Skip to content

Commit 761ffb6

Browse files
kayman-mkkayman-mk
committed
merge main
2 parents 017cb7f + ed99ab9 commit 761ffb6

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

59 files changed

+1679
-862
lines changed

‎.cspell.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"version": "0.2",
3+
"language": "en",
4+
"words": [
5+
"amannn",
6+
"anytrue",
7+
"aquasecurity",
8+
"awscli",
9+
"backports",
10+
"blockquotes",
11+
"codeowners",
12+
"concat",
13+
"devskim",
14+
"dind",
15+
"gitter",
16+
"kics",
17+
"jsonencode",
18+
"markdownlint",
19+
"Niek",
20+
"npalm",
21+
"oxsecurity",
22+
"shuf",
23+
"signoff",
24+
"substr",
25+
"templatefile",
26+
"terrascan",
27+
"tfenv",
28+
"tflint",
29+
"tfsec",
30+
"tfvars",
31+
"tmpfs",
32+
"trivy",
33+
"userdata"
34+
],
35+
"flagWords": []
36+
}

‎.github/workflows/ci.yml‎

Lines changed: 91 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,23 @@
1+
---
12
name: CI
2-
on:
3-
push:
4-
branches:
5-
- main
3+
4+
on: # yamllint disable-line rule:truthy
65
pull_request:
76

7+
concurrency:
8+
group: ${{ github.ref }}-${{ github.workflow }}
9+
cancel-in-progress: true
10+
11+
permissions:
12+
contents: read
13+
pull-requests: write
14+
815
jobs:
916
verify_module:
1017
name: Verify module
1118
strategy:
1219
matrix:
13-
terraform: [1.3.9]
20+
terraform: [ 1.3.9 ]
1421
runs-on: ubuntu-latest
1522
container:
1623
image: hashicorp/terraform:${{ matrix.terraform }}
@@ -24,14 +31,15 @@ jobs:
2431
strategy:
2532
fail-fast: false
2633
matrix:
27-
terraform: [1.3.9, latest]
34+
terraform: [ 1.0.11, 1.3.9, latest ]
2835
example:
2936
[
3037
"runner-default",
3138
"runner-docker",
3239
"runner-multi-region",
3340
"runner-pre-registered",
3441
"runner-public",
42+
"runner-certificates"
3543
]
3644
defaults:
3745
run:
@@ -46,13 +54,89 @@ jobs:
4654
run: terraform fmt -recursive -check=true -write=false
4755
- run: terraform validate
4856

57+
linter:
58+
name: MegaLinter
59+
runs-on: ubuntu-latest
60+
steps:
61+
# Git Checkout
62+
- name: Checkout Code
63+
uses: actions/checkout@v3
64+
with:
65+
token: ${{ secrets.GITHUB_TOKEN }}
66+
fetch-depth: 0 # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to improve performances
67+
68+
# MegaLinter
69+
- name: MegaLinter
70+
id: ml
71+
# You can override MegaLinter flavor used to have faster performances
72+
# More info at https://megalinter.io/flavors/
73+
uses: oxsecurity/megalinter@v6
74+
env:
75+
# All available variables are described in documentation
76+
# https://megalinter.io/configuration/
77+
VALIDATE_ALL_CODEBASE: false
78+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
79+
# ADD YOUR CUSTOM ENV VARIABLES HERE OR DEFINE THEM IN A FILE .mega-linter.yml AT THE ROOT OF YOUR REPOSITORY
80+
SPELL_CSPELL_FILTER_REGEX_EXCLUDE: (\.gitignore|.tflint.hcl|CHANGELOG.md)
81+
# needed to avoid multiple error messages
82+
TERRAFORM_TERRASCAN_ARGUMENTS: "--non-recursive"
83+
# format issues fail the build
84+
TERRAFORM_TERRAFORM_FMT_DISABLE_ERRORS: false
85+
# ignore: "tags not used", "access analyzer not used", "shield advanced not used"
86+
TERRAFORM_KICS_ARGUMENTS: "--exclude-queries e38a8e0a-b88b-4902-b3fe-b0fcb17d5c10,e592a0c5-5bdb-414c-9066-5dba7cdea370,084c6686-2a70-4710-91b1-000393e54c12"
87+
# it's an auto-generated file
88+
MARKDOWN_MARKDOWNLINT_FILTER_REGEX_EXCLUDE: (CHANGELOG.md)
89+
PAT: ${{ secrets.GITHUB_TOKEN }}
90+
# automatically commit fixes to the feature branch
91+
APPLY_FIXES: all
92+
APPLY_FIXES_EVENT: pull_request
93+
APPLY_FIXES_MODE: commit
94+
95+
# Upload MegaLinter artifacts
96+
- name: Archive production artifacts
97+
if: ${{ success() }} || ${{ failure() }}
98+
uses: actions/upload-artifact@v3
99+
with:
100+
name: MegaLinter reports
101+
path: |
102+
megalinter-reports
103+
mega-linter.log
104+
105+
tflint:
106+
runs-on: ubuntu-latest
107+
108+
steps:
109+
- uses: actions/checkout@v3
110+
name: Checkout source code
111+
112+
- uses: actions/cache@v2
113+
name: Cache plugin dir
114+
with:
115+
path: ~/.tflint.d/plugins
116+
key: tflint-${{ hashFiles('.tflint.hcl') }}
117+
118+
- uses: terraform-linters/setup-tflint@v2
119+
name: Setup TFLint
120+
with:
121+
tflint_version: latest
122+
123+
- name: Show version
124+
run: tflint --version
125+
126+
- name: Init TFLint
127+
run: tflint --init
128+
129+
- name: Run TFLint
130+
run: tflint
131+
49132
tfsec:
50133
name: tfsec PR commenter
51134
runs-on: ubuntu-latest
52135

