Skip to content

Commit 693678b

Browse files
mcdonnnjmcdonnnj
authored
Merge pull request #160 from cisagov/lineage/skeleton
⚠️ CONFLICT! Lineage pull request for: skeleton
2 parents 74d20ab + 530576b commit 693678b

File tree

6 files changed

+96
-34
lines changed

6 files changed

+96
-34
lines changed

‎.bandit.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
# https://bandit.readthedocs.io/en/latest/config.html
44

55
# Tests are first included by `tests`, and then excluded by `skips`.
6-
# If `tests` is empty, all tests are are considered included.
6+
# If `tests` is empty, all tests are considered included.
77

88
tests:
99
# - B101

‎.github/dependabot.yml

Lines changed: 18 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -5,31 +5,35 @@
55
# these updates when the pull request(s) in the appropriate skeleton are merged
66
# and Lineage processes these changes.
77

8-
version: 2
98
updates:
10-
- package-ecosystem: "github-actions"
11-
directory: "/"
12-
schedule:
13-
interval: "weekly"
9+
- directory: /
1410
ignore:
1511
# Managed by cisagov/skeleton-generic
1612
- dependency-name: actions/cache
1713
- dependency-name: actions/checkout
1814
- dependency-name: actions/setup-go
1915
- dependency-name: actions/setup-python
16+
- dependency-name: crazy-max/ghaction-dump-context
17+
- dependency-name: crazy-max/ghaction-github-labeler
18+
- dependency-name: crazy-max/ghaction-github-status
2019
- dependency-name: hashicorp/setup-terraform
2120
- dependency-name: mxschmitt/action-tmate
22-
23-
- package-ecosystem: "pip"
24-
directory: "/"
21+
- dependency-name: step-security/harden-runner
22+
package-ecosystem: github-actions
2523
schedule:
26-
interval: "weekly"
24+
interval: weekly
25+
26+
- directory: /
2727
# ignore:
2828
# # Managed by cisagov/skeleton-ansible-role
29-
# - dependency-name: "ansible"
30-
# - dependency-name: "ansible-lint"
29+
# - dependency-name: ansible
30+
# - dependency-name: ansible-lint
31+
package-ecosystem: pip
32+
schedule:
33+
interval: weekly
3134

32-
- package-ecosystem: "terraform"
33-
directory: "/"
35+
- directory: /
36+
package-ecosystem: terraform
3437
schedule:
35-
interval: "weekly"
38+
interval: weekly
39+
version: 2

‎.github/workflows/build.yml

Lines changed: 49 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,36 @@ env:
1414
RUN_TMATE: ${{ secrets.RUN_TMATE }}
1515

1616
jobs:
17+
diagnostics:
18+
name: Run diagnostics
19+
runs-on: ubuntu-latest
20+
steps:
21+
# Note that a duplicate of this step must be added at the top of
22+
# each job.
23+
- id: harden-runner
24+
name: Harden the runner
25+
uses: step-security/harden-runner@v2
26+
with:
27+
egress-policy: audit
28+
- id: github-status
29+
name: Check GitHub status
30+
uses: crazy-max/ghaction-github-status@v3
31+
- id: dump-context
32+
name: Dump context
33+
uses: crazy-max/ghaction-dump-context@v2
1734
lint:
35+
needs:
36+
- diagnostics
1837
runs-on: ubuntu-latest
1938
steps:
39+
- id: harden-runner
40+
name: Harden the runner
41+
uses: step-security/harden-runner@v2
42+
with:
43+
egress-policy: audit
2044
- id: setup-env
2145
uses: cisagov/setup-env-github-action@develop
22-
- uses: actions/checkout@v3
46+
- uses: actions/checkout@v4
2347
- id: setup-python
2448
uses: actions/setup-python@v4
2549
with:
@@ -80,11 +104,26 @@ jobs:
80104
- uses: hashicorp/setup-terraform@v2
81105
with:
82106
terraform_version: ${{ steps.setup-env.outputs.terraform-version }}
107+
- name: Install go-critic
108+
env:
109+
PACKAGE_URL: github.com/go-critic/go-critic/cmd/gocritic
110+
PACKAGE_VERSION: ${{ steps.setup-env.outputs.go-critic-version }}
111+
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
112+
- name: Install gosec
113+
env:
114+
PACKAGE_URL: github.com/securego/gosec/v2/cmd/gosec
115+
PACKAGE_VERSION: ${{ steps.setup-env.outputs.gosec-version }}
116+
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
83117
- name: Install shfmt
84118
env:
85119
PACKAGE_URL: mvdan.cc/sh/v3/cmd/shfmt
86120
PACKAGE_VERSION: ${{ steps.setup-env.outputs.shfmt-version }}
87121
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
122+
- name: Install staticcheck
123+
env:
124+
PACKAGE_URL: honnef.co/go/tools/cmd/staticcheck
125+
PACKAGE_VERSION: ${{ steps.setup-env.outputs.staticcheck-version }}
126+
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
88127
- name: Install Terraform-docs
89128
env:
90129
PACKAGE_URL: github.com/terraform-docs/terraform-docs
@@ -102,14 +141,21 @@ jobs:
102141
uses: mxschmitt/action-tmate@v3
103142
if: env.RUN_TMATE
104143
test:
144+
needs:
145+
- diagnostics
146+
runs-on: ubuntu-latest
105147
strategy:
106148
fail-fast: false
107149
matrix:
108150
scenario:
109151
- default
110-
runs-on: ubuntu-latest
111152
steps:
112-
- uses: actions/checkout@v3
153+
- id: harden-runner
154+
name: Harden the runner
155+
uses: step-security/harden-runner@v2
156+
with:
157+
egress-policy: audit
158+
- uses: actions/checkout@v4
113159
- id: setup-python
114160
uses: actions/setup-python@v4
115161
with:

‎.github/workflows/codeql-analysis.yml

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
#
55
# You may wish to alter this file to override the set of languages analyzed,
66
# or to provide custom queries or build logic.
7-
name: "CodeQL"
7+
name: CodeQL
88

99
on:
1010
push:
@@ -37,8 +37,14 @@ jobs:
3737
# https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
3838

3939
steps:
40+
- id: harden-runner
41+
name: Harden the runner
42+
uses: step-security/harden-runner@v2
43+
with:
44+
egress-policy: audit
45+
4046
- name: Checkout repository
41-
uses: actions/checkout@v3
47+
uses: actions/checkout@v4
4248

4349
# Initializes the CodeQL tools for scanning.
4450
- name: Initialize CodeQL

‎.github/workflows/sync-labels.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,10 @@ jobs:
1919
issues: write
2020
runs-on: ubuntu-latest
2121
steps:
22-
- uses: actions/checkout@v3
22+
- uses: actions/checkout@v4
2323
- name: Sync repository labels
2424
if: success()
25-
uses: crazy-max/ghaction-github-labeler@v4
25+
uses: crazy-max/ghaction-github-labeler@v5
2626
with:
2727
# This is a hideous ternary equivalent so we only do a dry run unless
2828
# this workflow is triggered by the develop branch.

‎.pre-commit-config.yaml

Lines changed: 18 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -31,13 +31,13 @@ repos:
3131

3232
# Text file hooks
3333
- repo: https://github.com/igorshubovych/markdownlint-cli
34-
rev: v0.34.0
34+
rev: v0.36.0
3535
hooks:
3636
- id: markdownlint
3737
args:
3838
- --config=.mdl_config.yaml
3939
- repo: https://github.com/pre-commit/mirrors-prettier
40-
rev: v3.0.0-alpha.9-for-vscode
40+
rev: v3.0.3
4141
hooks:
4242
- id: prettier
4343
- repo: https://github.com/adrienverge/yamllint
@@ -49,14 +49,14 @@ repos:
4949

5050
# GitHub Actions hooks
5151
- repo: https://github.com/python-jsonschema/check-jsonschema
52-
rev: 0.23.1
52+
rev: 0.26.3
5353
hooks:
5454
- id: check-github-actions
5555
- id: check-github-workflows
5656

5757
# pre-commit hooks
5858
- repo: https://github.com/pre-commit/pre-commit
59-
rev: v3.3.2
59+
rev: v3.4.0
6060
hooks:
6161
- id: validate_manifest
6262

@@ -79,6 +79,12 @@ repos:
7979
# GoSec
8080
- id: go-sec-repo-mod
8181

82+
# Nix hooks
83+
- repo: https://github.com/nix-community/nixpkgs-fmt
84+
rev: v1.3.0
85+
hooks:
86+
- id: nixpkgs-fmt
87+
8288
# Shell script hooks
8389
- repo: https://github.com/cisagov/pre-commit-shfmt
8490
rev: v0.0.2
@@ -108,12 +114,12 @@ repos:
108114
exclude: molecule/default/tests
109115
args:
110116
- --config=.bandit.yml
111-
- repo: https://github.com/psf/black
112-
rev: 23.3.0
117+
- repo: https://github.com/psf/black-pre-commit-mirror
118+
rev: 23.9.1
113119
hooks:
114120
- id: black
115121
- repo: https://github.com/PyCQA/flake8
116-
rev: 6.0.0
122+
rev: 6.1.0
117123
hooks:
118124
- id: flake8
119125
additional_dependencies:
@@ -123,24 +129,24 @@ repos:
123129
hooks:
124130
- id: isort
125131
- repo: https://github.com/pre-commit/mirrors-mypy
126-
rev: v1.3.0
132+
rev: v1.5.1
127133
hooks:
128134
- id: mypy
129135
- repo: https://github.com/asottile/pyupgrade
130-
rev: v3.4.0
136+
rev: v3.10.1
131137
hooks:
132138
- id: pyupgrade
133139

134140
# Ansible hooks
135-
- repo: https://github.com/ansible-community/ansible-lint
136-
rev: v6.17.0
141+
- repo: https://github.com/ansible/ansible-lint
142+
rev: v6.19.0
137143
hooks:
138144
- id: ansible-lint
139145
# files: molecule/default/playbook.yml
140146

141147
# Terraform hooks
142148
- repo: https://github.com/antonbabenko/pre-commit-terraform
143-
rev: v1.80.0
149+
rev: v1.83.2
144150
hooks:
145151
- id: terraform_fmt
146152
- id: terraform_validate

0 commit comments

Comments
 (0)