Skip to content

Commit 02695b2

Browse files
jsf9kjsf9k
authored
Merge pull request #45 from cisagov/lineage/skeleton
⚠️ CONFLICT! Lineage pull request for: skeleton
2 parents 1133359 + d3d448b commit 02695b2

12 files changed

+142
-60
lines changed

‎.bandit.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
# https://bandit.readthedocs.io/en/latest/config.html
44

55
# Tests are first included by `tests`, and then excluded by `skips`.
6-
# If `tests` is empty, all tests are are considered included.
6+
# If `tests` is empty, all tests are considered included.
77

88
tests:
99
# - B101

‎.github/dependabot.yml

Lines changed: 22 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -5,34 +5,40 @@
55
# these updates when the pull request(s) in the appropriate skeleton are merged
66
# and Lineage processes these changes.
77

8-
version: 2
98
updates:
10-
- package-ecosystem: "github-actions"
11-
directory: "/"
12-
schedule:
13-
interval: "weekly"
9+
- directory: /
1410
ignore:
1511
# Managed by cisagov/skeleton-generic
1612
- dependency-name: actions/cache
1713
- dependency-name: actions/checkout
1814
- dependency-name: actions/setup-go
1915
- dependency-name: actions/setup-python
16+
- dependency-name: crazy-max/ghaction-dump-context
17+
- dependency-name: crazy-max/ghaction-github-labeler
18+
- dependency-name: crazy-max/ghaction-github-status
2019
- dependency-name: hashicorp/setup-terraform
2120
- dependency-name: mxschmitt/action-tmate
22-
23-
- package-ecosystem: "pip"
24-
directory: "/"
21+
- dependency-name: step-security/harden-runner
22+
# Managed by cisagov/skeleton-ansible-role-with-test-user
23+
- dependency-name: aws-actions/configure-aws-credentials
24+
package-ecosystem: github-actions
2525
schedule:
26-
interval: "weekly"
26+
interval: weekly
27+
28+
- directory: /
2729
ignore:
2830
# Managed by cisagov/skeleton-ansible-role
29-
- dependency-name: "ansible"
30-
- dependency-name: "ansible-lint"
31-
32-
- package-ecosystem: "terraform"
33-
directory: "/terraform"
31+
- dependency-name: ansible
32+
- dependency-name: ansible-lint
33+
package-ecosystem: pip
3434
schedule:
35-
interval: "weekly"
35+
interval: weekly
36+
37+
- directory: /terraform
3638
ignore:
3739
# Managed by cisagov/skeleton-ansible-role-with-test-user
38-
- dependency-name: "hashicorp/aws"
40+
- dependency-name: hashicorp/aws
41+
package-ecosystem: terraform
42+
schedule:
43+
interval: weekly
44+
version: 2

‎.github/workflows/build.yml

Lines changed: 50 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,36 @@ env:
1515
RUN_TMATE: ${{ secrets.RUN_TMATE }}
1616

