Merge pull request #92 from cisagov/lineage/skeleton

⚠️ CONFLICT! Lineage pull request for: skeleton
cisagov · Nov 3, 2023 · f267922 · f267922
2 parents 793f5d4 + cf7985f
commit f267922
Show file tree

Hide file tree

Showing 27 changed files with 230 additions and 76 deletions.
diff --git a/.bandit.yml b/.bandit.yml
@@ -4,7 +4,7 @@
 # This config is applied to bandit when scanning the "tests" tree
 
 # Tests are first included by `tests`, and then excluded by `skips`.
-# If `tests` is empty, all tests are are considered included.
+# If `tests` is empty, all tests are considered included.
 
 tests:
 # - B101

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -5,40 +5,44 @@
 # these updates when the pull request(s) in the appropriate skeleton are merged
 # and Lineage processes these changes.
 
-version: 2
 updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
+  - directory: /
     ignore:
       # Managed by cisagov/skeleton-generic
       - dependency-name: actions/cache
       - dependency-name: actions/checkout
       - dependency-name: actions/setup-go
       - dependency-name: actions/setup-python
+      - dependency-name: crazy-max/ghaction-dump-context
+      - dependency-name: crazy-max/ghaction-github-labeler
+      - dependency-name: crazy-max/ghaction-github-status
       - dependency-name: hashicorp/setup-terraform
       - dependency-name: mxschmitt/action-tmate
+      - dependency-name: step-security/harden-runner
       # Managed by cisagov/skeleton-packer
       - dependency-name: aws-actions/configure-aws-credentials
-
-  - package-ecosystem: "pip"
-    directory: "/"
+    package-ecosystem: github-actions
     schedule:
-      interval: "weekly"
+      interval: weekly
 
-  - package-ecosystem: "terraform"
-    directory: "/terraform-build-user"
+  - directory: /
+    package-ecosystem: pip
     schedule:
-      interval: "weekly"
-    # Managed by cisagov/skeleton-packer
-    ignore:
-      - dependency-name: "hashicorp/aws"
+      interval: weekly
 
-  - package-ecosystem: "terraform"
-    directory: "/terraform-post-packer"
+  - directory: /terraform-build-user
+    ignore:
+      # Managed by cisagov/skeleton-packer
+      - dependency-name: hashicorp/aws
+    package-ecosystem: terraform
     schedule:
-      interval: "weekly"
-    # Managed by cisagov/skeleton-packer
+      interval: weekly
+
+  - directory: /terraform-post-packer
     ignore:
-      - dependency-name: "hashicorp/aws"
+      # Managed by cisagov/skeleton-packer
+      - dependency-name: hashicorp/aws
+    package-ecosystem: terraform
+    schedule:
+      interval: weekly
+version: 2
diff --git a/.github/labels.yml b/.github/labels.yml
@@ -2,6 +2,9 @@
 # Rather than breaking up descriptions into multiline strings we disable that
 # specific rule in yamllint for this file.
 # yamllint disable rule:line-length
+- color: "f15a53"
+  description: Pull requests that update Ansible code
+  name: ansible
 - color: "eb6420"
   description: This issue or pull request is awaiting the outcome of another issue or pull request
   name: blocked
@@ -50,6 +53,9 @@
 - color: "fcdb45"
   description: This pull request is awaiting an action or decision to move forward
   name: on hold
+- color: "02a8ef"
+  description: Pull requests that update Packer code
+  name: packer
 - color: "ef476c"
   description: This issue is a request for information or needs discussion
   name: question

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -15,12 +15,36 @@ env:
   RUN_TMATE: ${{ secrets.RUN_TMATE }}
 