53136
steps:
54137
- name: Clone repo
55-
uses: actions/checkout@master
138+
uses: actions/checkout@v3
139+
56140
- name: tfsec
57141
uses: aquasecurity/[email protected]
58142
with:

‎.github/workflows/lint_pr_title.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,25 @@
1+
---
12
name: "Lint PR title"
3+
24
on:
3-
pull_request_target:
5+
pull_request:
46
types:
57
- opened
68
- edited
79
- synchronize
810
branches-ignore:
911
- 'release-please--branches--*'
1012

13+
permissions: read-all
14+
1115
jobs:
1216
main:
1317
name: Validate PR title
1418
runs-on: ubuntu-latest
19+
permissions:
20+
pull-requests: read
21+
contents: read
22+
statuses: write
1523
steps:
1624
- uses: amannn/action-semantic-pull-request@b6bca70dcd3e56e896605356ce09b76f7e1e0d39 # ratchet:amannn/action-semantic-pull-request@v5
1725
env:
@@ -59,7 +67,7 @@ jobs:
5967
# will suggest using that commit message instead of the PR title for the
6068
# merge commit, and it's easy to commit this by mistake. Enable this option
6169
# to also validate the commit message for one commit PRs.
62-
validateSingleCommit: true
70+
validateSingleCommit: false
6371
# Related to `validateSingleCommit` you can opt-in to validate that the PR
6472
# title matches a single commit to avoid confusion.
6573
validateSingleCommitMatchesPrTitle: false

‎.github/workflows/pr-opened.yml‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,16 @@
1+
---
12
name: PR opened
2-
on:
3+
4+
on: # yamllint disable-line rule:truthy
35
pull_request_target:
46
# GITHUB_TOKEN is readonly and the action will fail for Dependabot
57
branches-ignore:
68
- 'dependabot/**'
79
types:
810
- opened
911

12+
permissions: read-all
13+
1014
jobs:
1115
add-welcome-message:
1216
runs-on: ubuntu-latest
@@ -21,5 +25,18 @@ jobs:
2125
issue_number: context.issue.number,
2226
owner: context.repo.owner,
2327
repo: context.repo.repo,
24-
body: 'Hey @${{ github.event.pull_request.user.login }}! 👋\n\nThank you for your contribution to the project. Please refer to the [contribution rules](${{ github.server_url }}/${{ github.repository }}/blob/main/CONTRIBUTING.md) for a quick overview of the process.\n\nMake sure that this PR clearly explains:\n\n- the problem being solved\n- the best way a reviewer and you can test your changes\n\nWith submitting this PR you confirm that you have the rights of the code added and agree that it will published under the [MIT license](${{ github.server_url }}/${{ github.repository }}/blob/main/LICENSE).\n\n_This message was generated automatically. You are welcome to [improve it](${{ github.server_url }}/${{ github.repository }}/blob/main/.github/workflows/pr-opened.yml)._'
28+
body: 'Hey @${{ github.event.pull_request.user.login }}! \
29+
\n\n \
30+
👋Thank you for your contribution to the project. Please refer to the
31+
[contribution rules](..//blob/main/CONTRIBUTION.md) for a quick overview of the process. \
32+
\n\n \
33+
Make sure that this PR clearly explains: \n \
34+
- the problem being solved \n \
35+
- the best way a reviewer and you can test your changes \n \
36+
\n \
37+
With submitting this PR you confirm that you hold the rights of the code added and agree \
38+
that it will published under the [Apache 2.0 license](/blob/main/LICENSE). \
39+
\n\n \
40+
This message was generated automatically. You are welcome to \
41+
[improve it](/blob/main/.github/workflows/new-pr-opened.yml)._'
2542
})

