Skip to content

Commit 24fb9c2

Browse files
MrSteve81MrSteve81
authored
Merge pull request #11 from ansible-lockdown/devel
Windows 2025 CIS 1.0.0 Release
2 parents 1d5644b + cc96838 commit 24fb9c2

57 files changed

Lines changed: 37833 additions & 4 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.ansible-lint‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
3+
parseable: true
4+
quiet: true
5+
skip_list:
6+
- 'package-latest'
7+
- 'risky-shell-pipe'
8+
- yaml[line-length]
9+
use_default_rules: true
10+
verbosity: 0

‎.gitattributes‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# adding github settings to show correct language
2+
*.sh linguist-detectable=true
3+
*.yml linguist-detectable=true
4+
*.ps1 linguist-detectable=true
5+
*.j2 linguist-detectable=true
6+
*.md linguist-documentation

‎.github/workflows/benchmark_tracking_controller.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
3+
# GitHub schedules all cron jobs in UTC.
4+
# This expression will run the job every day at 9 AM Eastern Time during Daylight Saving Time (mid-March to early November).
5+
# This expression will run the job every day at 8 AM Eastern Time during Standard Time (early November to mid-March).
6+
7+
name: Central Benchmark Orchestrator
8+
9+
on:
10+
push:
11+
branches:
12+
- latest
13+
schedule:
14+
- cron: '0 13 * * *' # Runs daily at 9 AM ET
15+
workflow_dispatch:
16+
17+
jobs:
18+
call-benchmark-tracker:
19+
if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref_name == 'latest')
20+
name: Start Benchmark Tracker
21+
uses: ansible-lockdown/github_windows_IaC/.github/workflows/benchmark_track.yml@self_hosted
22+
with:
23+
repo_name: ${{ github.repository }}
24+
secrets:
25+
TEAMS_WEBHOOK_URL: ${{ secrets.TEAMS_WEBHOOK_URL }}
26+
BADGE_PUSH_TOKEN: ${{ secrets.BADGE_PUSH_TOKEN }}
27+
DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
28+
29+
call-monitor-promotions:
30+
if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
31+
name: Monitor Promotions and Auto-Promote
32+
uses: ansible-lockdown/github_windows_IaC/.github/workflows/benchmark_promote.yml@self_hosted
33+
with:
34+
repo_name: ${{ github.repository }}
35+
secrets:
36+
TEAMS_WEBHOOK_URL: ${{ secrets.TEAMS_WEBHOOK_URL }}
37+
BADGE_PUSH_TOKEN: ${{ secrets.BADGE_PUSH_TOKEN }}
38+
DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}

