Skip to content

Commit e1f935b

Browse files
jsf9kjsf9k
authored
Merge pull request #168 from cisagov/lineage/skeleton
⚠️ CONFLICT! Lineage pull request for: skeleton
2 parents 6e07830 + 603cab6 commit e1f935b

File tree

11 files changed

+287
-99
lines changed

11 files changed

+287
-99
lines changed

‎.github/CODEOWNERS‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -3,22 +3,22 @@
33
# These owners will be the default owners for everything in the
44
# repo. Unless a later match takes precedence, these owners will be
55
# requested for review when someone opens a pull request.
6-
* @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
6+
* @dav3r @felddy @jsf9k @mcdonnnj
77

88
# These folks own any files in the .github directory at the root of
99
# the repository and any of its subdirectories.
10-
/.github/ @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
10+
/.github/ @dav3r @felddy @jsf9k @mcdonnnj
1111

1212
# These folks own all linting configuration files.
13-
/.ansible-lint @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
14-
/.bandit.yml @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
15-
/.flake8 @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
16-
/.isort.cfg @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
17-
/.mdl_config.yaml @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
18-
/.pre-commit-config.yaml @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
19-
/.prettierignore @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
20-
/.yamllint @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
21-
/requirements.txt @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
22-
/requirements-dev.txt @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
23-
/requirements-test.txt @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
24-
/setup-env @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
13+
/.ansible-lint @dav3r @felddy @jsf9k @mcdonnnj
14+
/.bandit.yml @dav3r @felddy @jsf9k @mcdonnnj
15+
/.flake8 @dav3r @felddy @jsf9k @mcdonnnj
16+
/.isort.cfg @dav3r @felddy @jsf9k @mcdonnnj
17+
/.mdl_config.yaml @dav3r @felddy @jsf9k @mcdonnnj
18+
/.pre-commit-config.yaml @dav3r @felddy @jsf9k @mcdonnnj
19+
/.prettierignore @dav3r @felddy @jsf9k @mcdonnnj
20+
/.yamllint @dav3r @felddy @jsf9k @mcdonnnj
21+
/requirements.txt @dav3r @felddy @jsf9k @mcdonnnj
22+
/requirements-dev.txt @dav3r @felddy @jsf9k @mcdonnnj
23+
/requirements-test.txt @dav3r @felddy @jsf9k @mcdonnnj
24+
/setup-env @dav3r @felddy @jsf9k @mcdonnnj

‎.github/dependabot.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,12 @@ updates:
1313
- dependency-name: actions/checkout
1414
- dependency-name: actions/setup-go
1515
- dependency-name: actions/setup-python
16+
- dependency-name: cisagov/setup-env-github-action
1617
- dependency-name: crazy-max/ghaction-dump-context
1718
- dependency-name: crazy-max/ghaction-github-labeler
1819
- dependency-name: crazy-max/ghaction-github-status
20+
- dependency-name: GitHubSecurityLab/actions-permissions
21+
- dependency-name: hashicorp/setup-packer
1922
- dependency-name: hashicorp/setup-terraform
2023
- dependency-name: mxschmitt/action-tmate
2124
- dependency-name: step-security/harden-runner
@@ -34,6 +37,8 @@ updates:
3437
# Managed by cisagov/skeleton-ansible-role
3538
- dependency-name: ansible
3639
- dependency-name: ansible-core
40+
- dependency-name: molecule
41+
- dependency-name: pytest-testinfra
3742
package-ecosystem: pip
3843
schedule:
3944
interval: weekly

‎.github/workflows/build.yml‎

Lines changed: 31 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@ defaults:
2121

