Skip to content

Commit 9f9f13d

Browse files
jsf9kjsf9k
authored
Merge pull request #28 from cisagov/lineage/skeleton
⚠️ CONFLICT! Lineage pull request for: skeleton
2 parents bccbbeb + 6788b7d commit 9f9f13d

File tree

13 files changed

+338
-142
lines changed

13 files changed

+338
-142
lines changed

‎.github/CODEOWNERS

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,17 @@
88
# These folks own any files in the .github directory at the root of
99
# the repository and any of its subdirectories.
1010
/.github/ @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
11+
12+
# These folks own all linting configuration files.
13+
/.ansible-lint @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
14+
/.bandit.yml @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
15+
/.flake8 @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
16+
/.isort.cfg @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
17+
/.mdl_config.yaml @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
18+
/.pre-commit-config.yaml @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
19+
/.prettierignore @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
20+
/.yamllint @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
21+
/requirements.txt @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
22+
/requirements-dev.txt @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
23+
/requirements-test.txt @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
24+
/setup-env @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj

‎.github/dependabot.yml

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,7 @@ updates:
2222
# Managed by cisagov/skeleton-python-library
2323
- dependency-name: actions/download-artifact
2424
- dependency-name: actions/upload-artifact
25-
- dependency-name: github/codeql-action/analyze
26-
- dependency-name: github/codeql-action/autobuild
27-
- dependency-name: github/codeql-action/init
25+
- dependency-name: github/codeql-action
2826
package-ecosystem: github-actions
2927
schedule:
3028
interval: weekly

‎.github/workflows/build.yml

Lines changed: 67 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,31 @@
22
name: build
33

44
on:
5-
push:
5+
merge_group:
6+
types:
7+
- checks_requested
68
pull_request:
9+
push:
710
repository_dispatch:
8-
types: [apb]
11+
types:
12+
- apb
13+
14+
# Set a default shell for any run steps. The `-Eueo pipefail` sets errtrace,
15+
# nounset, errexit, and pipefail. The `-x` will print all commands as they are
16+
# run. Please see the GitHub Actions documentation for more information:
17+
# https://docs.github.com/en/actions/using-jobs/setting-default-values-for-jobs
18+
defaults:
19+
run:
20+
shell: bash -Eueo pipefail -x {0}
921

1022
env:
1123
CURL_CACHE_DIR: ~/.cache/curl
1224
PIP_CACHE_DIR: ~/.cache/pip
1325
PRE_COMMIT_CACHE_DIR: ~/.cache/pre-commit
1426
RUN_TMATE: ${{ secrets.RUN_TMATE }}
27+
TERRAFORM_DOCS_REPO_BRANCH_NAME: improvement/support_atx_closed_markdown_headers
28+
TERRAFORM_DOCS_REPO_DEPTH: 1
29+
TERRAFORM_DOCS_REPO_URL: https://github.com/mcdonnnj/terraform-docs.git
1530

