Skip to content

Commit 53305c9

Browse files
author
jsf9k
committed
# Conflicts: # .github/dependabot.yml # .github/workflows/build.yml # .github/workflows/codeql-analysis.yml # meta/main.yml # molecule/default/molecule.yml # molecule/default/prepare.yml # requirements-test.txt
2 parents 761e993 + e940403 commit 53305c9

File tree

11 files changed

+747
-93
lines changed

11 files changed

+747
-93
lines changed

‎.github/CODEOWNERS

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -3,22 +3,22 @@
33
# These owners will be the default owners for everything in the
44
# repo. Unless a later match takes precedence, these owners will be
55
# requested for review when someone opens a pull request.
6-
* @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
6+
* @dav3r @felddy @jsf9k @mcdonnnj
77

88
# These folks own any files in the .github directory at the root of
99
# the repository and any of its subdirectories.
10-
/.github/ @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
10+
/.github/ @dav3r @felddy @jsf9k @mcdonnnj
1111

1212
# These folks own all linting configuration files.
13-
/.ansible-lint @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
14-
/.bandit.yml @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
15-
/.flake8 @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
16-
/.isort.cfg @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
17-
/.mdl_config.yaml @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
18-
/.pre-commit-config.yaml @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
19-
/.prettierignore @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
20-
/.yamllint @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
21-
/requirements.txt @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
22-
/requirements-dev.txt @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
23-
/requirements-test.txt @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
24-
/setup-env @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
13+
/.ansible-lint @dav3r @felddy @jsf9k @mcdonnnj
14+
/.bandit.yml @dav3r @felddy @jsf9k @mcdonnnj
15+
/.flake8 @dav3r @felddy @jsf9k @mcdonnnj
16+
/.isort.cfg @dav3r @felddy @jsf9k @mcdonnnj
17+
/.mdl_config.yaml @dav3r @felddy @jsf9k @mcdonnnj
18+
/.pre-commit-config.yaml @dav3r @felddy @jsf9k @mcdonnnj
19+
/.prettierignore @dav3r @felddy @jsf9k @mcdonnnj
20+
/.yamllint @dav3r @felddy @jsf9k @mcdonnnj
21+
/requirements.txt @dav3r @felddy @jsf9k @mcdonnnj
22+
/requirements-dev.txt @dav3r @felddy @jsf9k @mcdonnnj
23+
/requirements-test.txt @dav3r @felddy @jsf9k @mcdonnnj
24+
/setup-env @dav3r @felddy @jsf9k @mcdonnnj

‎.github/dependabot.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,12 @@ updates:
1313
- dependency-name: actions/checkout
1414
- dependency-name: actions/setup-go
1515
- dependency-name: actions/setup-python
16+
- dependency-name: cisagov/setup-env-github-action
1617
- dependency-name: crazy-max/ghaction-dump-context
1718
- dependency-name: crazy-max/ghaction-github-labeler
1819
- dependency-name: crazy-max/ghaction-github-status
20+
- dependency-name: GitHubSecurityLab/actions-permissions
21+
- dependency-name: hashicorp/setup-packer
1922
- dependency-name: hashicorp/setup-terraform
2023
- dependency-name: mxschmitt/action-tmate
2124
- dependency-name: step-security/harden-runner
@@ -28,10 +31,19 @@ updates:
2831
interval: weekly
2932

3033
- directory: /
34+
<<<<<<< HEAD
3135
ignore:
3236
# Managed by cisagov/skeleton-ansible-role
3337
- dependency-name: ansible
3438
- dependency-name: ansible-core
39+
=======
40+
# ignore:
41+
# # Managed by cisagov/skeleton-ansible-role
42+
# - dependency-name: ansible
43+
# - dependency-name: ansible-core
44+
# - dependency-name: molecule
45+
# - dependency-name: pytest-testinfra
46+
>>>>>>> e940403688abc64b9455c3903285c42bb978cc35
3547
package-ecosystem: pip
3648
schedule:
3749
interval: weekly

