Skip to content

Commit afcd3d3

Browse files
mcdonnnjmcdonnnj
authored
Merge pull request #76 from cisagov/lineage/skeleton
⚠️ CONFLICT! Lineage pull request for: skeleton
2 parents a729584 + 67264e5 commit afcd3d3

File tree

9 files changed

+143
-37
lines changed

9 files changed

+143
-37
lines changed

‎.bandit.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
# This config is applied to bandit when scanning the "tests" tree
55

66
# Tests are first included by `tests`, and then excluded by `skips`.
7-
# If `tests` is empty, all tests are are considered included.
7+
# If `tests` is empty, all tests are considered included.
88

99
tests:
1010
# - B101

‎.github/dependabot.yml‎

Lines changed: 18 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -5,30 +5,37 @@
55
# these updates when the pull request(s) in the appropriate skeleton are merged
66
# and Lineage processes these changes.
77

8-
version: 2
98
updates:
10-
- package-ecosystem: "github-actions"
11-
directory: "/"
12-
schedule:
13-
interval: "weekly"
9+
- directory: /
1410
ignore:
1511
# Managed by cisagov/skeleton-generic
1612
- dependency-name: actions/cache
1713
- dependency-name: actions/checkout
1814
- dependency-name: actions/setup-go
1915
- dependency-name: actions/setup-python
16+
- dependency-name: crazy-max/ghaction-dump-context
17+
- dependency-name: crazy-max/ghaction-github-labeler
18+
- dependency-name: crazy-max/ghaction-github-status
2019
- dependency-name: hashicorp/setup-terraform
2120
- dependency-name: mxschmitt/action-tmate
21+
- dependency-name: step-security/harden-runner
2222
# Managed by cisagov/skeleton-python-library
2323
- dependency-name: actions/download-artifact
2424
- dependency-name: actions/upload-artifact
25+
- dependency-name: github/codeql-action/analyze
26+
- dependency-name: github/codeql-action/autobuild
27+
- dependency-name: github/codeql-action/init
28+
package-ecosystem: github-actions
29+
schedule:
30+
interval: weekly
2531

26-
- package-ecosystem: "pip"
27-
directory: "/"
32+
- directory: /
33+
package-ecosystem: pip
2834
schedule:
29-
interval: "weekly"
35+
interval: weekly
3036

31-
- package-ecosystem: "terraform"
32-
directory: "/"
37+
- directory: /
38+
package-ecosystem: terraform
3339
schedule:
34-
interval: "weekly"
40+
interval: weekly
41+
version: 2

‎.github/workflows/build.yml‎

Lines changed: 72 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,36 @@ env:
1414
RUN_TMATE: ${{ secrets.RUN_TMATE }}
1515