1631
jobs:
1732
diagnostics:
@@ -27,7 +42,7 @@ jobs:
2742
egress-policy: audit
2843
- id: github-status
2944
name: Check GitHub status
30-
uses: crazy-max/ghaction-github-status@v3
45+
uses: crazy-max/ghaction-github-status@v4
3146
- id: dump-context
3247
name: Dump context
3348
uses: crazy-max/ghaction-dump-context@v2
@@ -45,20 +60,20 @@ jobs:
4560
uses: cisagov/setup-env-github-action@develop
4661
- uses: actions/checkout@v4
4762
- id: setup-python
48-
uses: actions/setup-python@v4
63+
uses: actions/setup-python@v5
4964
with:
50-
python-version: "3.11"
65+
python-version: ${{ steps.setup-env.outputs.python-version }}
5166
# We need the Go version and Go cache location for the actions/cache step,
5267
# so the Go installation must happen before that.
5368
- id: setup-go
54-
uses: actions/setup-go@v4
69+
uses: actions/setup-go@v5
5570
with:
5671
# There is no expectation for actual Go code so we disable caching as
5772
# it relies on the existence of a go.sum file.
5873
cache: false
59-
go-version: "1.20"
60-
- name: Lookup Go cache directory
61-
id: go-cache
74+
go-version: ${{ steps.setup-env.outputs.go-version }}
75+
- id: go-cache
76+
name: Lookup Go cache directory
6277
run: |
6378
echo "dir=$(go env GOCACHE)" >> $GITHUB_OUTPUT
6479
- uses: actions/cache@v3
@@ -69,6 +84,14 @@ jobs:
6984
packer${{ steps.setup-env.outputs.packer-version }}-\
7085
tf${{ steps.setup-env.outputs.terraform-version }}-"
7186
with:
87+
# We do not use '**/setup.py' in the cache key so only the 'setup.py'
88+
# file in the root of the repository is used. This is in case a Python
89+
# package were to have a 'setup.py' as part of its internal codebase.
90+
key: "${{ env.BASE_CACHE_KEY }}\
91+
${{ hashFiles('**/requirements-test.txt') }}-\
92+
${{ hashFiles('**/requirements.txt') }}-\
93+
${{ hashFiles('**/.pre-commit-config.yaml') }}-\
94+
${{ hashFiles('setup.py') }}"
7295
# Note that the .terraform directory IS NOT included in the
7396
# cache because if we were caching, then we would need to use
7497
# the `-upgrade=true` option. This option blindly pulls down the
@@ -80,14 +103,6 @@ jobs:
80103
${{ env.PRE_COMMIT_CACHE_DIR }}
81104
${{ env.CURL_CACHE_DIR }}
82105
${{ steps.go-cache.outputs.dir }}
83-
# We do not use '**/setup.py' in the cache key so only the 'setup.py'
84-
# file in the root of the repository is used. This is in case a Python
85-
# package were to have a 'setup.py' as part of its internal codebase.
86-
key: "${{ env.BASE_CACHE_KEY }}\
87-
${{ hashFiles('**/requirements-test.txt') }}-\
88-
${{ hashFiles('**/requirements.txt') }}-\
89-
${{ hashFiles('**/.pre-commit-config.yaml') }}-\
90-
${{ hashFiles('setup.py') }}"
91106
restore-keys: |
92107
${{ env.BASE_CACHE_KEY }}
93108
- name: Setup curl cache
@@ -105,34 +120,46 @@ jobs:
105120
${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}"
106121
sudo mv /usr/local/bin/packer /usr/local/bin/packer-default
107122
sudo ln -s /opt/packer/packer /usr/local/bin/packer
108-
- uses: hashicorp/setup-terraform@v2
123+
- uses: hashicorp/setup-terraform@v3
109124
with:
110125
terraform_version: ${{ steps.setup-env.outputs.terraform-version }}
111126
- name: Install go-critic
112127
env:
113128
PACKAGE_URL: github.com/go-critic/go-critic/cmd/gocritic
114129
PACKAGE_VERSION: ${{ steps.setup-env.outputs.go-critic-version }}
115130
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
131+
- name: Install goimports
132+
env:
133+
PACKAGE_URL: golang.org/x/tools/cmd/goimports
134+
PACKAGE_VERSION: ${{ steps.setup-env.outputs.goimports-version }}
135+
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
116136
- name: Install gosec
117137
env:
118138
PACKAGE_URL: github.com/securego/gosec/v2/cmd/gosec
119139
PACKAGE_VERSION: ${{ steps.setup-env.outputs.gosec-version }}
120140
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
121-
- name: Install shfmt
122-
env:
123-
PACKAGE_URL: mvdan.cc/sh/v3/cmd/shfmt
124-
PACKAGE_VERSION: ${{ steps.setup-env.outputs.shfmt-version }}
125-
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
126141
- name: Install staticcheck
127142
env:
128143
PACKAGE_URL: honnef.co/go/tools/cmd/staticcheck
129144
PACKAGE_VERSION: ${{ steps.setup-env.outputs.staticcheck-version }}
130145
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
131-
- name: Install Terraform-docs
132-
env:
133-
PACKAGE_URL: github.com/terraform-docs/terraform-docs
