Skip to content

Commit 685267a

Browse files
uk-bollyuk-bolly
authored
Merge pull request #21 from ansible-lockdown/devel
v1r2 release - workflow and audit updates
2 parents bb1b6e3 + 853fa67 commit 685267a

30 files changed

+1005
-894
lines changed

‎.ansible-lint‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ skip_list:
1010
- 'name[play]'
1111
- 'name[casing]'
1212
- 'name[template]'
13-
# - 'key-order[task]'
13+
- 'key-order[task]'
1414
- 'yaml[line-length]'
1515
- '204'
1616
- '305'

‎.github/workflows/devel_pipeline_validation.yml‎

Lines changed: 156 additions & 135 deletions
Original file line numberDiff line numberDiff line change
@@ -1,138 +1,159 @@
11
---
22

3-
name: Devel pipeline
4-
5-
on: # yamllint disable-line rule:truthy
6-
pull_request_target:
7-
types: [opened, reopened, synchronize]
8-
branches:
9-
- devel
10-
paths:
11-
- '**.yml'
12-
- '**.sh'
13-
- '**.j2'
14-
- '**.ps1'
15-
- '**.cfg'
16-
17-
# A workflow run is made up of one or more jobs
18-
# that can run sequentially or in parallel
19-
jobs:
20-
# This will create messages for first time contributers and direct them to the Discord server
21-
welcome:
22-
runs-on: ubuntu-latest
23-
24-
steps:
25-
- uses: actions/first-interaction@main
26-
with:
27-
repo-token: ${{ secrets.GITHUB_TOKEN }}
28-
pr-message: |-
29-
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
30-
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
31-
32-
# This workflow contains a single job that tests the playbook
33-
playbook-test:
34-
# The type of runner that the job will run on
35-
runs-on: ubuntu-latest
36-
env:
37-
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
38-
# Imported as a variable by terraform
39-
TF_VAR_repository: ${{ github.event.repository.name }}
40-
defaults:
41-
run:
42-
shell: bash
43-
working-directory: .github/workflows/github_linux_IaC
44-
45-
steps:
46-
- name: Clone ${{ github.event.repository.name }}
47-
uses: actions/checkout@v4
3+
name: Devel pipeline
4+
5+
on: # yamllint disable-line rule:truthy
6+
pull_request_target:
7+
types: [opened, reopened, synchronize]
8+
branches:
9+
- devel
10+
paths:
11+
- '**.yml'
12+
- '**.sh'
13+
- '**.j2'
14+
- '**.ps1'
15+
- '**.cfg'
16+
# Allow manual running of workflow
17+
workflow_dispatch:
18+
19+
# Allow permissions for AWS auth
20+
permissions:
21+
id-token: write
22+
contents: read
23+
pull-requests: read
24+
25+
# A workflow run is made up of one or more jobs
26+
# that can run sequentially or in parallel
27+
jobs:
28+
# This will create messages for first time contributers and direct them to the Discord server
29+
welcome:
30+
runs-on: self-hosted
31+
32+
steps:
33+
- uses: actions/first-interaction@main
4834
with:
49-
ref: ${{ github.event.pull_request.head.sha }}
50-
51-
# Pull in terraform code for linux servers
52-
- name: Clone GitHub IaC plan
53-
uses: actions/checkout@v4
54-
with:
55-
repository: ansible-lockdown/github_linux_IaC
56-
path: .github/workflows/github_linux_IaC
57-
58-
- name: Add_ssh_key
59-
working-directory: .github/workflows
60-
env:
61-
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
62-
PRIVATE_KEY: "${{ secrets.SSH_PRV_KEY }}"
63-
run: |
64-
mkdir .ssh
65-
chmod 700 .ssh
66-
echo $PRIVATE_KEY > .ssh/github_actions.pem
67-
chmod 600 .ssh/github_actions.pem
68-
69-
- name: DEBUG - Show IaC files
70-
if: env.ENABLE_DEBUG == 'true'
71-
run: |
72-
echo "OSVAR = $OSVAR"
73-
echo "benchmark_type = $benchmark_type"
74-
pwd
75-
ls
76-
env:
77-
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
78-
OSVAR: ${{ vars.OSVAR }}
79-
benchmark_type: ${{ vars.BENCHMARK_TYPE }}
80-
81-
- name: Terraform_Init
82-
id: init
83-
run: terraform init
84-
env:
85-
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
86-
OSVAR: ${{ vars.OSVAR }}
87-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
88-
89-
- name: Terraform_Validate
90-
id: validate
91-
run: terraform validate
92-
env:
93-
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
94-
OSVAR: ${{ vars.OSVAR }}
95-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
96-
97-
- name: Terraform_Apply
98-
id: apply
99-
env:
100-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
101-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
102-
OSVAR: ${{ vars.OSVAR }}
103-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
104-
run: terraform apply -var-file "github_vars.tfvars" -var-file "${OSVAR}.tfvars" --auto-approve -input=false
105-
106-
## Debug Section
107-
- name: DEBUG - Show Ansible hostfile
108-
if: env.ENABLE_DEBUG == 'true'
109-
run: cat hosts.yml
110-
111-
# Aws deployments taking a while to come up insert sleep or playbook fails
112-
113-
- name: Sleep for 60 seconds
114-
run: sleep ${{ vars.BUILD_SLEEPTIME }}
115-
116-
# Run the Ansibleplaybook
117-
- name: Run_Ansible_Playbook
118-
uses: arillso/action.playbook@master
119-
with:
120-
playbook: site.yml
121-
inventory: .github/workflows/github_linux_IaC/hosts.yml
