Skip to content

Commit 82b35bb

Browse files
jsf9kjsf9k
authored
Merge pull request #90 from cisagov/lineage/skeleton
⚠️ CONFLICT! Lineage pull request for: skeleton
2 parents 1179c03 + 87546a8 commit 82b35bb

9 files changed

+231
-90
lines changed

‎.bandit.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
# https://bandit.readthedocs.io/en/latest/config.html
44

55
# Tests are first included by `tests`, and then excluded by `skips`.
6-
# If `tests` is empty, all tests are are considered included.
6+
# If `tests` is empty, all tests are considered included.
77

88
tests:
99
# - B101

‎.github/dependabot.yml

+21-17
Original file line numberDiff line numberDiff line change
@@ -5,25 +5,25 @@
55
# these updates when the pull request(s) in the appropriate skeleton are merged
66
# and Lineage processes these changes.
77

8-
version: 2
98
updates:
10-
- package-ecosystem: "docker"
11-
directory: "/"
9+
- directory: /
10+
package-ecosystem: docker
1211
schedule:
13-
interval: "weekly"
12+
interval: weekly
1413

15-
- package-ecosystem: "github-actions"
16-
directory: "/"
17-
schedule:
18-
interval: "weekly"
14+
- directory: /
1915
ignore:
2016
# Managed by cisagov/skeleton-generic
2117
- dependency-name: actions/cache
2218
- dependency-name: actions/checkout
2319
- dependency-name: actions/setup-go
2420
- dependency-name: actions/setup-python
21+
- dependency-name: crazy-max/ghaction-dump-context
22+
- dependency-name: crazy-max/ghaction-github-labeler
23+
- dependency-name: crazy-max/ghaction-github-status
2524
- dependency-name: hashicorp/setup-terraform
2625
- dependency-name: mxschmitt/action-tmate
26+
- dependency-name: step-security/harden-runner
2727
# Managed by cisagov/skeleton-docker
2828
- dependency-name: actions/download-artifact
2929
- dependency-name: actions/github-script
@@ -33,18 +33,22 @@ updates:
3333
- dependency-name: docker/setup-buildx-action
3434
- dependency-name: docker/setup-qemu-action
3535
- dependency-name: github/codeql-action
36+
package-ecosystem: github-actions
37+
schedule:
38+
interval: weekly
3639

37-
- package-ecosystem: "pip"
38-
directory: "/"
40+
- directory: /
41+
package-ecosystem: pip
3942
schedule:
40-
interval: "weekly"
43+
interval: weekly
4144

42-
- package-ecosystem: "pip"
43-
directory: "/src"
45+
- directory: /src
46+
package-ecosystem: pip
4447
schedule:
45-
interval: "weekly"
48+
interval: weekly
4649

47-
- package-ecosystem: "terraform"
48-
directory: "/"
50+
- directory: /
51+
package-ecosystem: terraform
4952
schedule:
50-
interval: "weekly"
53+
interval: weekly
54+
version: 2

‎.github/workflows/build.yml

+103-24
Original file line numberDiff line numberDiff line change
@@ -36,15 +36,39 @@ env:
3636
RUN_TMATE: ${{ secrets.RUN_TMATE }}
3737