134-
PACKAGE_VERSION: ${{ steps.setup-env.outputs.terraform-docs-version }}
135-
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
146+
# TODO: https://github.com/cisagov/skeleton-generic/issues/165
147+
# We are temporarily using @mcdonnnj's forked branch of terraform-docs
148+
# until his PR: https://github.com/terraform-docs/terraform-docs/pull/745
149+
# is approved. This temporary fix will allow for ATX header support when
150+
# terraform-docs is run during linting.
151+
- name: Clone ATX headers branch from terraform-docs fork
152+
run: |
153+
git clone \
154+
--branch $TERRAFORM_DOCS_REPO_BRANCH_NAME \
155+
--depth $TERRAFORM_DOCS_REPO_DEPTH \
156+
--single-branch \
157+
$TERRAFORM_DOCS_REPO_URL /tmp/terraform-docs
158+
- name: Build and install terraform-docs binary
159+
run: |
160+
go build \
161+
-C /tmp/terraform-docs \
162+
-o $(go env GOPATH)/bin/terraform-docs
136163
- name: Install dependencies
137164
run: |
138165
python -m pip install --upgrade pip setuptools wheel
@@ -148,22 +175,17 @@ jobs:
148175
name: test source - py${{ matrix.python-version }}
149176
needs:
150177
- diagnostics
151-
runs-on: ${{ matrix.os }}
178+
runs-on: ubuntu-latest
152179
strategy:
153180
fail-fast: false
154181
matrix:
155-
os:
156-
- ubuntu-latest
157182
python-version:
158183
- "3.7"
159184
- "3.8"
160185
- "3.9"
161186
- "3.10"
162187
- "3.11"
163188
- "3.12"
164-
include:
165-
- os: ubuntu-20.04
166-
python-version: "3.6"
167189
steps:
168190
- id: harden-runner
169191
name: Harden the runner
@@ -172,7 +194,7 @@ jobs:
172194
egress-policy: audit
173195
- uses: actions/checkout@v4
174196
- id: setup-python
175-
uses: actions/setup-python@v4
197+
uses: actions/setup-python@v5
176198
with:
177199
python-version: ${{ matrix.python-version }}
178200
- uses: actions/cache@v3
@@ -221,10 +243,12 @@ jobs:
221243
with:
222244
egress-policy: audit
223245
- uses: actions/checkout@v4
246+
- id: setup-env
247+
uses: cisagov/setup-env-github-action@develop
224248
- id: setup-python
225-
uses: actions/setup-python@v4
249+
uses: actions/setup-python@v5
226250
with:
227-
python-version: "3.10"
251+
python-version: ${{ steps.setup-env.outputs.python-version }}
228252
- uses: actions/cache@v3
229253
env:
230254
BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\
@@ -257,22 +281,17 @@ jobs:
257281
- diagnostics
258282
- lint
259283
- test
260-
runs-on: ${{ matrix.os }}
284+
runs-on: ubuntu-latest
261285
strategy:
262286
fail-fast: false
263287
matrix:
264-
os:
265-
- ubuntu-latest
266288
python-version:
267289
- "3.7"
268290
- "3.8"
269291
- "3.9"
270292
- "3.10"
271293
- "3.11"
272294
- "3.12"
273-
include:
274-
- os: ubuntu-20.04
275-
python-version: "3.6"
276295
steps:
277296
- id: harden-runner
278297
name: Harden the runner
@@ -281,7 +300,7 @@ jobs:
281300
egress-policy: audit
282301
- uses: actions/checkout@v4
283302
- id: setup-python
284-
uses: actions/setup-python@v4
303+
uses: actions/setup-python@v5
285304
with:
286305
python-version: ${{ matrix.python-version }}
287306
- uses: actions/cache@v3
@@ -305,7 +324,7 @@ jobs:
305324
- name: Build artifacts
306325
run: python -m build
307326
- name: Upload artifacts
308-
uses: actions/upload-artifact@v3
327+
uses: actions/upload-artifact@v4
309328
with:
310329
name: dist-${{ matrix.python-version }}
311330
path: dist
@@ -317,22 +336,17 @@ jobs:
317336
needs:
318337
- diagnostics
319338
- build
320-
runs-on: ${{ matrix.os }}
339+
runs-on: ubuntu-latest
321340
strategy:
322341
fail-fast: false
323342
matrix:
324-
os:
325-
- ubuntu-latest
326343
python-version:
327344
- "3.7"
328345
- "3.8"
329346
- "3.9"
330347
- "3.10"
331348
- "3.11"
332349
- "3.12"
333-
include:
334-
- os: ubuntu-20.04
335-
python-version: "3.6"
336350
steps:
337351
- id: harden-runner
338352
name: Harden the runner
@@ -341,7 +355,7 @@ jobs:
341355
egress-policy: audit
342356
- uses: actions/checkout@v4
343357
- id: setup-python
344-
uses: actions/setup-python@v4
358+
uses: actions/setup-python@v5
345359
with:
346360
python-version: ${{ matrix.python-version }}
347361
- uses: actions/cache@v3
@@ -359,7 +373,7 @@ jobs:
359373
restore-keys: |
360374
${{ env.BASE_CACHE_KEY }}
361375
- name: Retrieve the built wheel
362-
uses: actions/download-artifact@v3
376+
uses: actions/download-artifact@v4
363377
with:
364378
name: dist-${{ matrix.python-version }}
365379
path: dist

