Skip to content

Commit 04e233c

Browse files
jsf9kjsf9k
authored
Merge pull request #78 from cisagov/lineage/skeleton
⚠️ CONFLICT! Lineage pull request for: skeleton
2 parents fecfc1a + 69e6253 commit 04e233c

11 files changed

+237
-96
lines changed

‎.bandit.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
# https://bandit.readthedocs.io/en/latest/config.html
44

55
# Tests are first included by `tests`, and then excluded by `skips`.
6-
# If `tests` is empty, all tests are are considered included.
6+
# If `tests` is empty, all tests are considered included.
77

88
tests:
99
# - B101

‎.github/dependabot.yml

+18-14
Original file line numberDiff line numberDiff line change
@@ -5,25 +5,25 @@
55
# these updates when the pull request(s) in the appropriate skeleton are merged
66
# and Lineage processes these changes.
77

8-
version: 2
98
updates:
10-
- package-ecosystem: "docker"
11-
directory: "/"
9+
- directory: /
10+
package-ecosystem: docker
1211
schedule:
13-
interval: "weekly"
12+
interval: weekly
1413

15-
- package-ecosystem: "github-actions"
16-
directory: "/"
17-
schedule:
18-
interval: "weekly"
14+
- directory: /
1915
ignore:
2016
# Managed by cisagov/skeleton-generic
2117
- dependency-name: actions/cache
2218
- dependency-name: actions/checkout
2319
- dependency-name: actions/setup-go
2420
- dependency-name: actions/setup-python
21+
- dependency-name: crazy-max/ghaction-dump-context
22+
- dependency-name: crazy-max/ghaction-github-labeler
23+
- dependency-name: crazy-max/ghaction-github-status
2524
- dependency-name: hashicorp/setup-terraform
2625
- dependency-name: mxschmitt/action-tmate
26+
- dependency-name: step-security/harden-runner
2727
# Managed by cisagov/skeleton-docker
2828
- dependency-name: actions/download-artifact
2929
- dependency-name: actions/github-script
@@ -33,13 +33,17 @@ updates:
3333
- dependency-name: docker/setup-buildx-action
3434
- dependency-name: docker/setup-qemu-action
3535
- dependency-name: github/codeql-action
36+
package-ecosystem: github-actions
37+
schedule:
38+
interval: weekly
3639

37-
- package-ecosystem: "pip"
38-
directory: "/"
40+
- directory: /
41+
package-ecosystem: pip
3942
schedule:
40-
interval: "weekly"
43+
interval: weekly
4144

42-
- package-ecosystem: "terraform"
43-
directory: "/"
45+
- directory: /
46+
package-ecosystem: terraform
4447
schedule:
45-
interval: "weekly"
48+
interval: weekly
49+
version: 2

‎.github/workflows/build.yml

+103-24
Original file line numberDiff line numberDiff line change
@@ -35,15 +35,39 @@ env:
3535
RUN_TMATE: ${{ secrets.RUN_TMATE }}
3636

