Skip to content

Commit 59aa4b1

Browse files
evanharmon1evanharmon1
committed
updates
1 parent cae5c1a commit 59aa4b1

File tree

6 files changed

+114
-16
lines changed

6 files changed

+114
-16
lines changed

‎template/.github/{% if ci_cd == 'github_actions' %}workflows{% endif %}/release.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
contents: write
1212
steps:
1313
- name: Checkout Repository
14-
uses: actions/checkout@v3
14+
uses: actions/checkout@v4
1515
with:
1616
fetch-depth: 0 # Fetch all history for versioning
1717

‎template/.github/{% if ci_cd == 'github_actions' %}workflows{% endif %}/security.yml

Lines changed: 60 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ jobs:
66
runs-on: ubuntu-latest
77
steps:
88
- run: echo "Triggered by a ${{ github.event_name }} event."
9-
- uses: actions/checkout@v3
9+
- uses: actions/checkout@v4
1010
# E.g., to check for my `~/Local/.secret` file
1111
- name: Custom check for secret files
1212
run: ./check_for_pattern.sh . "*secret*"
@@ -22,8 +22,66 @@ jobs:
2222
run: whispers --config test/whisperConfig.yml --severity BLOCKER,CRITICAL . > /tmp/scan_output.json
2323
# Upload Artifacts
2424
- name: Upload the scan output
25-
uses: actions/upload-artifact@v3
25+
uses: actions/upload-artifact@v4
2626
with:
2727
name: scan_results
2828
path: /tmp/scan_output.json
2929
retention-days: 7
30+
sast-dependencies:
31+
runs-on: ubuntu-latest
32+
steps:
33+
- uses: actions/checkout@v4
34+
# Node.js dependencies scan
35+
- name: Setup Node.js
36+
uses: actions/setup-node@v4
37+
with:
38+
node-version: "22"
39+
cache: "npm"
40+
- name: Install Node dependencies
41+
run: npm ci
42+
- name: Run Snyk for Node.js
43+
uses: snyk/actions/node@master
44+
env:
45+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
46+
with:
47+
command: test
48+
args: >
49+
--severity-threshold=high
50+
--show-vulnerable-paths=all
51+
# Python dependencies scan
52+
- name: Setup Python
53+
uses: actions/setup-python@v4
54+
with:
55+
python-version: "3.9"
56+
- name: Install Python dependencies
57+
run: pip install -r requirements.txt
58+
- name: Run Snyk for Python
59+
uses: snyk/actions/python@master
60+
env:
61+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
62+
with:
63+
command: test
64+
args: >
65+
--file=requirements.txt
66+
--severity-threshold=high
67+
--show-vulnerable-paths=all
68+
sast-code:
69+
runs-on: ubuntu-latest
70+
steps:
71+
- uses: actions/checkout@v4
72+
- name: Setup Node.js
73+
uses: actions/setup-node@v4
74+
with:
75+
node-version: "22"
76+
cache: "npm"
77+
- name: Install dependencies
78+
run: npm ci
79+
- name: Run Snyk to check for vulnerabilities
80+
uses: snyk/actions/node@master
81+
env:
82+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
83+
with:
84+
command: code test
85+
args: >
86+
--severity-threshold=high
87+
--json-file-output=snyk-code-test.json

‎template/.github/{% if ci_cd == 'github_actions' %}workflows{% endif %}/validate.yml

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
name: Validate
1+
name: Validate Code
22
run-name: ${{ github.actor }} is running Validate Actions
33
on: [pull_request]
44
jobs:
5-
validate:
5+
preCommit:
66
runs-on: ubuntu-latest
77
steps:
88
- run: echo "Triggered by a ${{ github.event_name }} event."
@@ -12,3 +12,14 @@ jobs:
1212
python-version: 3.9
1313
- uses: pre-commit/[email protected]
1414
- uses: pre-commit-ci/[email protected]
15+
check:
16+
runs-on: ubuntu-latest
17+
steps:
18+
- uses: actions/checkout@v4
19+
- name: Use Node.js 22
20+
uses: actions/setup-node@v4
21+
with:
22+
node-version: 22
23+
cache: npm
24+
- run: npm ci
25+
- run: npm run check