3838
jobs:
39+
diagnostics:
40+
name: Run diagnostics
41+
runs-on: ubuntu-latest
42+
steps:
43+
# Note that a duplicate of this step must be added at the top of
44+
# each job.
45+
- id: harden-runner
46+
name: Harden the runner
47+
uses: step-security/harden-runner@v2
48+
with:
49+
egress-policy: audit
50+
- id: github-status
51+
name: Check GitHub status
52+
uses: crazy-max/ghaction-github-status@v3
53+
- id: dump-context
54+
name: Dump context
55+
uses: crazy-max/ghaction-dump-context@v2
3956
lint:
4057
# Checks out the source and runs pre-commit hooks. Detects coding errors
4158
# and style deviations.
42-
name: "Lint sources"
59+
name: Lint sources
60+
needs:
61+
- diagnostics
4362
runs-on: ubuntu-latest
4463
steps:
64+
- id: harden-runner
65+
name: Harden the runner
66+
uses: step-security/harden-runner@v2
67+
with:
68+
egress-policy: audit
4569
- id: setup-env
4670
uses: cisagov/setup-env-github-action@develop
47-
- uses: actions/checkout@v3
71+
- uses: actions/checkout@v4
4872
- id: setup-python
4973
uses: actions/setup-python@v4
5074
with:
@@ -105,11 +129,26 @@ jobs:
105129
- uses: hashicorp/setup-terraform@v2
106130
with:
107131
terraform_version: ${{ steps.setup-env.outputs.terraform-version }}
132+
- name: Install go-critic
133+
env:
134+
PACKAGE_URL: github.com/go-critic/go-critic/cmd/gocritic
135+
PACKAGE_VERSION: ${{ steps.setup-env.outputs.go-critic-version }}
136+
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
137+
- name: Install gosec
138+
env:
139+
PACKAGE_URL: github.com/securego/gosec/v2/cmd/gosec
140+
PACKAGE_VERSION: ${{ steps.setup-env.outputs.gosec-version }}
141+
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
108142
- name: Install shfmt
109143
env:
110144
PACKAGE_URL: mvdan.cc/sh/v3/cmd/shfmt
111145
PACKAGE_VERSION: ${{ steps.setup-env.outputs.shfmt-version }}
112146
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
147+
- name: Install staticcheck
148+
env:
149+
PACKAGE_URL: honnef.co/go/tools/cmd/staticcheck
150+
PACKAGE_VERSION: ${{ steps.setup-env.outputs.staticcheck-version }}
151+
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
113152
- name: Install Terraform-docs
114153
env:
115154
PACKAGE_URL: github.com/terraform-docs/terraform-docs
@@ -167,18 +206,25 @@ jobs:
167206
# with the value specified by the user.
168207
#
169208
# Scheduled builds are tagged with `:nightly`.
170-
name: "Prepare build variables"
171-
runs-on: ubuntu-latest
209+
name: Prepare build variables
210+
needs:
211+
- diagnostics
172212
outputs:
173213
created: ${{ steps.prep.outputs.created }}
174214
repometa: ${{ steps.repo.outputs.result }}
175215
source_version: ${{ steps.prep.outputs.source_version }}
176216
tags: ${{ steps.prep.outputs.tags }}
217+
runs-on: ubuntu-latest
177218
steps:
178-
- uses: actions/checkout@v3
219+
- id: harden-runner
220+
name: Harden the runner
221+
uses: step-security/harden-runner@v2
222+
with:
223+
egress-policy: audit
224+
- uses: actions/checkout@v4
179225
- name: Gather repository metadata
180226
id: repo
181-
uses: actions/github-script@v6
227+
uses: actions/github-script@v7
182228
with:
183229
script: |
184230
const repo = await github.rest.repos.get(context.repo)
@@ -229,16 +275,23 @@ jobs:
229275
build:
230276
# Builds a single test image for the native platform. This image is saved
231277
# as an artifact and loaded by the test job.
232-
name: "Build test image"
278+
name: Build test image
279+
needs:
280+
- diagnostics
281+
- prepare
233282
runs-on: ubuntu-latest
234-
needs: [prepare]
235283
steps:
284+
- id: harden-runner
285+
name: Harden the runner
286+
uses: step-security/harden-runner@v2
287+
with:
288+
egress-policy: audit
236289
- name: Checkout
237-
uses: actions/checkout@v3
290+
uses: actions/checkout@v4
238291
- name: Set up QEMU
239-
uses: docker/setup-qemu-action@v2
292+
uses: docker/setup-qemu-action@v3
240293
- name: Set up Docker Buildx
241-
uses: docker/setup-buildx-action@v2
294+
uses: docker/setup-buildx-action@v3
242295
- name: Cache Docker layers
243296
uses: actions/cache@v3
244297
env:
@@ -252,7 +305,7 @@ jobs:
252305
run: mkdir -p dist
253306
- name: Build image
254307
id: docker_build
255-
uses: docker/build-push-action@v4
308+
uses: docker/build-push-action@v5
256309
with:
257310
build-args: |
258311
VERSION=${{ needs.prepare.outputs.source_version }}
@@ -261,6 +314,11 @@ jobs:
261314
context: .
262315
file: ./Dockerfile
263316
outputs: type=docker,dest=dist/image.tar
317+
# Uncomment the following option if you are building an image for use
318+
# on Google Cloud Run or AWS Lambda. The current default image output
319+
# is unable to run on either. Please see the following issue for more
320+
# information: https://github.com/docker/buildx/issues/1533
321+
# provenance: false
264322
tags: ${{ env.IMAGE_NAME }}:latest # not to be pushed
265323
# For a list of pre-defined annotation keys and value types see:
266324
# https://github.com/opencontainers/image-spec/blob/master/annotations.md
@@ -299,11 +357,18 @@ jobs:
299357
if: env.RUN_TMATE
300358
test:
301359
# Executes tests on the single-platform image created in the "build" job.
302-
name: "Test image"
360+
name: Test image
361+
needs:
362+
- diagnostics
363+
- build
303364
runs-on: ubuntu-latest
304-
needs: [build]
305365
steps:
306-
- uses: actions/checkout@v3
366+
- id: harden-runner
367+
name: Harden the runner
368+
uses: step-security/harden-runner@v2
369+
with:
370+
egress-policy: audit
371+
- uses: actions/checkout@v4
307372
- id: setup-python
308373
uses: actions/setup-python@v4
309374
with:
@@ -345,32 +410,41 @@ jobs:
345410
# GitHub Container Registry. The contents of README.md are pushed as the
346411
# image's description to Docker Hub. This job is skipped when the
347412
# triggering event is a pull request.
348-
name: "Build and push all platforms"
349-
runs-on: ubuntu-latest
350-
needs: [lint, prepare, test]
351413
if: github.event_name != 'pull_request'
414+
name: Build and push all platforms
415+
needs:
416+
- diagnostics
417+
- lint
418+
- prepare
419+
- test
352420
# When Dependabot creates a PR it requires this permission in
353421
# order to push Docker images to ghcr.io.
354422
permissions:
355423
packages: write
424+
runs-on: ubuntu-latest
356425
steps:
426+
- id: harden-runner
427+
name: Harden the runner
428+
uses: step-security/harden-runner@v2
429+
with:
430+
egress-policy: audit
357431
- name: Login to Docker Hub
358-
uses: docker/login-action@v2
432+
uses: docker/login-action@v3
359433
with:
360434
username: ${{ secrets.DOCKER_USERNAME }}
361435
password: ${{ secrets.DOCKER_PASSWORD }}
362436
- name: Login to GitHub Container Registry
363-
uses: docker/login-action@v2
437+
uses: docker/login-action@v3
364438
with:
365439
registry: ghcr.io
366440
username: ${{ github.actor }}
367441
password: ${{ secrets.GITHUB_TOKEN }}
368442
- name: Checkout
369-
uses: actions/checkout@v3
443+
uses: actions/checkout@v4
370444
- name: Set up QEMU
371-
uses: docker/setup-qemu-action@v2
445+
uses: docker/setup-qemu-action@v3
372446
- name: Set up Docker Buildx
373-
uses: docker/setup-buildx-action@v2
447+
uses: docker/setup-buildx-action@v3
374448
- name: Cache Docker layers
375449
uses: actions/cache@v3
376450
env:
@@ -384,7 +458,7 @@ jobs:
384458
run: ./buildx-dockerfile.sh
385459
- name: Build and push platform images to registries
386460
id: docker_build
387-
uses: docker/build-push-action@v4
461+
uses: docker/build-push-action@v5
388462
with:
389463
build-args: |
390464
VERSION=${{ needs.prepare.outputs.source_version }}
@@ -393,6 +467,11 @@ jobs:
393467
context: .
394468
file: ./Dockerfile-x
395469
platforms: ${{ env.PLATFORMS }}
470+
# Uncomment the following option if you are building an image for use
471+
# on Google Cloud Run or AWS Lambda. The current default image output
472+
# is unable to run on either. Please see the following issue for more
473+
# information: https://github.com/docker/buildx/issues/1533
474+
# provenance: false
396475
push: true
397476
tags: ${{ needs.prepare.outputs.tags }}
398477
# For a list of pre-defined annotation keys and value types see:

‎.github/workflows/codeql-analysis.yml

+27-2
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
#
55
# You may wish to alter this file to override the set of languages analyzed,
66
# or to provide custom queries or build logic.
7-
name: "CodeQL"
7+
name: CodeQL
88

99
on:
1010
push:
@@ -20,8 +20,27 @@ on:
2020
- cron: '0 21 * * 6'
2121

2222
jobs:
23+
diagnostics:
24+
name: Run diagnostics
25+
runs-on: ubuntu-latest
26+
steps:
27+
# Note that a duplicate of this step must be added at the top of
28+
# each job.
29+
- id: harden-runner
30+
name: Harden the runner
31+
uses: step-security/harden-runner@v2
32+
with:
33+
egress-policy: audit
34+
- id: github-status
35+
name: Check GitHub status
36+
uses: crazy-max/ghaction-github-status@v3
37+
- id: dump-context
38+
name: Dump context
39+
uses: crazy-max/ghaction-dump-context@v2
2340
analyze:
2441
name: Analyze
42+
needs:
43+
- diagnostics
2544
runs-on: ubuntu-latest
2645
permissions:
2746
# required for all workflows
@@ -37,8 +56,14 @@ jobs:
3756
# https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
3857

3958
steps:
59+
- id: harden-runner
60+
name: Harden the runner
61+
uses: step-security/harden-runner@v2
62+
with:
63+
egress-policy: audit
64+
4065
- name: Checkout repository
41-
uses: actions/checkout@v3
66+
uses: actions/checkout@v4
4267

4368
# Initializes the CodeQL tools for scanning.
4469
- name: Initialize CodeQL

‎.github/workflows/sync-labels.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,10 @@ jobs:
1919
issues: write
2020
runs-on: ubuntu-latest
2121
steps:
22-
- uses: actions/checkout@v3
22+
- uses: actions/checkout@v4
2323
- name: Sync repository labels
2424
if: success()
25-
uses: crazy-max/ghaction-github-labeler@v4
25+
uses: crazy-max/ghaction-github-labeler@v5
2626
with:
2727
# This is a hideous ternary equivalent so we only do a dry run unless
2828
# this workflow is triggered by the develop branch.

0 commit comments

Comments
 (0)