‎.github/workflows/codeql-analysis.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -67,15 +67,15 @@ jobs:
6767

6868
# Initializes the CodeQL tools for scanning.
6969
- name: Initialize CodeQL
70-
uses: github/codeql-action/init@v2
70+
uses: github/codeql-action/init@v3
7171
with:
7272
languages: ${{ matrix.language }}
7373

7474
# Autobuild attempts to build any compiled languages (C/C++, C#, or
7575
# Java). If this step fails, then you should remove it and run the build
7676
# manually (see below).
7777
- name: Autobuild
78-
uses: github/codeql-action/autobuild@v2
78+
uses: github/codeql-action/autobuild@v3
7979

8080
# ℹ️ Command-line programs to run using the OS shell.
8181
# 📚 https://git.io/JvXDl
@@ -89,4 +89,4 @@ jobs:
8989
# make release
9090

9191
- name: Perform CodeQL Analysis
92-
uses: github/codeql-action/analyze@v2
92+
uses: github/codeql-action/analyze@v3

‎.github/workflows/sync-labels.yml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,38 @@ permissions:
1111
contents: read
1212

1313
jobs:
14+
diagnostics:
15+
name: Run diagnostics
16+
runs-on: ubuntu-latest
17+
steps:
18+
# Note that a duplicate of this step must be added at the top of
19+
# each job.
20+
- id: harden-runner
21+
name: Harden the runner
22+
uses: step-security/harden-runner@v2
23+
with:
24+
egress-policy: audit
25+
- id: github-status
26+
name: Check GitHub status
27+
uses: crazy-max/ghaction-github-status@v3
28+
- id: dump-context
29+
name: Dump context
30+
uses: crazy-max/ghaction-dump-context@v2
1431
labeler:
32+
needs:
33+
- diagnostics
1534
permissions:
1635
# actions/checkout needs this to fetch code
1736
contents: read
1837
# crazy-max/ghaction-github-labeler needs this to manage repository labels
1938
issues: write
2039
runs-on: ubuntu-latest
2140
steps:
41+
- id: harden-runner
42+
name: Harden the runner
43+
uses: step-security/harden-runner@v2
44+
with:
45+
egress-policy: audit
2246
- uses: actions/checkout@v4
2347
- name: Sync repository labels
2448
if: success()

0 commit comments

Comments
 (0)