Skip to content

Commit 2976526

Browse files
andywick-awsandywick-aws
authored
Merge pull request #91 from andywick-aws/actions
GitHub actions and fixes for flake8 findings
2 parents 65ba130 + b52a263 commit 2976526

File tree

22 files changed

+3388
-2105
lines changed

22 files changed

+3388
-2105
lines changed

‎.flake8

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[flake8]
22
max-line-length = 150
3-
max-complexity = 10
4-
max-cognitive-complexity = 10
5-
max-parameters-amount = 7
3+
max-complexity = 15
4+
max-cognitive-complexity = 15
5+
max-parameters-amount = 8
66
min_python_version = 3.9.0
77
copyright-regexp = Copyright Amazon.com, Inc\..*
88
exclude =

‎.github/workflows/bandit.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: bandit - Python Scan
2+
3+
on: push
4+
5+
jobs:
6+
build:
7+
runs-on: ubuntu-latest
8+
strategy:
9+
matrix:
10+
python-version: ['3.9']
11+
steps:
12+
- uses: actions/checkout@v3
13+
- name: Set up Python ${{ matrix.python-version }}
14+
uses: actions/setup-python@v3
15+
with:
16+
python-version: ${{ matrix.python-version }}
17+
- name: Install
18+
run: |
19+
python -m pip install --upgrade pip
20+
python -m pip install bandit
21+
- name: Bandit Check
22+
run: bandit -r -lll -ii .

‎.github/workflows/cfn-nag.yml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: cfn-nag - CloudFormation Scan
2+
3+
on: push
4+
5+
jobs:
6+
build:
7+
runs-on: ubuntu-latest
8+
steps:
9+
- uses: actions/checkout@v3
10+
- name: Set up Ruby 2.6
11+
uses: actions/setup-ruby@v1
12+
with:
13+
ruby-version: '2.6'
14+
- name: Install cfn-nag
15+
run: gem install cfn-nag
16+
- name: Scan files in all templates folders
17+
run: |
18+
export deployment_dir=`pwd`
19+
echo "$deployment_dir"
20+
for i in $(find . -type f | grep -E '.template$|.yaml$|.yml$|.json$' | sed 's/^.\///') ; do
21+
echo $i
22+
if [[ "$i" == *"templates"* ]]; then
23+
cfn_nag_scan --input-path "$deployment_dir/$i"
24+
if [ $? -ne 0 ]; then
25+
echo "cfn-nag failed validation - $i"
26+
exit 1
27+
fi
28+
fi
29+
done

‎.github/workflows/checkov.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: checkov - CloudFormation Scan
2+
3+
on: push
4+
5+
jobs:
6+
build:
7+
runs-on: ubuntu-latest
8+
strategy:
9+
matrix:
10+
python-version: ['3.9']
11+
steps:
12+
- uses: actions/checkout@v3
13+
- name: Set up Python ${{ matrix.python-version }}
14+
uses: actions/setup-python@v3
15+
with:
16+
python-version: ${{ matrix.python-version }}
17+
- name: Install
18+
run: |
19+
python -m pip install --upgrade pip
20+
python -m pip install checkov
21+
- name: checkov scan
22+
run: checkov --quiet -d aws_sra_examples

‎.github/workflows/markdown-links.yml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
name: Markdown Link Check
2+
3+
on: push
4+
5+
jobs:
6+
markdown-link-check:
7+
runs-on: ubuntu-latest
8+
steps:
9+
- uses: actions/checkout@v3
10+
- uses: gaurav-nelson/github-action-markdown-link-check@v1
11+
with:
12+
use-quiet-mode: 'yes'
13+
use-verbose-mode: 'no'

