Skip to content

Commit 80a5770

Browse files
alindtalindt
committed
git[hub] plumbing update
1 parent 4dee243 commit 80a5770

File tree

14 files changed

+325
-6
lines changed

14 files changed

+325
-6
lines changed

‎.github/FUNDING.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
github: alindt
2+
liberapay: alindt

‎.github/dependabot.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
version: 2
2+
updates:
3+
# Enable version updates for GitHub Actions
4+
- package-ecosystem: "github-actions"
5+
directory: "/"
6+
schedule:
7+
interval: "weekly"
8+
day: "monday"
9+
time: "09:00"
10+
open-pull-requests-limit: 10
11+
reviewers:
12+
- "alindt"
13+
assignees:
14+
- "alindt"
15+
16+
# Enable version updates for npm packages (for markdownlint)
17+
- package-ecosystem: "npm"
18+
directory: "/"
19+
schedule:
20+
interval: "weekly"
21+
day: "monday"
22+
time: "09:00"
23+
open-pull-requests-limit: 5
24+
reviewers:
25+
- "alindt"
26+
assignees:
27+
- "alindt"
28+
29+
# Enable version updates for Python packages (for yamllint)
30+
- package-ecosystem: "pip"
31+
directory: "/"
32+
schedule:
33+
interval: "weekly"
34+
day: "monday"
35+
time: "09:00"
36+
open-pull-requests-limit: 5
37+
reviewers:
38+
- "alindt"
39+
assignees:
40+
- "alindt"

‎.github/workflows/lint-test.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
name: Lint and Test Charts
2+
3+
on:
4+
pull_request:
5+
branches: [ main, master ]
6+
push:
7+
branches: [ main, master ]
8+
9+
jobs:
10+
lint-test:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Checkout
14+
uses: actions/checkout@v4
15+
16+
- name: Install Helm
17+
uses: azure/[email protected]
18+
19+
- name: Add Bitnami repository
20+
run: helm repo add bitnami https://charts.bitnami.com/bitnami
21+
22+
- name: Update Helm repositories
23+
run: helm repo update
24+
25+
- name: Lint charts
26+
run: |
27+
for chart in */Chart.yaml; do
28+
chart_dir=$(dirname "$chart")
29+
echo "Linting $chart_dir..."
30+
helm lint "$chart_dir"
31+
done
32+
33+
- name: Validate chart dependencies
34+
run: |
35+
for chart in */Chart.yaml; do
36+
chart_dir=$(dirname "$chart")
37+
echo "Validating dependencies for $chart_dir..."
38+
helm dependency build "$chart_dir"
39+
helm dependency update "$chart_dir"
40+
done
41+
42+
- name: Test chart rendering
43+
run: |
44+
for chart in */Chart.yaml; do
45+
chart_dir=$(dirname "$chart")
46+
echo "Testing chart rendering for $chart_dir..."
47+
helm template test "$chart_dir" --values "$chart_dir/values.yaml"
48+
done
49+
50+
- name: Check for chart version bumps
51+
run: |
52+
for chart in */Chart.yaml; do
53+
chart_dir=$(dirname "$chart")
54+
echo "Checking version for $chart_dir..."
55+
if [ -f "$chart_dir/Chart.lock" ]; then
56+
echo "Chart.lock exists for $chart_dir - dependencies are locked"
57+
else
58+
echo "Warning: No Chart.lock found for $chart_dir"
59+
fi
60+
done

‎.github/workflows/markdown-lint.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: Markdown Lint
2+
3+
on:
4+
pull_request:
5+
branches: [ main, master ]
6+
push:
7+
branches: [ main, master ]
8+
9+
jobs:
10+
markdown-lint:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Checkout
14+
uses: actions/checkout@v4
15+
16+
- name: Install markdownlint
17+
run: |
18+
npm install -g markdownlint-cli
19+
20+
- name: Lint markdown files
21+
run: |
22+
markdownlint "**/*.md" --config .markdownlint.json

‎.github/workflows/release.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
runs-on: ubuntu-latest
1515
steps:
1616
- name: Checkout
17-
uses: actions/checkout@v2
17+
uses: actions/checkout@v4
1818
with:
1919
fetch-depth: 0
2020