1717
jobs:
18+
diagnostics:
19+
name: Run diagnostics
20+
runs-on: ubuntu-latest
21+
steps:
22+
# Note that a duplicate of this step must be added at the top of
23+
# each job.
24+
- id: harden-runner
25+
name: Harden the runner
26+
uses: step-security/harden-runner@v2
27+
with:
28+
egress-policy: audit
29+
- id: github-status
30+
name: Check GitHub status
31+
uses: crazy-max/ghaction-github-status@v3
32+
- id: dump-context
33+
name: Dump context
34+
uses: crazy-max/ghaction-dump-context@v2
1835
lint:
36+
needs:
37+
- diagnostics
1938
runs-on: ubuntu-latest
2039
steps:
40+
- id: harden-runner
41+
name: Harden the runner
42+
uses: step-security/harden-runner@v2
43+
with:
44+
egress-policy: audit
2145
- id: setup-env
2246
uses: cisagov/setup-env-github-action@develop
23-
- uses: actions/checkout@v3
47+
- uses: actions/checkout@v4
2448
- id: setup-python
2549
uses: actions/setup-python@v4
2650
with:
@@ -81,11 +105,26 @@ jobs:
81105
- uses: hashicorp/setup-terraform@v2
82106
with:
83107
terraform_version: ${{ steps.setup-env.outputs.terraform-version }}
108+
- name: Install go-critic
109+
env:
110+
PACKAGE_URL: github.com/go-critic/go-critic/cmd/gocritic
111+
PACKAGE_VERSION: ${{ steps.setup-env.outputs.go-critic-version }}
112+
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
113+
- name: Install gosec
114+
env:
115+
PACKAGE_URL: github.com/securego/gosec/v2/cmd/gosec
116+
PACKAGE_VERSION: ${{ steps.setup-env.outputs.gosec-version }}
117+
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
84118
- name: Install shfmt
85119
env:
86120
PACKAGE_URL: mvdan.cc/sh/v3/cmd/shfmt
87121
PACKAGE_VERSION: ${{ steps.setup-env.outputs.shfmt-version }}
88122
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
123+
- name: Install staticcheck
124+
env:
125+
PACKAGE_URL: honnef.co/go/tools/cmd/staticcheck
126+
PACKAGE_VERSION: ${{ steps.setup-env.outputs.staticcheck-version }}
127+
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
89128
- name: Install Terraform-docs
90129
env:
91130
PACKAGE_URL: github.com/terraform-docs/terraform-docs
@@ -103,14 +142,21 @@ jobs:
103142
uses: mxschmitt/action-tmate@v3
104143
if: env.RUN_TMATE
105144
test:
145+
needs:
146+
- diagnostics
147+
runs-on: ubuntu-latest
106148
strategy:
107149
fail-fast: false
108150
matrix:
109151
scenario:
110152
- default
111-
runs-on: ubuntu-latest
112153
steps:
113-
- uses: actions/checkout@v3
154+
- id: harden-runner
155+
name: Harden the runner
156+
uses: step-security/harden-runner@v2
157+
with:
158+
egress-policy: audit
159+
- uses: actions/checkout@v4
114160
- id: setup-python
115161
uses: actions/setup-python@v4
116162
with:
@@ -131,7 +177,7 @@ jobs:
131177
python -m pip install --upgrade pip
132178
pip install --upgrade --requirement requirements-test.txt
133179
- name: Assume AWS test role
134-
uses: aws-actions/configure-aws-credentials@v1
180+
uses: aws-actions/configure-aws-credentials@v4
135181
with:
136182
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
137183
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

‎.github/workflows/codeql-analysis.yml

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
#
55
# You may wish to alter this file to override the set of languages analyzed,
66
# or to provide custom queries or build logic.
7-
name: "CodeQL"
7+
name: CodeQL
88

99
on:
1010
push:
@@ -37,8 +37,14 @@ jobs:
3737
# https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
3838

3939
steps:
40+
- id: harden-runner
41+
name: Harden the runner
42+
uses: step-security/harden-runner@v2
43+
with:
44+
egress-policy: audit
45+
4046
- name: Checkout repository
41-
uses: actions/checkout@v3
47+
uses: actions/checkout@v4
4248

4349
# Initializes the CodeQL tools for scanning.
4450
- name: Initialize CodeQL

‎.github/workflows/sync-labels.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,10 @@ jobs:
1919
issues: write
2020
runs-on: ubuntu-latest
2121
steps:
22-
- uses: actions/checkout@v3
22+
- uses: actions/checkout@v4
2323
- name: Sync repository labels
2424
if: success()
25-
uses: crazy-max/ghaction-github-labeler@v4
25+
uses: crazy-max/ghaction-github-labeler@v5
2626
with:
2727
# This is a hideous ternary equivalent so we only do a dry run unless
2828
# this workflow is triggered by the develop branch.

