Skip to content

Commit 135bf16

Browse files
uk-bollyuk-bolly
authored
Merge pull request #90 from ansible-lockdown/devel
April 26 updates
2 parents f9e4ecc + 0efb804 commit 135bf16

55 files changed

Lines changed: 983 additions & 838 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/devel_pipeline_validation.yml‎

Lines changed: 159 additions & 158 deletions
Original file line numberDiff line numberDiff line change
@@ -1,162 +1,163 @@
11
---
22

3-
name: Devel pipeline
4-
5-
on: # yamllint disable-line rule:truthy
6-
pull_request_target:
7-
types: [opened, reopened, synchronize]
8-
branches:
9-
- devel
10-
- benchmark*
11-
paths:
12-
- '**.yml'
13-
- '**.sh'
14-
- '**.j2'
15-
- '**.ps1'
16-
- '**.cfg'
17-
# Allow manual running of workflow
18-
workflow_dispatch:
19-
20-
# A workflow run is made up of one or more jobs
21-
# that can run sequentially or in parallel
22-
jobs:
23-
# This will create messages for first time contributers and direct them to the Discord server
24-
welcome:
25-
runs-on: ubuntu-latest
26-
27-
permissions:
28-
issues: write
29-
pull-requests: write
30-
31-
steps:
32-
- uses: actions/first-interaction@main
33-
with:
34-
repo_token: ${{ secrets.GITHUB_TOKEN }}
35-
issue_message: |-
36-
Congrats on opening your first issue and thank you for taking the time to help improve Ansible-Lockdown!
37-
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
38-
pr_message: |-
39-
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
40-
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
41-
42-
# This workflow contains a single job that tests the playbook
43-
playbook-test:
44-
# The type of runner that the job will run on
45-
runs-on: self-hosted
46-
47-
# Allow permissions for AWS auth
48-
permissions:
49-
id-token: write
50-
contents: read
51-
pull-requests: read
52-
53-
env:
54-
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
55-
# Imported as a variable by terraform
56-
TF_VAR_repository: ${{ github.event.repository.name }}
57-
AWS_REGION: "us-east-1"
58-
ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
59-
defaults:
60-
run:
61-
shell: bash
62-
working-directory: .github/workflows/github_linux_IaC
63-
# working-directory: .github/workflows
64-
65-
steps:
66-
67-
- name: Git clone the lockdown repository to test
68-
uses: actions/checkout@v4
69-
with:
70-
ref: ${{ github.event.pull_request.head.sha }}
71-
72-
- name: If a variable for IAC_BRANCH is set use that branch
73-
working-directory: .github/workflows
74-
run: |
75-
if [ ${{ vars.IAC_BRANCH }} != '' ]; then
76-
echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
77-
echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
78-
else
79-
echo IAC_BRANCH=main >> $GITHUB_ENV
80-
fi
81-
82-
# Pull in terraform code for linux servers
83-
- name: Clone GitHub IaC plan
84-
uses: actions/checkout@v4
85-
with:
86-
repository: ansible-lockdown/github_linux_IaC
87-
path: .github/workflows/github_linux_IaC
88-
ref: ${{ env.IAC_BRANCH }}
89-
90-
# Uses dedicated restricted role and policy to enable this only for this task
91-
# No credentials are part of github for AWS auth
92-
- name: configure aws credentials
93-
uses: aws-actions/configure-aws-credentials@main
94-
with:
95-
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
96-
role-session-name: ${{ secrets.AWS_ROLE_SESSION }}
97-
aws-region: ${{ env.AWS_REGION }}
98-
99-
- name: DEBUG - Show IaC files
100-
if: env.ENABLE_DEBUG == 'true'
101-
run: |
102-
echo "OSVAR = $OSVAR"
103-
echo "benchmark_type = $benchmark_type"
104-
pwd
105-
env:
106-
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
107-
OSVAR: ${{ vars.OSVAR }}
108-
benchmark_type: ${{ vars.BENCHMARK_TYPE }}
109-
110-
- name: Tofu init
111-
id: init
112-
run: tofu init
113-
env:
114-
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
115-
OSVAR: ${{ vars.OSVAR }}
116-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
117-
118-
- name: Tofu validate
119-
id: validate
120-
run: tofu validate
121-
env:
122-
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
123-
OSVAR: ${{ vars.OSVAR }}
124-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
125-
126-
- name: Tofu apply
127-
id: apply
128-
env:
129-
OSVAR: ${{ vars.OSVAR }}
130-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
131-
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
132-
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
133-
run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false
3+
name: Devel pipeline
4+
5+
on: # yamllint disable-line rule:truthy
6+
pull_request_target:
7+
types: [opened, reopened, synchronize]
8+
branches:
9+
- devel
10+
- benchmark*
11+
paths:
12+
- '**.yml'
13+
- '**.sh'
14+
- '**.j2'
15+
- '**.ps1'
16+
- '**.cfg'
17+
# Allow manual running of workflow
18+
workflow_dispatch:
19+
20+
# A workflow run is made up of one or more jobs
21+
# that can run sequentially or in parallel
22+
jobs:
23+
# This will create messages for first time contributers and direct them to the Discord server
24+
welcome:
25+
runs-on: ubuntu-latest
26+
27+
permissions:
28+
issues: write
29+
pull-requests: write
30+
31+
steps:
32+
- uses: actions/first-interaction@main
33+
with:
34+
repo_token: ${{ secrets.GITHUB_TOKEN }}
35+
issue_message: |-
36+
Congrats on opening your first issue and thank you for taking the time to help improve Ansible-Lockdown!
37+
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
38+
pr_message: |-
39+
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
40+
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
41+
42+
# This workflow contains a single job that tests the playbook
43+
playbook-test:
44+
# The type of runner that the job will run on
45+
runs-on: self-hosted
46+
47+
# Allow permissions for AWS auth
48+
permissions:
49+
id-token: write
50+
contents: read
51+
pull-requests: read
52+
53+
env:
54+
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
55+
# Imported as a variable by terraform
56+
TF_VAR_repository: ${{ github.event.repository.name }}
57+
AWS_REGION: "us-east-1"
58+
ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
59+
defaults:
60+
run:
61+
shell: bash
62+
working-directory: .github/workflows/github_linux_IaC
63+
# working-directory: .github/workflows
64+
65+
steps:
66+
67+
- name: Git clone the lockdown repository to test
68+
uses: actions/checkout@v6.0.2
69+
with:
70+
ref: ${{ github.event.pull_request.head.sha }}
71+
72+
- name: If a variable for IAC_BRANCH is set use that branch
73+
working-directory: .github/workflows
74+
run: |
75+
if [ ${{ vars.IAC_BRANCH }} != '' ]; then
76+
echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
77+
echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
78+
else
79+
echo IAC_BRANCH=main >> $GITHUB_ENV
80+
fi
81+
82+
# Pull in terraform code for linux servers
83+
- name: Clone GitHub IaC plan
84+
uses: actions/checkout@v6.0.2
85+
with:
86+
repository: ansible-lockdown/github_linux_IaC
87+
path: .github/workflows/github_linux_IaC
88+
ref: ${{ env.IAC_BRANCH }}
89+
90+
# Uses dedicated restricted role and policy to enable this only for this task
91+
# No credentials are part of github for AWS auth
92+
- name: configure aws credentials
93+
uses: aws-actions/configure-aws-credentials@main
94+
with:
95+
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
96+
role-session-name: ${{ secrets.AWS_ROLE_SESSION }}
97+
aws-region: ${{ env.AWS_REGION }}
98+
99+
- name: DEBUG - Show IaC files
100+
if: env.ENABLE_DEBUG == 'true'
101+
run: |
102+
echo "OSVAR = $OSVAR"
103+
echo "benchmark_type = $benchmark_type"
104+
pwd
105+
env:
106+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
107+
OSVAR: ${{ vars.OSVAR }}
108+
benchmark_type: ${{ vars.BENCHMARK_TYPE }}
109+
110+
- name: Tofu init
111+
id: init
112+
run: tofu init
113+
env:
114+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
115+
OSVAR: ${{ vars.OSVAR }}
116+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
117+
118+
- name: Tofu validate
119+
id: validate
120+
run: tofu validate
121+
env:
122+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
123+
OSVAR: ${{ vars.OSVAR }}
124+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
125+
126+
- name: Tofu apply
127+
id: apply
128+
env:
129+
OSVAR: ${{ vars.OSVAR }}
130+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
131+
TF_VAR_ansible_version: ${{ vars.ANSIBLE_RUNNER_VERSION }}
132+
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
133+
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
134+
run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false
134135