‎.github/workflows/pylic.yml

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: pylic - Python License Check
2+
3+
on: push
4+
5+
jobs:
6+
Linting:
7+
runs-on: ubuntu-latest
8+
strategy:
9+
fail-fast: true
10+
matrix:
11+
python-version: [3.9]
12+
steps:
13+
#----------------------------------------------
14+
# check-out repo and set-up python
15+
#----------------------------------------------
16+
- name: Check out repository
17+
uses: actions/checkout@v3
18+
- name: Set up python
19+
id: setup-python
20+
uses: actions/setup-python@v3
21+
with:
22+
python-version: 3.9
23+
#----------------------------------------------
24+
# ----- install & configure poetry -----
25+
#----------------------------------------------
26+
- name: Load Cached Poetry Installation
27+
uses: actions/cache@v3
28+
with:
29+
path: ~/.local # the path depends on the OS
30+
key: poetry-no-dev-2 # increment to reset cache
31+
- name: Install Poetry
32+
uses: snok/install-poetry@v1
33+
with:
34+
virtualenvs-create: true
35+
virtualenvs-in-project: true
36+
installer-parallel: true
37+
#----------------------------------------------
38+
# load cached venv if cache exists
39+
#----------------------------------------------
40+
- name: Load cached venv
41+
id: cached-poetry-no-dev-dependencies
42+
uses: actions/cache@v3
43+
with:
44+
path: .venv
45+
key: venv-no-dev-dependencies-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('**/poetry.lock') }}
46+
#----------------------------------------------
47+
# install dependencies if cache does not exist
48+
#----------------------------------------------
49+
- name: Install dependencies
50+
if: steps.cached-poetry-no-dev-dependencies.outputs.cache-hit != 'true'
51+
run: poetry install --no-dev --no-root
52+
#----------------------------------------------
53+
# Run pylic check
54+
#----------------------------------------------
55+
- name: pylic check
56+
run: |
57+
poetry run pip install pylic
58+
poetry run pylic check

‎.github/workflows/safety.yml

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: safety - Python Dependency Check
2+
3+
on: push
4+
5+
jobs:
6+
Linting:
7+
runs-on: ubuntu-latest
8+
strategy:
9+
fail-fast: true
10+
matrix:
11+
python-version: [3.9]
12+
steps:
13+
#----------------------------------------------
14+
# check-out repo and set-up python
15+
#----------------------------------------------
16+
- name: Check out repository
17+
uses: actions/checkout@v3
18+
- name: Set up python
19+
id: setup-python
20+
uses: actions/setup-python@v3
21+
with:
22+
python-version: 3.9
23+
#----------------------------------------------
24+
# ----- install & configure poetry -----
25+
#----------------------------------------------
26+
- name: Load Cached Poetry Installation
27+
uses: actions/cache@v3
28+
with:
29+
path: ~/.local # the path depends on the OS
30+
key: poetry-no-dev-2 # increment to reset cache
31+
- name: Install Poetry
32+
uses: snok/install-poetry@v1
33+
with:
34+
virtualenvs-create: true
35+
virtualenvs-in-project: true
36+
installer-parallel: true
37+
#----------------------------------------------
38+
# load cached venv if cache exists
39+
#----------------------------------------------
40+
- name: Load cached venv
41+
id: cached-poetry-no-dev-dependencies
42+
uses: actions/cache@v3
43+
with:
44+
path: .venv
45+
key: venv-no-dev-dependencies-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('**/poetry.lock') }}
46+
#----------------------------------------------
47+
# install dependencies if cache does not exist
48+
#----------------------------------------------
49+
- name: Install dependencies
50+
if: steps.cached-poetry-no-dev-dependencies.outputs.cache-hit != 'true'
51+
run: poetry install --no-dev --no-root
52+
#----------------------------------------------
53+
# Run Safety check
54+
#----------------------------------------------
55+
- name: Safety check
56+
run: |
57+
poetry run pip install safety
58+
poetry run safety check