1616
jobs:
17+
diagnostics:
18+
name: Run diagnostics
19+
runs-on: ubuntu-latest
20+
steps:
21+
# Note that a duplicate of this step must be added at the top of
22+
# each job.
23+
- id: harden-runner
24+
name: Harden the runner
25+
uses: step-security/harden-runner@v2
26+
with:
27+
egress-policy: audit
28+
- id: github-status
29+
name: Check GitHub status
30+
uses: crazy-max/ghaction-github-status@v3
31+
- id: dump-context
32+
name: Dump context
33+
uses: crazy-max/ghaction-dump-context@v2
1734
lint:
35+
needs:
36+
- diagnostics
1837
runs-on: ubuntu-latest
1938
steps:
39+
- id: harden-runner
40+
name: Harden the runner
41+
uses: step-security/harden-runner@v2
42+
with:
43+
egress-policy: audit
2044
- id: setup-env
2145
uses: cisagov/setup-env-github-action@develop
22-
- uses: actions/checkout@v3
46+
- uses: actions/checkout@v4
2347
- id: setup-python
2448
uses: actions/setup-python@v4
2549
with:
@@ -84,11 +108,26 @@ jobs:
84108
- uses: hashicorp/setup-terraform@v2
85109
with:
86110
terraform_version: ${{ steps.setup-env.outputs.terraform-version }}
111+
- name: Install go-critic
112+
env:
113+
PACKAGE_URL: github.com/go-critic/go-critic/cmd/gocritic
114+
PACKAGE_VERSION: ${{ steps.setup-env.outputs.go-critic-version }}
115+
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
116+
- name: Install gosec
117+
env:
118+
PACKAGE_URL: github.com/securego/gosec/v2/cmd/gosec
119+
PACKAGE_VERSION: ${{ steps.setup-env.outputs.gosec-version }}
120+
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
87121
- name: Install shfmt
88122
env:
89123
PACKAGE_URL: mvdan.cc/sh/v3/cmd/shfmt
90124
PACKAGE_VERSION: ${{ steps.setup-env.outputs.shfmt-version }}
91125
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
126+
- name: Install staticcheck
127+
env:
128+
PACKAGE_URL: honnef.co/go/tools/cmd/staticcheck
129+
PACKAGE_VERSION: ${{ steps.setup-env.outputs.staticcheck-version }}
130+
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
92131
- name: Install Terraform-docs
93132
env:
94133
PACKAGE_URL: github.com/terraform-docs/terraform-docs
@@ -107,6 +146,8 @@ jobs:
107146
if: env.RUN_TMATE
108147
test:
109148
name: test source - py${{ matrix.python-version }}
149+
needs:
150+
- diagnostics
110151
runs-on: ${{ matrix.os }}
111152
strategy:
112153
fail-fast: false
@@ -119,11 +160,17 @@ jobs:
119160
- "3.9"
120161
- "3.10"
121162
- "3.11"
163+
- "3.12"
122164
include:
123165
- os: ubuntu-20.04
124166
python-version: "3.6"
125167
steps:
126-
- uses: actions/checkout@v3
168+
- id: harden-runner
169+
name: Harden the runner
170+
uses: step-security/harden-runner@v2
171+
with:
172+
egress-policy: audit
173+
- uses: actions/checkout@v4
127174
- id: setup-python
128175
uses: actions/setup-python@v4
129176
with:
@@ -165,9 +212,15 @@ jobs:
165212
coveralls-finish:
166213
runs-on: ubuntu-latest
167214
needs:
215+
- diagnostics
168216
- test
169217
steps:
170-
- uses: actions/checkout@v3
218+
- id: harden-runner
219+
name: Harden the runner
220+
uses: step-security/harden-runner@v2
221+
with:
222+
egress-policy: audit
223+
- uses: actions/checkout@v4
171224
- id: setup-python
172225
uses: actions/setup-python@v4
173226
with:
@@ -201,6 +254,7 @@ jobs:
201254
build:
202255
name: build wheel - py${{ matrix.python-version }}
203256
needs:
257+
- diagnostics
204258
- lint
205259
- test
206260
runs-on: ${{ matrix.os }}
@@ -215,11 +269,17 @@ jobs:
215269
- "3.9"
216270
- "3.10"
217271
- "3.11"
272+
- "3.12"
218273
include:
219274
- os: ubuntu-20.04
220275
python-version: "3.6"
221276
steps:
222-
- uses: actions/checkout@v3
277+
- id: harden-runner
278+
name: Harden the runner
279+
uses: step-security/harden-runner@v2
280+
with:
281+
egress-policy: audit
282+
- uses: actions/checkout@v4
223283
- id: setup-python
224284
uses: actions/setup-python@v4
225285
with:
@@ -255,6 +315,7 @@ jobs:
255315
test-build:
256316
name: test built wheel - py${{ matrix.python-version }}
257317
needs:
318+
- diagnostics
258319
- build
259320
runs-on: ${{ matrix.os }}
260321
strategy:
@@ -268,11 +329,17 @@ jobs:
268329
- "3.9"
269330
- "3.10"
270331
- "3.11"
332+
- "3.12"
271333
include:
272334
- os: ubuntu-20.04
273335
python-version: "3.6"
274336
steps:
275-
- uses: actions/checkout@v3
337+
- id: harden-runner
338+
name: Harden the runner
339+
uses: step-security/harden-runner@v2
340+
with:
341+
egress-policy: audit
342+
- uses: actions/checkout@v4
276343
- id: setup-python
277344
uses: actions/setup-python@v4
278345
with:

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 27 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
#
55
# You may wish to alter this file to override the set of languages analyzed,
66
# or to provide custom queries or build logic.
7-
name: "CodeQL"
7+
name: CodeQL
88

99
on:
1010
push:
@@ -20,8 +20,27 @@ on:
2020
- cron: '0 14 * * 6'
2121

2222
jobs:
23+
diagnostics:
24+
name: Run diagnostics
25+
runs-on: ubuntu-latest
26+
steps:
27+
# Note that a duplicate of this step must be added at the top of
28+
# each job.
29+
- id: harden-runner
30+
name: Harden the runner
31+
uses: step-security/harden-runner@v2
32+
with:
33+
egress-policy: audit
34+
- id: github-status
35+
name: Check GitHub status
36+
uses: crazy-max/ghaction-github-status@v3
37+
- id: dump-context
38+
name: Dump context
39+
uses: crazy-max/ghaction-dump-context@v2
2340
analyze:
2441
name: Analyze
42+
needs:
43+
- diagnostics
2544
runs-on: ubuntu-latest
2645
permissions:
2746
# required for all workflows
@@ -37,8 +56,14 @@ jobs:
3756
# https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
3857

3958
steps:
59+
- id: harden-runner
60+
name: Harden the runner
61+
uses: step-security/harden-runner@v2
62+
with:
63+
egress-policy: audit
64+
4065
- name: Checkout repository
41-
uses: actions/checkout@v3
66+
uses: actions/checkout@v4
4267