‎.github/workflows/release.yml‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,31 @@
1+
---
12
name: Release
2-
on:
3+
4+
on: # yamllint disable-line rule:truthy
35
push:
46
branches:
57
- main
6-
8+
9+
permissions: read-all
10+
711
jobs:
812
release:
913
runs-on: ubuntu-latest
14+
permissions:
15+
contents: write
16+
pull-requests: write
1017
steps:
1118
- name: Get app installation token
1219
uses: npalm/action-app-token@dd4bb16d91ced5659bc618705c96b822c5a42136 # ratchet:npalm/[email protected]
1320
id: token
1421
with:
15-
appId: ${{ secrets.APP_ID }}
16-
appPrivateKeyBase64: ${{ secrets.APP_PRIVATE_KEY_BASE64 }}
22+
appId: ${{ secrets.RELEASER_APP_ID }}
23+
appPrivateKeyBase64: ${{ secrets.RELEASER_APP_PRIVATE_KEY_BASE64 }}
1724
appInstallationType: repo
1825
appInstallationValue: ${{ github.repository }}
1926
# bootstrap-sha and release-as needs to be removed after first release
2027
- name: Release
21-
uses: google-github-actions/release-please-action@d3c71f9a0a55385580de793de58da057b3560862 # ratchet:google-github-actions/release-please-action@v3
28+
uses: google-github-actions/release-please-action@e0b9d1885d92e9a93d5ce8656de60e3b806e542c # ratchet:google-github-actions/release-please-action@v3
2229
with:
2330
release-type: terraform-module
2431
token: ${{ steps.token.outputs.token }}

‎.github/workflows/slash_ops_commands.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,24 @@
1+
---
12
name: Execute ChatOps command
2-
on:
3+
4+
on: # yamllint disable-line rule:truthy
35
repository_dispatch:
46
types:
57
- help-command
68

9+
permissions: read-all
10+
711
jobs:
812
help-command:
913
name: "ChatOps: /help"
1014
runs-on: ubuntu-latest
15+
permissions:
16+
pull-requests: write
1117
steps:
1218
- name: Choose maintainer
1319
id: vars
1420
run: |
15-
maintainer=$(cat CODEOWNERS | grep -oE "@[a-zA-Z0-9_-]+" | shuf -n 1)
21+
maintainer=$(grep -oE "@[a-zA-Z0-9_-]+" CODEOWNERS | shuf -n 1)
1622
echo "maintainer=$maintainer" >> "$GITHUB_OUTPUT"
1723
- name: Create comment
1824
uses: actions/github-script@98814c53be79b1d30f795b907e553d8679345975 # ratchet:actions/github-script@v6

‎.github/workflows/slash_ops_comment_dispatch.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,26 @@
1+
---
12
name: PR commented
2-
on:
3+
4+
on: # yamllint disable-line rule:truthy
35
issue_comment:
46
types:
57
- created
68

9+
permissions: read-all
10+
711
jobs:
812
slash-command-dispatch:
913
runs-on: ubuntu-latest
14+
permissions:
15+
# to dispatch the command via workflow
16+
contents: write
17+
# to add a reaction to the comment
18+
pull-requests: write
1019
steps:
1120
- name: Slash Command Dispatch
1221
uses: peter-evans/slash-command-dispatch@a28ee6cd74d5200f99e247ebc7b365c03ae0ef3c # ratchet:peter-evans/slash-command-dispatch@v3
1322
with:
1423
token: ${{ secrets.GITHUB_TOKEN }}
1524
issue-type: pull-request
16-
reactions: false
1725
commands: |
1826
help

‎.github/workflows/stale.yml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,18 @@
1+
---
12
name: 'Close stale issues and PRs'
2-
on:
3+
4+
on: # yamllint disable-line rule:truthy
35
schedule:
46
- cron: '25 2 * * *'
57

8+
permissions: read-all
9+
610
jobs:
711
stale:
812
runs-on: ubuntu-latest
13+
permissions:
14+
issues: write
15+
pull-requests: write
916
steps:
1017
- uses: actions/stale@6f05e4244c9a0b2ed3401882b05d701dd0a7289b # ratchet:actions/stale@v7
1118
with:

‎.github/workflows/update_docs.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,20 @@
1+
---
12
name: Update docs
2-
on:
3+
4+
on: # yamllint disable-line rule:truthy
35
push:
46
branches:
57
- release-please--branches--main
68

9+
permissions: read-all
10+
711
jobs:
812
docs:
913
# update docs after merge back to develop
1014
name: Auto update terraform docs
1115
runs-on: ubuntu-latest
16+
permissions:
17+
contents: write
1218
steps:
1319
- name: Checkout branch
1420
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # ratchet:actions/checkout@v3

‎.gitignore‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,10 @@ builds/
3131

3232
# exceptions for semantic release
3333
!.release/package*
34-
!.release/*.lock
34+
!.release/*.lock
35+
36+
# VS Code
37+
.vscode/
38+
39+
# Python
40+
venv/

0 commit comments

Comments
 (0)