‎.github/workflows/static-checking.yml

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
name: Static Checks (mypy, flake8, black, isort)
2+
3+
on: push
4+
5+
jobs:
6+
Linting:
7+
runs-on: ubuntu-latest
8+
strategy:
9+
fail-fast: true
10+
matrix:
11+
python-version: [3.9]
12+
steps:
13+
#----------------------------------------------
14+
# check-out repo and set-up python
15+
#----------------------------------------------
16+
- name: Check out repository
17+
uses: actions/checkout@v3
18+
- name: Set up python
19+
id: setup-python
20+
uses: actions/setup-python@v3
21+
with:
22+
python-version: 3.9
23+
#----------------------------------------------
24+
# ----- install & configure poetry -----
25+
#----------------------------------------------
26+
- name: Load Cached Poetry Installation
27+
uses: actions/cache@v3
28+
with:
29+
path: ~/.local # the path depends on the OS
30+
key: poetry-with-dev-0 # increment to reset cache
31+
- name: Install Poetry
32+
uses: snok/install-poetry@v1
33+
with:
34+
virtualenvs-create: true
35+
virtualenvs-in-project: true
36+
installer-parallel: true
37+
38+
#----------------------------------------------
39+
# load cached venv if cache exists
40+
#----------------------------------------------
41+
- name: Load cached venv
42+
id: cached-poetry-with-dev-dependencies
43+
uses: actions/cache@v3
44+
with:
45+
path: .venv
46+
key: venv-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('**/poetry.lock') }}
47+
#----------------------------------------------
48+
# install dependencies if cache does not exist
49+
#----------------------------------------------
50+
- name: Install dependencies
51+
if: steps.cached-poetry-with-dev-dependencies.outputs.cache-hit != 'true'
52+
run: poetry install --no-interaction --no-root
53+
#----------------------------------------------
54+
# Activate virtual environment
55+
#----------------------------------------------
56+
- name: Activate Virtual Environment
57+
run: source .venv/bin/activate
58+
#----------------------------------------------
59+
# Run MyPY check
60+
#----------------------------------------------
61+
- name: mypy check
62+
run: poetry run mypy aws_sra_examples
63+
#----------------------------------------------
64+
# Run Flake8 check
65+
#----------------------------------------------
66+
- name: Flake8 Lint
67+
run: poetry run flake8 aws_sra_examples
68+
#----------------------------------------------
69+
# Run Python Black check
70+
#----------------------------------------------
71+
- name: Black style check
72+
run: poetry run black --check aws_sra_examples
73+
#----------------------------------------------
74+
# Run isort check
75+
#----------------------------------------------
76+
- name: Imports order check (isort)
77+
run: poetry run isort --check aws_sra_examples

‎CHANGELOG.md

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
## Table of Contents<!-- omit in toc -->
44

55
- [Introduction](#introduction)
6+
- [2022-04-10](#2022-04-10)
67
- [2022-04-04](#2022-04-04)
78
- [2022-03-29](#2022-03-29)
89
- [2022-03-16](#2022-03-16)
@@ -24,6 +25,17 @@ All notable changes to this project will be documented in this file.
2425

2526
---
2627

28+
## 2022-04-10
29+
30+
### Added<!-- omit in toc -->
31+
32+
- Added GitHub action workflow templates to run code quality and security checks.
33+
34+
### Changed<!-- omit in toc -->
35+
36+
- Updated Lambda python files to fix and suppress flake8 findings.
37+
- Updated dependencies within the pyproject.toml file to the latest version.
38+
2739
## 2022-04-04
2840

2941
### Changed<!-- omit in toc -->

‎aws_sra_examples/solutions/cloudtrail/cloudtrail_org/lambda/src/app.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
import logging
1313
import os
1414
import re
15-
from typing import TYPE_CHECKING, Union
15+
from typing import TYPE_CHECKING, Optional
1616

1717
import boto3
1818
from crhelper import CfnResource
@@ -129,7 +129,7 @@ def get_cloudtrail_parameters(is_create: bool, params: dict) -> dict:
129129
return cloudtrail_params
130130

131131

132-
def parameter_pattern_validator(parameter_name: str, parameter_value: Union[str, None], pattern: str) -> None:
132+
def parameter_pattern_validator(parameter_name: str, parameter_value: Optional[str], pattern: str) -> None:
133133
"""Validate CloudFormation Custom Resource Parameters.
134134
135135
Args:

0 commit comments

Comments
 (0)