@@ -31,4 +31,4 @@ jobs:
3131
with:
3232
charts_dir: '.'
3333
env:
34-
CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
34+
CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

‎.github/workflows/security-scan.yml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
name: Security Scan
2+
3+
on:
4+
pull_request:
5+
branches: [ main, master ]
6+
push:
7+
branches: [ main, master ]
8+
schedule:
9+
# Run weekly on Sundays
10+
- cron: '0 0 * * 0'
11+
12+
jobs:
13+
security-scan:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Checkout
17+
uses: actions/checkout@v4
18+
19+
- name: Run Trivy vulnerability scanner
20+
uses: aquasecurity/trivy-action@master
21+
with:
22+
scan-type: 'fs'
23+
scan-ref: '.'
24+
format: 'sarif'
25+
output: 'trivy-results.sarif'
26+
27+
- name: Upload Trivy scan results to GitHub Security tab
28+
uses: github/codeql-action/upload-sarif@v3
29+
if: always()
30+
with:
31+
sarif_file: 'trivy-results.sarif'
32+
33+
- name: Check for secrets in code
34+
uses: trufflesecurity/trufflehog@main
35+
with:
36+
path: .
37+
base: HEAD~1
38+
head: HEAD
39+
extra_args: --only-verified --fail
40+
41+
- name: Check for hardcoded secrets
42+
run: |
43+
# Check for potential secrets in values files
44+
if grep -r "password.*:" invidious/values.yaml; then
45+
echo "Warning: Potential hardcoded passwords found in values.yaml"
46+
exit 1
47+
fi
48+
49+
# Check for potential secrets in templates
50+
if grep -r "password.*:" invidious/templates/; then
51+
echo "Warning: Potential hardcoded passwords found in templates"
52+
exit 1
53+
fi

‎.github/workflows/yaml-lint.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: YAML Lint
2+
3+
on:
4+
pull_request:
5+
branches: [ main, master ]
6+
push:
7+
branches: [ main, master ]
8+
9+
jobs:
10+
yaml-lint:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Checkout
14+
uses: actions/checkout@v4
15+
16+
- name: Install yamllint
17+
run: |
18+
python -m pip install --upgrade pip
19+
pip install yamllint
20+
21+
- name: Lint YAML files
22+
run: |
23+
yamllint -c .yamllint .
24+
continue-on-error: true
25+
26+
- name: Check YAML syntax
27+
run: |
28+
find . -name "*.yml" -o -name "*.yaml" | while read -r file; do
29+
echo "Checking $file..."
30+
python -c "import yaml; yaml.safe_load(open('$file', 'r'))"
31+
done

‎.gitignore‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1 @@
11
.vscode/
2-

‎.markdownlint.json‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"default": true,
3+
"MD013": {
4+
"line_length": 120,
5+
"code_blocks": false,
6+
"tables": false
7+
},
8+
"MD014": false,
9+
"MD033": false,
10+
"MD034": false,
11+
"MD041": false,
12+
"MD024": {
13+
"siblings_only": true
14+
},
15+
"MD029": {
16+
"style": "ordered"
17+
},
18+
"MD007": {
19+
"indent": 2
20+
},
21+
"MD012": {
22+
"maximum": 1
23+
},
24+
"MD026": {
25+
"punctuation": ".,;:!"
26+
}
27+
}

‎.pre-commit-config.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
repos:
2+
- repo: https://github.com/pre-commit/pre-commit-hooks
3+
rev: v4.5.0
4+
hooks:
5+
- id: trailing-whitespace
6+
- id: end-of-file-fixer
7+
- id: check-yaml
8+
exclude: ^invidious/templates/
9+
- id: check-added-large-files
10+
- id: check-merge-conflict
11+
- id: check-case-conflict
12+
- id: check-json
13+
- id: check-toml
14+
- id: debug-statements
15+
16+
- repo: https://github.com/adrienverge/yamllint
17+
rev: v1.35.1
18+
hooks:
19+
- id: yamllint
20+
args: [--config-file, .yamllint]
21+
exclude: ^invidious/templates/
22+
23+
- repo: https://github.com/igorshubovych/markdownlint-cli
24+
rev: v0.38.0
25+
hooks:
26+
- id: markdownlint
27+
args: [--config, .markdownlint.json]

0 commit comments

Comments
 (0)