‎template/README.md.jinja

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,12 @@
55
Author: {{ author_full_name }}
66

77
[![Validate](https://github.com/{{ author_git_provider_username }}/{{ project_slug }}/actions/workflows/validate.yml/badge.svg)](https://github.com/{{ author_git_provider_username }}/{{ project_slug }}/actions/workflows/validate.yml)
8+
[![Build](https://github.com/{{ author_git_provider_username }}/{{ project_slug }}/actions/workflows/build.yml/badge.svg)](https://github.com/{{ author_git_provider_username }}/{{ project_slug }}/actions/workflows/build.yml)
89
[![Security](https://github.com/{{ author_git_provider_username }}/{{ project_slug }}/actions/workflows/security.yml/badge.svg)](https://github.com/{{ author_git_provider_username }}/{{ project_slug }}/actions/workflows/security.yml)
910
[![Copier](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/copier-org/copier/master/img/badge/badge-grayscale-inverted-border-orange.json)](https://github.com/copier-org/copier)
11+
[![Maintained](https://img.shields.io/badge/maintained%3F-yes-brightgreen.svg?style=flat-square)](https://github.com/onwidget)
12+
[![Contributions Welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat-square)](https://github.com/onwidget/astrowind#contributing)
13+
[![Known Vulnerabilities](https://snyk.io/test/github/onwidget/astrowind/badge.svg?style=flat-square)](https://snyk.io/test/github/onwidget/astrowind)
1014

1115
## Setup & Installation
1216

‎template/Taskfile.yml.jinja

Lines changed: 35 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Taskfile for {{ project_name }}
2-
version: "3"
2+
version: '3'
33
tasks:
44
boostrap:
55
cmds:
@@ -13,25 +13,50 @@ tasks:
1313
silent: true
1414
validate:
1515
cmds:
16-
- pre-commit run --all-files
17-
# - shellcheck osConfig/mac/updateMac.sh
18-
# - shellcheck osConfig/mac/setupMac.sh
19-
# - shellcheck osConfig/mac/configureMacSettings.sh
16+
- task: preCommit
17+
- task: check
2018
silent: true
21-
pre-commit:
19+
preCommit:
2220
cmds:
2321
- pre-commit run --all-files
2422
silent: true
23+
check:
24+
cmds:
25+
- npm run check:astro
26+
- npm run check:eslint
27+
- cmd: npm run check:prettier
28+
# - shellcheck osConfig/mac/updateMac.sh
29+
# - shellcheck osConfig/mac/setupMac.sh
30+
# - shellcheck osConfig/mac/configureMacSettings.sh
31+
ignore_error: true
32+
silent: true
33+
fix:
34+
cmds:
35+
- npm run fix
36+
silent: true
2537
security:
38+
cmds:
39+
- task: secrets
40+
- task: sast
41+
ignore_error: true
42+
silent: true
43+
secrets:
2644
cmds:
2745
- ./check_for_pattern.sh . "*secret*"
2846
- whispers --config test/whisperConfig.yml --severity BLOCKER,CRITICAL .
29-
- task: snyk
3047
silent: true
31-
snyk:
48+
sast:
49+
cmds:
50+
- task: sast-dependencies
51+
- task: sast-code
52+
silent: true
53+
sast-dependencies:
54+
cmds:
55+
- snyk test --all-projects
56+
silent: true
57+
sast-code:
3258
cmds:
33-
- snyk test --file=requirements.txt
34-
- snyk test --file=package.json
59+
- snyk code test
3560
silent: true
3661
ghReleaseInit:
3762
cmds:

‎template/test/whisperConfig.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
include:
22
files:
3-
- "**/*"
3+
- '**/*'
44

55
exclude:
66
files:

0 commit comments

Comments
 (0)