3737
jobs:
38+
diagnostics:
39+
name: Run diagnostics
40+
runs-on: ubuntu-latest
41+
steps:
42+
# Note that a duplicate of this step must be added at the top of
43+
# each job.
44+
- id: harden-runner
45+
name: Harden the runner
46+
uses: step-security/harden-runner@v2
47+
with:
48+
egress-policy: audit
49+
- id: github-status
50+
name: Check GitHub status
51+
uses: crazy-max/ghaction-github-status@v3
52+
- id: dump-context
53+
name: Dump context
54+
uses: crazy-max/ghaction-dump-context@v2
3855
lint:
3956
# Checks out the source and runs pre-commit hooks. Detects coding errors
4057
# and style deviations.
41-
name: "Lint sources"
58+
name: Lint sources
59+
needs:
60+
- diagnostics
4261
runs-on: ubuntu-latest
4362
steps:
63+
- id: harden-runner
64+
name: Harden the runner
65+
uses: step-security/harden-runner@v2
66+
with:
67+
egress-policy: audit
4468
- id: setup-env
4569
uses: cisagov/setup-env-github-action@develop
46-
- uses: actions/checkout@v3
70+
- uses: actions/checkout@v4
4771
- id: setup-python
4872
uses: actions/setup-python@v4
4973
with:
@@ -104,11 +128,26 @@ jobs:
104128
- uses: hashicorp/setup-terraform@v2
105129
with:
106130
terraform_version: ${{ steps.setup-env.outputs.terraform-version }}
131+
- name: Install go-critic
132+
env:
133+
PACKAGE_URL: github.com/go-critic/go-critic/cmd/gocritic
134+
PACKAGE_VERSION: ${{ steps.setup-env.outputs.go-critic-version }}
135+
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
136+
- name: Install gosec
137+
env:
138+
PACKAGE_URL: github.com/securego/gosec/v2/cmd/gosec
139+
PACKAGE_VERSION: ${{ steps.setup-env.outputs.gosec-version }}
140+
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
107141
- name: Install shfmt
108142
env:
109143
PACKAGE_URL: mvdan.cc/sh/v3/cmd/shfmt
110144
PACKAGE_VERSION: ${{ steps.setup-env.outputs.shfmt-version }}
111145
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
146+
- name: Install staticcheck
147+
env:
148+
PACKAGE_URL: honnef.co/go/tools/cmd/staticcheck
149+
PACKAGE_VERSION: ${{ steps.setup-env.outputs.staticcheck-version }}
150+
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
112151
- name: Install Terraform-docs
113152
env:
114153
PACKAGE_URL: github.com/terraform-docs/terraform-docs
@@ -166,18 +205,25 @@ jobs:
166205
# with the value specified by the user.
167206
#
168207
# Scheduled builds are tagged with `:nightly`.
169-
name: "Prepare build variables"
170-
runs-on: ubuntu-latest
208+
name: Prepare build variables
209+
needs:
210+
- diagnostics
171211
outputs:
172212
created: ${{ steps.prep.outputs.created }}
173213
repometa: ${{ steps.repo.outputs.result }}
174214
source_version: ${{ steps.prep.outputs.source_version }}
175215
tags: ${{ steps.prep.outputs.tags }}
216+
runs-on: ubuntu-latest
176217
steps:
177-
- uses: actions/checkout@v3
218+
- id: harden-runner
219+
name: Harden the runner
220+
uses: step-security/harden-runner@v2
221+
with:
222+
egress-policy: audit
223+
- uses: actions/checkout@v4
178224
- name: Gather repository metadata
179225
id: repo
180-
uses: actions/github-script@v6
226+
uses: actions/github-script@v7
181227
with:
182228
script: |
183229
const repo = await github.rest.repos.get(context.repo)
@@ -228,16 +274,23 @@ jobs:
228274
build:
229275
# Builds a single test image for the native platform. This image is saved
230276
# as an artifact and loaded by the test job.
231-
name: "Build test image"
277+
name: Build test image
278+
needs:
279+
- diagnostics
280+
- prepare
232281
runs-on: ubuntu-latest
233-
needs: [prepare]
234282
steps:
283+
- id: harden-runner
284+
name: Harden the runner
285+
uses: step-security/harden-runner@v2
286+
with:
287+
egress-policy: audit
235288
- name: Checkout
236-
uses: actions/checkout@v3
289+
uses: actions/checkout@v4
237290
- name: Set up QEMU
238-
uses: docker/setup-qemu-action@v2
291+
uses: docker/setup-qemu-action@v3
239292
- name: Set up Docker Buildx
240-
uses: docker/setup-buildx-action@v2
293+
uses: docker/setup-buildx-action@v3
241294
- name: Cache Docker layers
242295
uses: actions/cache@v3
243296
env:
@@ -251,7 +304,7 @@ jobs:
251304
run: mkdir -p dist
252305
- name: Build image
253306
id: docker_build
254-
uses: docker/build-push-action@v4
307+
uses: docker/build-push-action@v5
255308
with:
256309
build-args: |
257310
VERSION=${{ needs.prepare.outputs.source_version }}
@@ -260,6 +313,11 @@ jobs:
260313
context: .
261314
file: ./Dockerfile
262315
outputs: type=docker,dest=dist/image.tar
316+
# Uncomment the following option if you are building an image for use
317+
# on Google Cloud Run or AWS Lambda. The current default image output
318+
# is unable to run on either. Please see the following issue for more
319+
# information: https://github.com/docker/buildx/issues/1533
320+
# provenance: false
263321
tags: ${{ env.IMAGE_NAME }}:latest # not to be pushed
264322
# For a list of pre-defined annotation keys and value types see:
265323
# https://github.com/opencontainers/image-spec/blob/master/annotations.md
@@ -298,11 +356,18 @@ jobs:
298356
if: env.RUN_TMATE
299357
test:
300358
# Executes tests on the single-platform image created in the "build" job.
301-
name: "Test image"
359+
name: Test image
360+
needs:
361+
- diagnostics
362+
- build
302363
runs-on: ubuntu-latest
303-
needs: [build]
304364
steps:
305-
- uses: actions/checkout@v3
365+
- id: harden-runner
366+
name: Harden the runner
367+
uses: step-security/harden-runner@v2
368+
with:
369+
egress-policy: audit
370+
- uses: actions/checkout@v4
306371
- id: setup-python
307372
uses: actions/setup-python@v4
308373
with:
@@ -344,32 +409,41 @@ jobs:
344409
# GitHub Container Registry. The contents of README.md are pushed as the
345410
# image's description to Docker Hub. This job is skipped when the
346411
# triggering event is a pull request.
347-
name: "Build and push all platforms"
348-
runs-on: ubuntu-latest
349-
needs: [lint, prepare, test]
350412
if: github.event_name != 'pull_request'
413+
name: Build and push all platforms
414+
needs:
415+
- diagnostics
416+
- lint
417+
- prepare
418+
- test
351419
# When Dependabot creates a PR it requires this permission in
352420
# order to push Docker images to ghcr.io.
353421
permissions:
354422
packages: write
423+
runs-on: ubuntu-latest
355424
steps:
425+
- id: harden-runner
426+
name: Harden the runner
427+
uses: step-security/harden-runner@v2
428+
with:
429+
egress-policy: audit
356430
- name: Login to Docker Hub
357-
uses: docker/login-action@v2
431+
uses: docker/login-action@v3
358432
with:
359433
username: ${{ secrets.DOCKER_USERNAME }}
360434
password: ${{ secrets.DOCKER_PASSWORD }}
361435
- name: Login to GitHub Container Registry
362-
uses: docker/login-action@v2
436+
uses: docker/login-action@v3
363437
with:
364438
registry: ghcr.io
365439
username: ${{ github.actor }}
366440
password: ${{ secrets.GITHUB_TOKEN }}
367441
- name: Checkout
368-
uses: actions/checkout@v3
442+
uses: actions/checkout@v4
369443
- name: Set up QEMU
370-
uses: docker/setup-qemu-action@v2
444+
uses: docker/setup-qemu-action@v3
371445
- name: Set up Docker Buildx
372-
uses: docker/setup-buildx-action@v2
446+
uses: docker/setup-buildx-action@v3
373447
- name: Cache Docker layers
374448
uses: actions/cache@v3
375449
env:
@@ -383,7 +457,7 @@ jobs:
383457
run: ./buildx-dockerfile.sh
384458
- name: Build and push platform images to registries
385459
id: docker_build
386-
uses: docker/build-push-action@v4
460+
uses: docker/build-push-action@v5
387461
with:
388462
build-args: |
389463
VERSION=${{ needs.prepare.outputs.source_version }}
@@ -392,6 +466,11 @@ jobs:
392466
context: .
393467
file: ./Dockerfile-x
394468
platforms: ${{ env.PLATFORMS }}
469+
# Uncomment the following option if you are building an image for use
470+
# on Google Cloud Run or AWS Lambda. The current default image output
471+
# is unable to run on either. Please see the following issue for more
472+
# information: https://github.com/docker/buildx/issues/1533
473+
# provenance: false
395474
push: true
396475
tags: ${{ needs.prepare.outputs.tags }}
397476
# For a list of pre-defined annotation keys and value types see:

