-glob-to-any-file: | ||
| - .devcontainer/* | ||
| - .devcontainer/*/** | ||
| - .devcontainer/devcontainer.json | ||
| - .devcontainer/devcontainer.json/** | ||
| - docker-compose.yml | ||
| - docker-compose.yml/** | ||
|
|
||
| # Add 'github-actions' label to any changes in the '.github' directory | ||
| github-actions: | ||
| - .github/workflows/* | ||
| - .github/workflows/*/** | ||
| - .github/dependabot.yml | ||
| - .github/dependabot.yml/** | ||
| # Add 'config' label to any changes in the 'config' directory | ||
| config: | ||
| - changed-files: | ||
| - any-glob-to-any-file: | ||
| - config/* | ||
| - config/** | ||
|
|
||
| # Add 'scripting' label to any changes in the 'scripts' directory | ||
| scripting: | ||
| - changed-files: | ||
| - any-glob-to-any-file: | ||
| - scripts/* | ||
| - scripts/*/** | ||
|
|
||
| # Add 'tooling' label to any changes in the 'build' directory | ||
| tooling: | ||
| - changed-files: | ||
| - any-glob-to-any-file: | ||
| - tools/* | ||
| - tools/** | ||
|
|
||
| # Add 'container' label to Dockerfile | ||
| container: | ||
| - changed-files: | ||
| - any-glob-to-any-file: | ||
| - build/**/Dockerfile | ||
| - build/img/**/Dockerfile | ||
|
|
||
| # Add 'release' label to any PR opened against the 'main' branch | ||
| release: | ||
| - base-branch: main |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| name: DevOS | ||
|
|
||
| on: | ||
| - workflow_call | ||
|
|
||
| permissions: read-all | ||
|
|
||
| jobs: | ||
| airskiff: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | ||
| - run: hack/run |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| name: SonarQube | ||
|
|
||
| on: | ||
| workflow_call: | ||
| inputs: | ||
| sonarqube: | ||
| type: boolean | ||
| default: false | ||
| description: Run SonarQube Quality Gate | ||
|
|
||
| permissions: read-all | ||
|
|
||
| jobs: | ||
| sonarqube: | ||
| runs-on: ubuntu-latest | ||
| if: ${{ inputs.sonarqube }} | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 https://github.com/actions/checkout/commit/692973e3d937129bcbf40652eb9f2f61becf3332 | ||
| with: | ||
| fetch-depth: 0 | ||
| persist-credentials: false | ||
| - name: SonarQube Quality Gate | ||
| uses: sonarsource/sonarqube-quality-gate-action@d304d050d930b02a896b0f85935344f023928496 # v1.1.0 https://github.com/SonarSource/sonarqube-quality-gate-action/commit/d304d050d930b02a896b0f85935344f023928496 | ||
| timeout-minutes: 5 | ||
| env: | ||
| SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }} | ||
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| name: Trivy | ||
|
|
||
| on: | ||
| - workflow_call | ||
|
|
||
| permissions: read-all | ||
|
|
||
| jobs: | ||
| trivy: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 https://github.com/actions/checkout/commit/692973e3d937129bcbf40652eb9f2f61becf3332 | ||
| with: | ||
| fetch-depth: 0 | ||
| persist-credentials: false | ||
| - name: Trivy Scan | ||
| uses: ./.github/actions/trivy | ||
| # with: | ||
| # generate-sbom: ${{ github.ref == 'refs/heads/main' && github.event_name == 'push' }} | ||
| # upload-scan-result: ${{ github.ref == 'refs/heads/main' && github.event_name == 'push' }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| name: Bot | ||
|
|
||
| on: | ||
| - workflow_call | ||
|
|
||
| permissions: | ||
| issues: write | ||
| pull-requests: write | ||
| repository-projects: write | ||
|
|
||
| jobs: | ||
| dependabot: | ||
| runs-on: ubuntu-latest | ||
| if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }} | ||
| steps: | ||
| - name: Dependabot metadata | ||
| id: metadata | ||
| uses: dependabot/fetch-metadata@dbb049abf0d677abbd7f7eee0375145b417fdd34 # v2.2.0 https://github.com/dependabot/fetch-metadata/commit/dbb049abf0d677abbd7f7eee0375145b417fdd34 | ||
| with: | ||
| alert-lookup: true | ||
| compat-lookup: true | ||
|
|
||
| - name: Approve a PR | ||
| shell: bash | ||
| run: | | ||
| gh pr checkout "$PR_URL" | ||
| if [ "$(gh pr status --json reviewDecision -q .currentBranch.reviewDecision)" != "APPROVED" ];then | ||
| gh pr review --approve "$PR_URL" | ||
| else | ||
| echo "PR already approved, skipping additional approvals to minimize emails/notification noise."; | ||
| fi | ||
| env: | ||
| GITHUB_TOKEN: ${{ github.token }} | ||
| PR_URL: ${{ github.event.pull_request.html_url }} | ||
|
|
||
| - name: Enable auto-merge for Dependabot PRs | ||
| if: ${{ steps.metadata.outputs.update-type == 'version-update:semver-patch' }} | ||
| shell: bash | ||
| run: gh pr merge --auto --merge "$PR_URL" | ||
| env: | ||
| GITHUB_TOKEN: ${{ github.token }} | ||
| PR_URL: ${{ github.event.pull_request.html_url }} | ||
|
|
||
| # todo: raise issue on failure for cron job | ||
| # todo: update issue on job run failure |
Oops, something went wrong.