 jobs:
+  diagnostics:
+    name: Run diagnostics
+    runs-on: ubuntu-latest
+    steps:
+      # Note that a duplicate of this step must be added at the top of
+      # each job.
+      - id: harden-runner
+        name: Harden the runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+      - id: github-status
+        name: Check GitHub status
+        uses: crazy-max/ghaction-github-status@v3
+      - id: dump-context
+        name: Dump context
+        uses: crazy-max/ghaction-dump-context@v2
   lint:
+    needs:
+      - diagnostics
     runs-on: ubuntu-latest
     steps:
+      - id: harden-runner
+        name: Harden the runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
       - id: setup-env
         uses: cisagov/setup-env-github-action@develop
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - id: setup-python
         uses: actions/setup-python@v4
         with:
@@ -81,11 +105,26 @@ jobs:
       - uses: hashicorp/setup-terraform@v2
         with:
           terraform_version: ${{ steps.setup-env.outputs.terraform-version }}
+      - name: Install go-critic
+        env:
+          PACKAGE_URL: github.com/go-critic/go-critic/cmd/gocritic
+          PACKAGE_VERSION: ${{ steps.setup-env.outputs.go-critic-version }}
+        run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
+      - name: Install gosec
+        env:
+          PACKAGE_URL: github.com/securego/gosec/v2/cmd/gosec
+          PACKAGE_VERSION: ${{ steps.setup-env.outputs.gosec-version }}
+        run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
       - name: Install shfmt
         env:
           PACKAGE_URL: mvdan.cc/sh/v3/cmd/shfmt
           PACKAGE_VERSION: ${{ steps.setup-env.outputs.shfmt-version }}
         run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
+      - name: Install staticcheck
+        env:
+          PACKAGE_URL: honnef.co/go/tools/cmd/staticcheck
+          PACKAGE_VERSION: ${{ steps.setup-env.outputs.staticcheck-version }}
+        run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
       - name: Install Terraform-docs
         env:
           PACKAGE_URL: github.com/terraform-docs/terraform-docs
@@ -97,6 +136,10 @@ jobs:
           pip install --upgrade --requirement requirements-test.txt
       - name: Install Ansible roles
         run: ansible-galaxy install --force --role-file src/requirements.yml
+      # This must happen before pre-commit is run or the Packer format
+      # linter will throw an error.
+      - name: Install Packer plugins
+        run: packer init src
       - name: Set up pre-commit hook environments
         run: pre-commit install-hooks
       - name: Run pre-commit on all files
@@ -105,11 +148,18 @@ jobs:
         uses: mxschmitt/action-tmate@v3
         if: env.RUN_TMATE
   test:
+    needs:
+      - diagnostics
     runs-on: ubuntu-latest
     steps:
+      - id: harden-runner
+        name: Harden the runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
       - id: setup-env
         uses: cisagov/setup-env-github-action@develop
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - id: setup-python
         uses: actions/setup-python@v4
         with:
@@ -157,12 +207,19 @@ jobs:
   build:
     # The AMI build process is an expensive test (in terms of time) so
     # let's not run it unless the other jobs succeed.
-    needs: [lint, test]
+    needs:
+      - lint
+      - test
     runs-on: ubuntu-latest
     steps:
+      - id: harden-runner
+        name: Harden the runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
       - id: setup-env
         uses: cisagov/setup-env-github-action@develop
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - id: setup-python
         uses: actions/setup-python@v4
         with:
@@ -207,7 +264,7 @@ jobs:
       - name: Install Ansible roles
         run: ansible-galaxy install --force --role-file src/requirements.yml
       - name: Assume AWS build role
-        uses: aws-actions/configure-aws-credentials@v1
+        uses: aws-actions/configure-aws-credentials@v4
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -225,6 +282,8 @@ jobs:
           sudo mv /usr/bin/python3 /usr/bin/python3-default
           sudo ln -s ${{ env.pythonLocation }}/bin/python3 \
           /usr/bin/python3
+      - name: Install Packer plugins
+        run: packer init src
       - name: Create machine image
         # This runs through the AMI creation process but does not
         # actually create an AMI

diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
@@ -12,12 +12,36 @@ env:
   RUN_TMATE: ${{ secrets.RUN_TMATE }}
 
 jobs:
+  diagnostics:
+    name: Run diagnostics
+    runs-on: ubuntu-latest
+    steps:
+      # Note that a duplicate of this step must be added at the top of
+      # each job.
+      - id: harden-runner
+        name: Harden the runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+      - id: github-status
+        name: Check GitHub status
+        uses: crazy-max/ghaction-github-status@v3
+      - id: dump-context
+        name: Dump context
+        uses: crazy-max/ghaction-dump-context@v2
   prerelease:
+    needs:
+      - diagnostics
     runs-on: ubuntu-latest
     steps:
+      - id: harden-runner
+        name: Harden the runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
       - id: setup-env
         uses: cisagov/setup-env-github-action@develop
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - id: setup-python
         uses: actions/setup-python@v4
         with:
@@ -62,7 +86,7 @@ jobs:
       - name: Install ansible roles
         run: ansible-galaxy install --force --role-file src/requirements.yml
       - name: Assume AWS build role
-        uses: aws-actions/configure-aws-credentials@v1
+        uses: aws-actions/configure-aws-credentials@v4
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -80,6 +104,8 @@ jobs:
           sudo mv /usr/bin/python3 /usr/bin/python3-default
           sudo ln -s ${{ env.pythonLocation }}/bin/python3 \
           /usr/bin/python3
+      - name: Install Packer plugins
+        run: packer init src
       - name: Create machine image
         env:
           # Since we are using the default value of 15 seconds for

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -19,12 +19,36 @@ env:
   RUN_TMATE: ${{ secrets.RUN_TMATE }}
 
 jobs:
+  diagnostics:
+    name: Run diagnostics
+    runs-on: ubuntu-latest
+    steps:
+      # Note that a duplicate of this step must be added at the top of
+      # each job.
+      - id: harden-runner
+        name: Harden the runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+      - id: github-status
+        name: Check GitHub status
+        uses: crazy-max/ghaction-github-status@v3
+      - id: dump-context
+        name: Dump context
+        uses: crazy-max/ghaction-dump-context@v2
   release:
+    needs:
+      - diagnostics
     runs-on: ubuntu-latest
     steps:
+      - id: harden-runner
+        name: Harden the runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
       - id: setup-env
         uses: cisagov/setup-env-github-action@develop
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - id: setup-python
         uses: actions/setup-python@v4
         with:
@@ -77,7 +101,7 @@ jobs:
       #     echo $COPY_REGIONS_KMS_MAP | \
       #       ./patch_packer_config.py src/packer.pkr.hcl
       - name: Assume AWS build role
-        uses: aws-actions/configure-aws-credentials@v1
+        uses: aws-actions/configure-aws-credentials@v4
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -95,6 +119,8 @@ jobs:
           sudo mv /usr/bin/python3 /usr/bin/python3-default
           sudo ln -s ${{ env.pythonLocation }}/bin/python3 \
           /usr/bin/python3
+      - name: Install Packer plugins
+        run: packer init src
       - name: Create machine image
         env:
           # Since we are using the default value of 15 seconds for

diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml
@@ -19,10 +19,10 @@ jobs:
       issues: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Sync repository labels
         if: success()
-        uses: crazy-max/ghaction-github-labeler@v4
+        uses: crazy-max/ghaction-github-labeler@v5
         with:
           # This is a hideous ternary equivalent so we only do a dry run unless
           # this workflow is triggered by the develop branch.