‎.github/workflows/build.yml

Lines changed: 100 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ defaults:
2020
shell: bash -Eueo pipefail -x {0}
2121

2222
env:
23-
CURL_CACHE_DIR: ~/.cache/curl
2423
PIP_CACHE_DIR: ~/.cache/pip
2524
PRE_COMMIT_CACHE_DIR: ~/.cache/pre-commit
2625
RUN_TMATE: ${{ secrets.RUN_TMATE }}
@@ -31,10 +30,18 @@ env:
3130
jobs:
3231
diagnostics:
3332
name: Run diagnostics
33+
# This job does not need any permissions
34+
permissions: {}
3435
runs-on: ubuntu-latest
3536
steps:
3637
# Note that a duplicate of this step must be added at the top of
3738
# each job.
39+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
40+
with:
41+
# Uses the organization variable unless overridden
42+
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
43+
# Note that a duplicate of this step must be added at the top of
44+
# each job.
3845
- id: harden-runner
3946
name: Harden the runner
4047
uses: step-security/harden-runner@v2
@@ -49,8 +56,15 @@ jobs:
4956
lint:
5057
needs:
5158
- diagnostics
59+
permissions:
60+
# actions/checkout needs this to fetch code
61+
contents: read
5262
runs-on: ubuntu-latest
5363
steps:
64+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
65+
with:
66+
# Uses the organization variable unless overridden
67+
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
5468
- id: harden-runner
5569
name: Harden the runner
5670
uses: step-security/harden-runner@v2
@@ -76,7 +90,7 @@ jobs:
7690
name: Lookup Go cache directory
7791
run: |
7892
echo "dir=$(go env GOCACHE)" >> $GITHUB_OUTPUT
79-
- uses: actions/cache@v3
93+
- uses: actions/cache@v4
8094
env:
8195
BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\
8296
py${{ steps.setup-python.outputs.python-version }}-\
@@ -97,25 +111,12 @@ jobs:
97111
path: |
98112
${{ env.PIP_CACHE_DIR }}
99113
${{ env.PRE_COMMIT_CACHE_DIR }}
100-
${{ env.CURL_CACHE_DIR }}
101114
${{ steps.go-cache.outputs.dir }}
102115
restore-keys: |
103116
${{ env.BASE_CACHE_KEY }}
104-
- name: Setup curl cache
105-
run: mkdir -p ${{ env.CURL_CACHE_DIR }}
106-
- name: Install Packer
107-
env:
108-
PACKER_VERSION: ${{ steps.setup-env.outputs.packer-version }}
109-
run: |
110-
PACKER_ZIP="packer_${PACKER_VERSION}_linux_amd64.zip"
111-
curl --output ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}" \
112-
--time-cond ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}" \
113-
--location \
114-
"https://releases.hashicorp.com/packer/${PACKER_VERSION}/${PACKER_ZIP}"
115-
sudo unzip -d /opt/packer \
116-
${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}"
117-
sudo mv /usr/local/bin/packer /usr/local/bin/packer-default
118-
sudo ln -s /opt/packer/packer /usr/local/bin/packer
117+
- uses: hashicorp/setup-packer@v3
118+
with:
119+
version: ${{ steps.setup-env.outputs.packer-version }}