4368
# Initializes the CodeQL tools for scanning.
4469
- name: Initialize CodeQL

‎.github/workflows/sync-labels.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,10 @@ jobs:
1919
issues: write
2020
runs-on: ubuntu-latest
2121
steps:
22-
- uses: actions/checkout@v3
22+
- uses: actions/checkout@v4
2323
- name: Sync repository labels
2424
if: success()
25-
uses: crazy-max/ghaction-github-labeler@v4
25+
uses: crazy-max/ghaction-github-labeler@v5
2626
with:
2727
# This is a hideous ternary equivalent so we only do a dry run unless
2828
# this workflow is triggered by the develop branch.

‎.pre-commit-config.yaml‎

Lines changed: 19 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -31,13 +31,13 @@ repos:
3131

3232
# Text file hooks
3333
- repo: https://github.com/igorshubovych/markdownlint-cli
34-
rev: v0.34.0
34+
rev: v0.36.0
3535
hooks:
3636
- id: markdownlint
3737
args:
3838
- --config=.mdl_config.yaml
3939
- repo: https://github.com/pre-commit/mirrors-prettier
40-
rev: v3.0.0-alpha.9-for-vscode
40+
rev: v3.0.3
4141
hooks:
4242
- id: prettier
4343
- repo: https://github.com/adrienverge/yamllint
@@ -49,14 +49,14 @@ repos:
4949

5050
# GitHub Actions hooks
5151
- repo: https://github.com/python-jsonschema/check-jsonschema
52-
rev: 0.23.1
52+
rev: 0.26.3
5353
hooks:
5454
- id: check-github-actions
5555
- id: check-github-workflows
5656

5757
# pre-commit hooks
5858
- repo: https://github.com/pre-commit/pre-commit
59-
rev: v3.3.2
59+
rev: v3.4.0
6060
hooks:
6161
- id: validate_manifest
6262

@@ -79,6 +79,12 @@ repos:
7979
# GoSec
8080
- id: go-sec-repo-mod
8181

82+
# Nix hooks
83+
- repo: https://github.com/nix-community/nixpkgs-fmt
84+
rev: v1.3.0
85+
hooks:
86+
- id: nixpkgs-fmt
87+
8288
# Shell script hooks
8389
- repo: https://github.com/cisagov/pre-commit-shfmt
8490
rev: v0.0.2
@@ -111,17 +117,17 @@ repos:
111117
- --config=.bandit.yml
112118
# Run bandit on everything except the "tests" tree
113119
- repo: https://github.com/PyCQA/bandit
114-
rev: 1.7.4
120+
rev: 1.7.5
115121
hooks:
116122
- id: bandit
117123
name: bandit (everything else)
118124
exclude: tests
119-
- repo: https://github.com/psf/black
120-
rev: 23.3.0
125+
- repo: https://github.com/psf/black-pre-commit-mirror
126+
rev: 23.9.1
121127
hooks:
122128
- id: black
123129
- repo: https://github.com/PyCQA/flake8
124-
rev: 6.0.0
130+
rev: 6.1.0
125131
hooks:
126132
- id: flake8
127133
additional_dependencies:
@@ -131,28 +137,28 @@ repos:
131137
hooks:
132138
- id: isort
133139
- repo: https://github.com/pre-commit/mirrors-mypy
134-
rev: v1.3.0
140+
rev: v1.5.1
135141
hooks:
136142
- id: mypy
137143
additional_dependencies:
138144
- types-PyYAML
139145
- types-requests
140146
- types-setuptools
141147
- repo: https://github.com/asottile/pyupgrade
142-
rev: v3.4.0
148+
rev: v3.10.1
143149
hooks:
144150
- id: pyupgrade
145151

146152
# Ansible hooks
147-
- repo: https://github.com/ansible-community/ansible-lint
148-
rev: v6.17.0
153+
- repo: https://github.com/ansible/ansible-lint
154+
rev: v6.19.0
149155
hooks:
150156
- id: ansible-lint
151157
# files: molecule/default/playbook.yml
152158

153159
# Terraform hooks
154160
- repo: https://github.com/antonbabenko/pre-commit-terraform
155-
rev: v1.80.0
161+
rev: v1.83.2
156162
hooks:
157163
- id: terraform_fmt
158164
- id: terraform_validate

‎setup.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@ def get_version(version_file):
8181
"Programming Language :: Python :: 3.9",
8282
"Programming Language :: Python :: 3.10",
8383
"Programming Language :: Python :: 3.11",
84+
"Programming Language :: Python :: 3.12",
8485
"Programming Language :: Python :: Implementation :: CPython",
8586
],
8687
python_requires=">=3.6",

0 commit comments

Comments
 (0)