‎.github/workflows/codeql-analysis.yml

+27-2
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
#
55
# You may wish to alter this file to override the set of languages analyzed,
66
# or to provide custom queries or build logic.
7-
name: "CodeQL"
7+
name: CodeQL
88

99
on:
1010
push:
@@ -20,8 +20,27 @@ on:
2020
- cron: '0 21 * * 6'
2121

2222
jobs:
23+
diagnostics:
24+
name: Run diagnostics
25+
runs-on: ubuntu-latest
26+
steps:
27+
# Note that a duplicate of this step must be added at the top of
28+
# each job.
29+
- id: harden-runner
30+
name: Harden the runner
31+
uses: step-security/harden-runner@v2
32+
with:
33+
egress-policy: audit
34+
- id: github-status
35+
name: Check GitHub status
36+
uses: crazy-max/ghaction-github-status@v3
37+
- id: dump-context
38+
name: Dump context
39+
uses: crazy-max/ghaction-dump-context@v2
2340
analyze:
2441
name: Analyze
42+
needs:
43+
- diagnostics
2544
runs-on: ubuntu-latest
2645
permissions:
2746
# required for all workflows
@@ -37,8 +56,14 @@ jobs:
3756
# https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
3857

3958
steps:
59+
- id: harden-runner
60+
name: Harden the runner
61+
uses: step-security/harden-runner@v2
62+
with:
63+
egress-policy: audit
64+
4065
- name: Checkout repository
41-
uses: actions/checkout@v3
66+
uses: actions/checkout@v4
4267

4368
# Initializes the CodeQL tools for scanning.
4469
- name: Initialize CodeQL

‎.github/workflows/sync-labels.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,10 @@ jobs:
1919
issues: write
2020
runs-on: ubuntu-latest
2121
steps:
22-
- uses: actions/checkout@v3
22+
- uses: actions/checkout@v4
2323
- name: Sync repository labels
2424
if: success()
25-
uses: crazy-max/ghaction-github-labeler@v4
25+
uses: crazy-max/ghaction-github-labeler@v5
2626
with:
2727
# This is a hideous ternary equivalent so we only do a dry run unless
2828
# this workflow is triggered by the develop branch.

0 commit comments

Comments
 (0)