119120
- uses: hashicorp/setup-terraform@v3
120121
with:
121122
terraform_version: ${{ steps.setup-env.outputs.terraform-version }}
@@ -171,3 +172,84 @@ jobs:
171172
- name: Setup tmate debug session
172173
uses: mxschmitt/action-tmate@v3
173174
if: env.RUN_TMATE
175+
<<<<<<< HEAD
176+
=======
177+
test:
178+
name: >-
179+
test (${{ matrix.scenario }}) -
180+
${{ matrix.platform }}-${{ matrix.architecture }}
181+
needs:
182+
- diagnostics
183+
permissions:
184+
# actions/checkout needs this to fetch code
185+
contents: read
186+
runs-on: ubuntu-latest
187+
strategy:
188+
fail-fast: false
189+
matrix:
190+
architecture:
191+
- amd64
192+
- arm64
193+
platform:
194+
- amazonlinux2023-systemd
195+
- debian10-systemd
196+
- debian11-systemd
197+
- debian12-systemd
198+
- debian13-systemd
199+
- fedora39-systemd
200+
- fedora40-systemd
201+
- fedora41-systemd
202+
- kali-systemd
203+
- ubuntu-20-systemd
204+
- ubuntu-22-systemd
205+
- ubuntu-24-systemd
206+
scenario:
207+
- default
208+
steps:
209+
# With this task in place the GitHub runners run out of
210+
# resources and crash. See cisagov/skeleton-ansible-role#211
211+
# for more details.
212+
# - uses: GitHubSecurityLab/actions-permissions/monitor@v1
213+
# with:
214+
# # Uses the organization variable unless overridden
215+
# config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
216+
- id: harden-runner
217+
name: Harden the runner
218+
uses: step-security/harden-runner@v2
219+
with:
220+
egress-policy: audit
221+
- id: setup-env
222+
uses: cisagov/setup-env-github-action@develop
223+
- uses: actions/checkout@v4
224+
- id: setup-python
225+
uses: actions/setup-python@v5
226+
with:
227+
python-version: ${{ steps.setup-env.outputs.python-version }}
228+
- uses: actions/cache@v4
229+
env:
230+
BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\
231+
py${{ steps.setup-python.outputs.python-version }}-"
232+
with:
233+
path: ${{ env.PIP_CACHE_DIR }}
234+
key: "${{ env.BASE_CACHE_KEY }}\
235+
${{ hashFiles('**/requirements-test.txt') }}-\
236+
${{ hashFiles('**/requirements.txt') }}"
237+
restore-keys: |
238+
${{ env.BASE_CACHE_KEY }}
239+
- name: Install dependencies
240+
run: |
241+
python -m pip install --upgrade pip
242+
pip install --upgrade --requirement requirements-test.txt
243+
- name: Set up QEMU
244+
uses: docker/setup-qemu-action@v3
245+
- name: Set up Docker Buildx
246+
uses: docker/setup-buildx-action@v3
247+
- name: Run molecule tests
248+
run: >-
249+
molecule test
250+
--platform-name ${{ matrix.platform }}-${{ matrix.architecture }}
251+
--scenario-name ${{ matrix.scenario }}
252+
- name: Setup tmate debug session
253+
uses: mxschmitt/action-tmate@v3
254+
if: env.RUN_TMATE
255+
>>>>>>> e940403688abc64b9455c3903285c42bb978cc35