122-
galaxy_file: collections/requirements.yml
123-
private_key: ${{ secrets.SSH_PRV_KEY }}
124-
# verbose: 3
125-
env:
126-
ANSIBLE_HOST_KEY_CHECKING: "false"
127-
ANSIBLE_DEPRECATION_WARNINGS: "false"
128-
129-
# Remove test system - User secrets to keep if necessary
130-
131-
- name: Terraform_Destroy
132-
if: always() && env.ENABLE_DEBUG == 'false'
133-
env:
134-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
135-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
136-
OSVAR: ${{ vars.OSVAR }}
137-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
138-
run: terraform destroy -var-file "github_vars.tfvars" -var-file "${OSVAR}.tfvars" --auto-approve -input=false
35+
repo-token: ${{ secrets.GITHUB_TOKEN }}
36+
pr-message: |-
37+
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
38+
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
39+
40+
# This workflow contains a single job that tests the playbook
41+
playbook-test:
42+
# The type of runner that the job will run on
43+
runs-on: self-hosted
44+
env:
45+
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
46+
# Imported as a variable by terraform
47+
TF_VAR_repository: ${{ github.event.repository.name }}
48+
AWS_REGION: "us-east-1"
49+
ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
50+
defaults:
51+
run:
52+
shell: bash
53+
working-directory: .github/workflows/github_linux_IaC
54+
# working-directory: .github/workflows
55+
56+
steps:
57+
58+
- name: Git clone the lockdown repository to test
59+
uses: actions/checkout@v4
60+
with:
61+
ref: ${{ github.event.pull_request.head.sha }}
62+
63+
- name: If a variable for IAC_BRANCH is set use that branch
64+
working-directory: .github/workflows
65+
run: |
66+
if [ ${{ vars.IAC_BRANCH }} != '' ]; then
67+
echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
68+
echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
69+
else
70+
echo IAC_BRANCH=main >> $GITHUB_ENV
71+
fi
72+
73+
74+
# Pull in terraform code for linux servers
75+
- name: Clone GitHub IaC plan
76+
uses: actions/checkout@v4
77+
with:
78+
repository: ansible-lockdown/github_linux_IaC
79+
path: .github/workflows/github_linux_IaC
80+
ref: ${{ env.IAC_BRANCH }}
81+
82+
# Uses dedicated restricted role and policy to enable this only for this task
83+
# No credentials are part of github for AWS auth
84+
- name: configure aws credentials
85+
uses: aws-actions/configure-aws-credentials@main
86+
with:
87+
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
88+
role-session-name: ${{ secrets.AWS_ROLE_SESSION }}
89+
aws-region: ${{ env.AWS_REGION }}
90+
91+
- name: DEBUG - Show IaC files
92+
if: env.ENABLE_DEBUG == 'true'
93+
run: |
94+
echo "OSVAR = $OSVAR"
95+
echo "benchmark_type = $benchmark_type"
96+
echo "PRIVSUBNET_ID = $AWS_PRIVSUBNET_ID"
97+
echo "VPC_ID" = $AWS_VPC_SECGRP_ID"
98+
pwd
99+
ls
100+
env:
101+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
102+
OSVAR: ${{ vars.OSVAR }}
103+
benchmark_type: ${{ vars.BENCHMARK_TYPE }}
104+
PRIVSUBNET_ID: ${{ secrets.AWS_PRIVSUBNET_ID }}
105+
VPC_ID: ${{ secrets.AWS_VPC_SECGRP_ID }}
106+
107+
- name: Tofu init
108+
id: init
109+
run: tofu init
110+
env:
111+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
112+
OSVAR: ${{ vars.OSVAR }}
113+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
114+
115+
- name: Tofu validate
116+
id: validate
117+
run: tofu validate
118+
env:
119+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
120+
OSVAR: ${{ vars.OSVAR }}
121+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
122+
123+
- name: Tofu apply
124+
id: apply
125+
env:
126+
OSVAR: ${{ vars.OSVAR }}
127+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
128+
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
129+
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
130+
run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false
131+
132+
## Debug Section
133+
- name: DEBUG - Show Ansible hostfile
134+
if: env.ENABLE_DEBUG == 'true'
135+
run: cat hosts.yml
136+
137+
# Aws deployments taking a while to come up insert sleep or playbook fails
138+
139+
- name: Sleep to allow system to come up
140+
run: sleep ${{ vars.BUILD_SLEEPTIME }}
141+
142+
# Run the Ansible playbook
143+
- name: Run_Ansible_Playbook
144+
env:
145+
ANSIBLE_HOST_KEY_CHECKING: "false"
146+
ANSIBLE_DEPRECATION_WARNINGS: "false"
147+
run: |
148+
/opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml --private-key ~/.ssh/le_runner ../../../site.yml
149+
150+
# Remove test system - User secrets to keep if necessary
151+
152+
- name: Tofu Destroy
153+
if: always() && env.ENABLE_DEBUG == 'false'
154+
env:
155+
OSVAR: ${{ vars.OSVAR }}
156+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
157+
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
158+
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
159+
run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve -input=false

0 commit comments

Comments
 (0)