135136
## Debug Section
136-
- name: DEBUG - Show Ansible hostfile
137-
if: env.ENABLE_DEBUG == 'true'
138-
run: cat hosts.yml
139-
140-
# Aws deployments taking a while to come up insert sleep or playbook fails
141-
142-
- name: Sleep to allow system to come up
143-
run: sleep ${{ vars.BUILD_SLEEPTIME }}
144-
145-
# Run the Ansible playbook
146-
- name: Run_Ansible_Playbook
147-
env:
148-
ANSIBLE_HOST_KEY_CHECKING: "false"
149-
ANSIBLE_DEPRECATION_WARNINGS: "false"
150-
run: |
151-
/opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml --private-key ~/.ssh/le_runner ../../../site.yml
152-
153-
# Remove test system - User secrets to keep if necessary
154-
155-
- name: Tofu Destroy
156-
if: always() && env.ENABLE_DEBUG == 'false'
157-
env:
158-
OSVAR: ${{ vars.OSVAR }}
159-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
160-
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
161-
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
162-
run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve -input=false
137+
- name: DEBUG - Show Ansible hostfile
138+
if: env.ENABLE_DEBUG == 'true'
139+
run: cat hosts.yml
140+
141+
# Aws deployments taking a while to come up insert sleep or playbook fails
142+
143+
- name: Sleep to allow system to come up
144+
run: sleep ${{ vars.BUILD_SLEEPTIME }}
145+
146+
# Run the Ansible playbook
147+
- name: Run_Ansible_Playbook
148+
env:
149+
ANSIBLE_HOST_KEY_CHECKING: "false"
150+
ANSIBLE_DEPRECATION_WARNINGS: "false"
151+
run: |
152+
/opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml --private-key ~/.ssh/le_runner ../../../site.yml
153+
154+
# Remove test system - User secrets to keep if necessary
155+
156+
- name: Tofu Destroy
157+
if: always() && env.ENABLE_DEBUG == 'false'
158+
env:
159+
OSVAR: ${{ vars.OSVAR }}
160+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
161+
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
162+
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
163+
run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve -input=false

‎.github/workflows/export_badges_private.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22

33
name: Export Private Repo Badges
44

5-
65
on:
76
push:
87
branches:

0 commit comments

Comments
 (0)