‎.github/workflows/codeql-analysis.yml

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
---
2+
# For most projects, this workflow file will not need changing; you simply need
3+
# to commit it to your repository.
4+
#
5+
# You may wish to alter this file to override the set of languages analyzed,
6+
# or to provide custom queries or build logic.
7+
name: CodeQL
8+
9+
on:
10+
merge_group:
11+
types:
12+
- checks_requested
13+
push:
14+
# Dependabot triggered push events have read-only access, but uploading code
15+
# scanning requires write access.
16+
branches-ignore:
17+
- dependabot/**
18+
pull_request:
19+
# The branches below must be a subset of the branches above
20+
branches:
21+
- develop
22+
schedule:
23+
- cron: '0 2 * * 6'
24+
25+
jobs:
26+
diagnostics:
27+
name: Run diagnostics
28+
# This job does not need any permissions
29+
permissions: {}
30+
runs-on: ubuntu-latest
31+
steps:
32+
# Note that a duplicate of this step must be added at the top of
33+
# each job.
34+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
35+
with:
36+
# Uses the organization variable unless overridden
37+
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
38+
# Note that a duplicate of this step must be added at the top of
39+
# each job.
40+
- id: harden-runner
41+
name: Harden the runner
42+
uses: step-security/harden-runner@v2
43+
with:
44+
egress-policy: audit
45+
- id: github-status
46+
name: Check GitHub status
47+
uses: crazy-max/ghaction-github-status@v4
48+
- id: dump-context
49+
name: Dump context
50+
uses: crazy-max/ghaction-dump-context@v2
51+
analyze:
52+
name: Analyze
53+
needs:
54+
- diagnostics
55+
runs-on: ubuntu-latest
56+
permissions:
57+
# actions/checkout needs this to fetch code
58+
contents: read
59+
# required for all workflows
60+
security-events: write
61+
strategy:
62+
fail-fast: false
63+
matrix:
64+
# Override automatic language detection by changing the below list
65+
# Supported options are go, javascript, csharp, python, cpp, and java
66+
language:
67+
- python
68+
# Learn more...
69+
# https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
70+
71+
steps:
72+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
73+
with:
74+
# Uses the organization variable unless overridden
75+
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
76+
- id: harden-runner
77+
name: Harden the runner
78+
uses: step-security/harden-runner@v2
79+
with:
80+
egress-policy: audit
81+
82+
- name: Checkout repository
83+
uses: actions/checkout@v4
84+
85+
# Initializes the CodeQL tools for scanning.
86+
- name: Initialize CodeQL
87+
uses: github/codeql-action/init@v3
88+
with:
89+
languages: ${{ matrix.language }}
90+
91+
# Autobuild attempts to build any compiled languages (C/C++, C#, or
92+
# Java). If this step fails, then you should remove it and run the build
93+
# manually (see below).
94+
- name: Autobuild
95+
uses: github/codeql-action/autobuild@v3
96+
97+
# ℹ️ Command-line programs to run using the OS shell.
98+
# 📚 https://git.io/JvXDl
99+
100+
# ✏️ If the Autobuild fails above, remove it and uncomment the following
101+
# three lines and modify them (or add more) to build your code if your
102+
# project uses a compiled language
103+
104+
# - run: |
105+
# make bootstrap
106+
# make release
107+
108+
- name: Perform CodeQL Analysis
109+
uses: github/codeql-action/analyze@v3

‎.github/workflows/sync-labels.yml

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,27 +4,36 @@ name: sync-labels
44
on:
55
push:
66
paths:
7-
- '.github/labels.yml'
8-
- '.github/workflows/sync-labels.yml'
7+
- .github/labels.yml
8+
- .github/workflows/sync-labels.yml
9+
workflow_dispatch:
910

1011
permissions:
1112
contents: read
1213

1314
jobs:
1415
diagnostics:
1516
name: Run diagnostics
17+
# This job does not need any permissions
18+
permissions: {}
1619
runs-on: ubuntu-latest
1720
steps:
1821
# Note that a duplicate of this step must be added at the top of
1922
# each job.
23+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
24+
with:
25+
# Uses the organization variable unless overridden
26+
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
27+
# Note that a duplicate of this step must be added at the top of
28+
# each job.
2029
- id: harden-runner
2130
name: Harden the runner
2231
uses: step-security/harden-runner@v2
2332
with:
2433
egress-policy: audit
2534
- id: github-status
2635
name: Check GitHub status
27-
uses: crazy-max/ghaction-github-status@v3
36+
uses: crazy-max/ghaction-github-status@v4
2837
- id: dump-context
2938
name: Dump context
3039
uses: crazy-max/ghaction-dump-context@v2
@@ -38,6 +47,10 @@ jobs:
3847
issues: write
3948
runs-on: ubuntu-latest
4049
steps:
50+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
51+
with:
52+
# Uses the organization variable unless overridden
53+
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
4154
- id: harden-runner
4255
name: Harden the runner
4356
uses: step-security/harden-runner@v2

0 commit comments

Comments
 (0)