‎.pre-commit-config.yaml

Lines changed: 19 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -31,13 +31,13 @@ repos:
3131

3232
# Text file hooks
3333
- repo: https://github.com/igorshubovych/markdownlint-cli
34-
rev: v0.34.0
34+
rev: v0.36.0
3535
hooks:
3636
- id: markdownlint
3737
args:
3838
- --config=.mdl_config.yaml
3939
- repo: https://github.com/pre-commit/mirrors-prettier
40-
rev: v3.0.0-alpha.9-for-vscode
40+
rev: v3.0.3
4141
hooks:
4242
- id: prettier
4343
- repo: https://github.com/adrienverge/yamllint
@@ -49,14 +49,14 @@ repos:
4949

5050
# GitHub Actions hooks
5151
- repo: https://github.com/python-jsonschema/check-jsonschema
52-
rev: 0.23.1
52+
rev: 0.26.3
5353
hooks:
5454
- id: check-github-actions
5555
- id: check-github-workflows
5656

5757
# pre-commit hooks
5858
- repo: https://github.com/pre-commit/pre-commit
59-
rev: v3.3.2
59+
rev: v3.4.0
6060
hooks:
6161
- id: validate_manifest
6262

@@ -79,6 +79,12 @@ repos:
7979
# GoSec
8080
- id: go-sec-repo-mod
8181

82+
# Nix hooks
83+
- repo: https://github.com/nix-community/nixpkgs-fmt
84+
rev: v1.3.0
85+
hooks:
86+
- id: nixpkgs-fmt
87+
8288
# Shell script hooks
8389
- repo: https://github.com/cisagov/pre-commit-shfmt
8490
rev: v0.0.2
@@ -105,15 +111,15 @@ repos:
105111
hooks:
106112
- id: bandit
107113
# Bandit complains about the use of assert() in tests
108-
exclude: molecule/default/tests
114+
exclude: molecule/(default|systemd_enabled)/tests
109115
args:
110116
- --config=.bandit.yml
111-
- repo: https://github.com/psf/black
112-
rev: 23.3.0
117+
- repo: https://github.com/psf/black-pre-commit-mirror
118+
rev: 23.9.1
113119
hooks:
114120
- id: black
115121
- repo: https://github.com/PyCQA/flake8
116-
rev: 6.0.0
122+
rev: 6.1.0
117123
hooks:
118124
- id: flake8
119125
additional_dependencies:
@@ -123,24 +129,24 @@ repos:
123129
hooks:
124130
- id: isort
125131
- repo: https://github.com/pre-commit/mirrors-mypy
126-
rev: v1.3.0
132+
rev: v1.5.1
127133
hooks:
128134
- id: mypy
129135
- repo: https://github.com/asottile/pyupgrade
130-
rev: v3.4.0
136+
rev: v3.10.1
131137
hooks:
132138
- id: pyupgrade
133139

134140
# Ansible hooks
135-
- repo: https://github.com/ansible-community/ansible-lint
136-
rev: v6.17.0
141+
- repo: https://github.com/ansible/ansible-lint
142+
rev: v6.19.0
137143
hooks:
138144
- id: ansible-lint
139145
# files: molecule/default/playbook.yml
140146

141147
# Terraform hooks
142148
- repo: https://github.com/antonbabenko/pre-commit-terraform
143-
rev: v1.80.0
149+
rev: v1.83.2
144150
hooks:
145151
- id: terraform_fmt
146152
- id: terraform_validate

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ Here's how to use it in a playbook:
7878

7979
```yaml
8080
- hosts: all
81-
become: yes
81+
become: true
8282
become_method: sudo
8383
tasks:
8484
- name: Install and trust CDM certificates

‎meta/main.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
---
2+
# Note that dependencies listed here are automatically installed
3+
# before this role. Role variables for any roles listed here can be
4+
# assigned static variables.
5+
#
6+
# See also cisagov/skeleton-ansible-role#153.
27
dependencies: []
38
galaxy_info:
49
author: Shane Frasier
@@ -37,3 +42,4 @@ galaxy_info:
3742
- focal
3843
- jammy
3944
role_name: cdm_certificates
45+
standalone: true

‎meta/requirements.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
# Note that dependencies listed here are made available to the role
3+
# but _are not_ automatically installed. Role variables cannot be
4+
# specified here.
5+
#
6+
# It _is_ possible to list both collections and roles in this file,
7+
# but unfortunately ansible-galaxy attempts to naively merge the
8+
# dependencies listed in meta/main.yml with these. That means that
9+
# both sets of dependencies must be lists. :(
10+
#
11+
# See also cisagov/skeleton-ansible-role#153.
12+
[]

0 commit comments

Comments
 (0)