2222
env:
2323
AWS_DEFAULT_REGION: us-east-1
24-
CURL_CACHE_DIR: ~/.cache/curl
2524
PIP_CACHE_DIR: ~/.cache/pip
2625
PRE_COMMIT_CACHE_DIR: ~/.cache/pre-commit
2726
RUN_TMATE: ${{ secrets.RUN_TMATE }}
@@ -32,10 +31,18 @@ env:
3231
jobs:
3332
diagnostics:
3433
name: Run diagnostics
34+
# This job does not need any permissions
35+
permissions: {}
3536
runs-on: ubuntu-latest
3637
steps:
3738
# Note that a duplicate of this step must be added at the top of
3839
# each job.
40+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
41+
with:
42+
# Uses the organization variable unless overridden
43+
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
44+
# Note that a duplicate of this step must be added at the top of
45+
# each job.
3946
- id: harden-runner
4047
name: Harden the runner
4148
uses: step-security/harden-runner@v2
@@ -50,8 +57,15 @@ jobs:
5057
lint:
5158
needs:
5259
- diagnostics
60+
permissions:
61+
# actions/checkout needs this to fetch code
62+
contents: read
5363
runs-on: ubuntu-latest
5464
steps:
65+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
66+
with:
67+
# Uses the organization variable unless overridden
68+
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
5569
- id: harden-runner
5670
name: Harden the runner
5771
uses: step-security/harden-runner@v2
@@ -77,7 +91,7 @@ jobs:
7791
name: Lookup Go cache directory
7892
run: |
7993
echo "dir=$(go env GOCACHE)" >> $GITHUB_OUTPUT
80-
- uses: actions/cache@v3
94+
- uses: actions/cache@v4
8195
env:
8296
BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\
8397
py${{ steps.setup-python.outputs.python-version }}-\
@@ -98,25 +112,12 @@ jobs:
98112
path: |
99113
${{ env.PIP_CACHE_DIR }}
100114
${{ env.PRE_COMMIT_CACHE_DIR }}
101-
${{ env.CURL_CACHE_DIR }}
102115
${{ steps.go-cache.outputs.dir }}
103116
restore-keys: |
104117
${{ env.BASE_CACHE_KEY }}
105-
- name: Setup curl cache
106-
run: mkdir -p ${{ env.CURL_CACHE_DIR }}
107-
- name: Install Packer
108-
env:
109-
PACKER_VERSION: ${{ steps.setup-env.outputs.packer-version }}
110-
run: |
111-
PACKER_ZIP="packer_${PACKER_VERSION}_linux_amd64.zip"
112-
curl --output ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}" \
113-
--time-cond ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}" \
114-
--location \
115-
"https://releases.hashicorp.com/packer/${PACKER_VERSION}/${PACKER_ZIP}"
116-
sudo unzip -d /opt/packer \
117-
${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}"
118-
sudo mv /usr/local/bin/packer /usr/local/bin/packer-default
119-
sudo ln -s /opt/packer/packer /usr/local/bin/packer
118+
- uses: hashicorp/setup-packer@v3
119+
with:
120+
version: ${{ steps.setup-env.outputs.packer-version }}
120121
- uses: hashicorp/setup-terraform@v3
121122
with:
122123
terraform_version: ${{ steps.setup-env.outputs.terraform-version }}
@@ -174,6 +175,9 @@ jobs:
174175
${{ matrix.platform }}-${{ matrix.architecture }}
175176
needs:
176177
- diagnostics
178+
permissions:
179+
# actions/checkout needs this to fetch code
180+
contents: read
177181
runs-on: ubuntu-latest
178182
strategy:
179183
fail-fast: false
@@ -189,13 +193,21 @@ jobs:
189193
- debian13-systemd
190194
- fedora39-systemd
191195
- fedora40-systemd
196+
- fedora41-systemd
192197
- kali-systemd
193198
- ubuntu-20-systemd
194199
- ubuntu-22-systemd
195200
- ubuntu-24-systemd
196201
scenario:
197202
- default
198203
steps:
204+
# With this task in place the GitHub runners run out of
205+
# resources and crash. See cisagov/skeleton-ansible-role#211
206+
# for more details.
207+
# - uses: GitHubSecurityLab/actions-permissions/monitor@v1
208+
# with:
209+
# # Uses the organization variable unless overridden
210+
# config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
199211
- id: harden-runner
200212
name: Harden the runner
201213
uses: step-security/harden-runner@v2
@@ -208,7 +220,7 @@ jobs:
208220
uses: actions/setup-python@v5
209221
with:
210222
python-version: ${{ steps.setup-env.outputs.python-version }}
211-
- uses: actions/cache@v3
223+
- uses: actions/cache@v4
212224
env:
213225
BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\
214226
py${{ steps.setup-python.outputs.python-version }}-"

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,18 +25,26 @@ on:
2525
jobs:
2626
diagnostics:
2727
name: Run diagnostics
28+
# This job does not need any permissions
29+
permissions: {}
2830
runs-on: ubuntu-latest
2931
steps:
3032
# Note that a duplicate of this step must be added at the top of
3133
# each job.
34+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
35+
with:
36+
# Uses the organization variable unless overridden
37+
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
38+
# Note that a duplicate of this step must be added at the top of
39+
# each job.
3240
- id: harden-runner
3341
name: Harden the runner
3442
uses: step-security/harden-runner@v2
3543
with:
3644
egress-policy: audit
3745
- id: github-status
3846
name: Check GitHub status
39-
uses: crazy-max/ghaction-github-status@v3
47+
uses: crazy-max/ghaction-github-status@v4
4048
- id: dump-context
4149
name: Dump context
4250
uses: crazy-max/ghaction-dump-context@v2
@@ -46,6 +54,8 @@ jobs:
4654
- diagnostics
4755
runs-on: ubuntu-latest
4856
permissions:
57+
# actions/checkout needs this to fetch code
58+
contents: read
4959
# required for all workflows
5060
security-events: write
5161
strategy:
@@ -59,6 +69,10 @@ jobs:
5969
# https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
6070

6171
steps:
72+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
73+
with:
74+
# Uses the organization variable unless overridden
75+
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
6276
- id: harden-runner
6377
name: Harden the runner
6478
uses: step-security/harden-runner@v2

‎.github/workflows/sync-labels.yml‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,27 +4,36 @@ name: sync-labels
44
on:
55
push:
66
paths:
7-
- '.github/labels.yml'
8-
- '.github/workflows/sync-labels.yml'
7+
- .github/labels.yml
8+
- .github/workflows/sync-labels.yml
9+
workflow_dispatch:
910

1011
permissions:
1112
contents: read
1213

1314
jobs:
1415
diagnostics:
1516
name: Run diagnostics
17+
# This job does not need any permissions
18+
permissions: {}
1619
runs-on: ubuntu-latest
1720
steps:
1821
# Note that a duplicate of this step must be added at the top of
1922
# each job.
23+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
24+
with:
25+
# Uses the organization variable unless overridden
26+
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
27+
# Note that a duplicate of this step must be added at the top of
28+
# each job.
2029
- id: harden-runner
2130
name: Harden the runner
2231
uses: step-security/harden-runner@v2
2332
with:
2433
egress-policy: audit
2534
- id: github-status
2635
name: Check GitHub status
27-
uses: crazy-max/ghaction-github-status@v3
36+
uses: crazy-max/ghaction-github-status@v4
2837
- id: dump-context
2938
name: Dump context
3039
uses: crazy-max/ghaction-dump-context@v2
@@ -38,6 +47,10 @@ jobs:
3847
issues: write
3948
runs-on: ubuntu-latest
4049
steps:
50+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
51+
with:
52+
# Uses the organization variable unless overridden
53+
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
4154
- id: harden-runner
4255
name: Harden the runner
4356
uses: step-security/harden-runner@v2

0 commit comments

Comments
 (0)