‎.github/workflows/devel_pipeline_validation.yml‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
---
2+
3+
# This is a basic workflow to help you get started with Actions
4+
5+
name: Ansible Remediate Devel Pipeline Validation
6+
7+
# Controls when the action will run.
8+
# Triggers the workflow on push or pull request
9+
# events but only for the devel branch and any branch that contains benchmark in name.
10+
on: # yamllint disable-line rule:truthy
11+
pull_request_target:
12+
types: [opened, reopened, synchronize]
13+
branches:
14+
- devel
15+
- benchmark*
16+
paths:
17+
- '**.yml'
18+
- '**.sh'
19+
- '**.j2'
20+
- '**.ps1'
21+
- '**.cfg'
22+
23+
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
24+
# This section contains all the jobs below that are running in the workflow.
25+
jobs:
26+
# This will create messages for the first time contributors and direct them to the Discord server
27+
welcome:
28+
# The type of runner that the job will run on.
29+
runs-on: ubuntu-latest
30+
steps:
31+
- uses: actions/first-interaction@main
32+
with:
33+
repo-token: ${{ secrets.GITHUB_TOKEN }}
34+
pr-message: |-
35+
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
36+
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
37+
38+
build-azure-windows:
39+
# Use the AWS self-hosted runner
40+
runs-on: self-hosted
41+
env:
42+
# Imported as a variable by OpenTofu.
43+
ARM_CLIENT_ID: ${{ secrets.AZURE_AD_CLIENT_ID }}
44+
ARM_CLIENT_SECRET: ${{ secrets.AZURE_AD_CLIENT_SECRET }}
45+
ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
46+
ARM_TENANT_ID: ${{ secrets.AZURE_AD_TENANT_ID }}
47+
WIN_USERNAME: ${{ secrets.WIN_USERNAME }}
48+
WIN_PASSWORD: ${{ secrets.WIN_PASSWORD }}
49+
OSVAR: ${{ vars.OSVAR }}
50+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
51+
TF_VAR_repository: ${{ github.event.repository.name }}
52+
ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
53+
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
54+
55+
defaults:
56+
run:
57+
shell: bash
58+
working-directory: .github/workflows/github_windows_IaC
59+
60+
steps:
61+
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it.
62+
- name: Clone ${{ github.event.repository.name }}
63+
uses: actions/checkout@v6.0.2
64+
with:
65+
ref: ${{ github.event.pull_request.head.sha }}
66+
67+
- name: If a variable for IAC_BRANCH is set use that branch
68+
working-directory: .github/workflows
69+
run: |
70+
if [ ${{ vars.IAC_BRANCH }} != '' ]; then
71+
echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
72+
echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
73+
else
74+
echo IAC_BRANCH=main >> $GITHUB_ENV
75+
fi
76+
77+
# Pull In OpenTofu Code For Windows Azure
78+
- name: Clone IaC Repository
79+
uses: actions/checkout@v6.0.2
80+
with:
81+
repository: ansible-lockdown/github_windows_IaC
82+
path: .github/workflows/github_windows_IaC
83+
ref: ${{ env.IAC_BRANCH }}
84+
85+
# Sensitive Data Stored And Passed To OpenTofu
86+
# Default Working Dir Defined In Defaults Above.
87+
- name: Save Sensitive Info
88+
run: echo "{\"username\":\"${WIN_USERNAME}\",\"password\":\"${WIN_PASSWORD}\"}" >> sensitive_info.json
89+
90+
# Show the Os Var and Benchmark Type And Load
91+
- name: DEBUG - Show IaC files
92+
if: env.ENABLE_DEBUG == 'true'
93+
run: |
94+
echo "OSVAR = $OSVAR"
95+
echo "benchmark_type = $benchmark_type"
96+
pwd
97+
ls
98+
env:
99+
# Imported from github variables this is used to load the relevant OS.tfvars file
100+
OSVAR: ${{ vars.OSVAR }}
101+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
102+
103+
# Initialize The OpenTofu Working Directory
104+
- name: Tofu init
105+
id: init
106+
run: tofu init
107+
env:
108+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
109+
OSVAR: ${{ vars.OSVAR }}
110+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
111+
112+
# Validate The Syntax Of OpenTofu Files
113+
- name: Tofu validate
114+
id: validate
115+
run: tofu validate
116+
env:
117+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
118+
OSVAR: ${{ vars.OSVAR }}
119+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
120+
121+
# Execute The Actions And Build Azure Server
122+
- name: Tofo Apply
123+
id: apply
124+
env:
125+
# Imported from github variables this is used to load the relevant OS.tfvars file
126+
WIN_USERNAME: ${{ secrets.WIN_USERNAME }}
127+
WIN_PASSWORD: ${{ secrets.WIN_PASSWORD }}
128+
OSVAR: ${{ vars.OSVAR }}
129+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
130+
run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false
131+
132+
# Debug Section
133+
- name: DEBUG - Show Ansible Hostfile
134+
if: env.ENABLE_DEBUG == 'true'
135+
run: cat hosts.yml
136+
137+
# Run the Ansible Playbook
138+
- name: Run_Ansible_Playbook
139+
env:
140+
ANSIBLE_HOST_KEY_CHECKING: "false"
141+
ANSIBLE_DEPRECATION_WARNINGS: "false"
142+
run: |
143+
/opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml ../../../site.yml
144+
145+
# Destroy The Azure Test System
146+
- name: Tofu Destroy
147+
if: always() && env.ENABLE_DEBUG == 'false'
148+
env:
149+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
150+
OSVAR: ${{ vars.OSVAR }}
151+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
152+
run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve

‎.github/workflows/devel_pipeline_validation_gpo.yml‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
---
2+
3+
# This is a basic workflow to help you get started with Actions
4+
5+
name: GPO Devel Pipeline Validation
6+
7+
# Controls when the action will run.
8+
# Triggers the workflow on push or pull request
9+
# events but only for the devel branch and any branch that contains benchmark in name.
10+
on: # yamllint disable-line rule:truthy
11+
pull_request_target:
12+
types: [opened, reopened, synchronize]
13+
branches:
14+
- devel
15+
- benchmark*
16+
paths:
17+
- '**.yml'
18+
- '**.sh'
19+
- '**.j2'
20+
- '**.ps1'
21+
- '**.cfg'
22+
23+
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
24+
# This section contains all the jobs below that are running in the workflow.
25+
jobs:
26+
# This will create messages for the first time contributors and direct them to the Discord server
27+
welcome:
28+
# The type of runner that the job will run on.
29+
runs-on: ubuntu-latest
30+
steps:
31+
- uses: actions/first-interaction@main
32+
with:
33+
repo-token: ${{ secrets.GITHUB_TOKEN }}
34+
pr-message: |-
35+
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
36+
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
37+
38+
build-azure-windows-gpo:
39+
# Use the AWS self-hosted runner
40+
runs-on: self-hosted
41+
env:
42+
# Imported as a variable by OpenTofu.
43+
ARM_CLIENT_ID: ${{ secrets.AZURE_AD_CLIENT_ID }}
44+
ARM_CLIENT_SECRET: ${{ secrets.AZURE_AD_CLIENT_SECRET }}
45+
ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
46+
ARM_TENANT_ID: ${{ secrets.AZURE_AD_TENANT_ID }}
47+
WIN_USERNAME: ${{ secrets.WIN_USERNAME }}
48+
WIN_PASSWORD: ${{ secrets.WIN_PASSWORD }}
49+
GPO_OSVAR: ${{ vars.GPO_OSVAR }}
50+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
51+
TF_VAR_repository: ${{ github.event.repository.name }}
52+
ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
53+
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
54+
55+
defaults:
56+
run:
57+
shell: bash
58+
working-directory: .github/workflows/github_windows_IaC
59+
60+
steps:
61+
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it.
62+
- name: Clone ${{ github.event.repository.name }}
63+
uses: actions/checkout@v6.0.2
64+
with:
65+
ref: ${{ github.event.pull_request.head.sha }}
66+
67+
- name: If a variable for IAC_BRANCH is set use that branch
68+
working-directory: .github/workflows
69+
run: |
70+
if [ ${{ vars.IAC_BRANCH }} != '' ]; then
71+
echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
72+
echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
73+
else
74+
echo IAC_BRANCH=main >> $GITHUB_ENV
75+
fi
76+
77+
# Pull In OpenTofu Code For Windows Azure
78+
- name: Clone IaC Repository
79+
uses: actions/checkout@v6.0.2
80+
with:
81+
repository: ansible-lockdown/github_windows_IaC
82+
path: .github/workflows/github_windows_IaC
83+
ref: ${{ env.IAC_BRANCH }}
84+
85+
# Sensitive Data Stored And Passed To OpenTofu
86+
# Default Working Dir Defined In Defaults Above.
87+
- name: Save Sensitive Info
88+
run: echo "{\"username\":\"${WIN_USERNAME}\",\"password\":\"${WIN_PASSWORD}\"}" >> sensitive_info.json
89+
90+
# Show the Os Var and Benchmark Type And Load
91+
- name: DEBUG - Show IaC files
92+
if: env.ENABLE_DEBUG == 'true'
93+
run: |
94+
echo "GPO_OSVAR = $GPO_OSVAR"
95+
echo "benchmark_type = $benchmark_type"
96+
pwd
97+
ls
98+
env:
99+
# Imported from github variables this is used to load the relevant OS.tfvars file
100+
GPO_OSVAR: ${{ vars.GPO_OSVAR }}
101+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
102+
103+
# Initialize The OpenTofu Working Directory
104+
- name: Tofu init
105+
id: init
106+
run: tofu init
107+
env:
108+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
109+
GPO_OSVAR: ${{ vars.GPO_OSVAR }}
110+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
111+
112+
# Validate The Syntax Of OpenTofu Files
113+
- name: Tofu validate
114+
id: validate
115+
run: tofu validate
116+
env:
117+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
118+
GPO_OSVAR: ${{ vars.GPO_OSVAR }}
119+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
120+
121+
# Execute The Actions And Build Azure Server
122+
- name: Tofo Apply
123+
id: apply
124+
env:
125+
# Imported from github variables this is used to load the relevant OS.tfvars file
126+
WIN_USERNAME: ${{ secrets.WIN_USERNAME }}
127+
WIN_PASSWORD: ${{ secrets.WIN_PASSWORD }}
128+
OSVAR: ${{ vars.OSVAR }}
129+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
130+
run: tofu apply -var-file "${GPO_OSVAR}.tfvars" --auto-approve -input=false
131+
132+
# Debug Section
133+
- name: DEBUG - Show Ansible Hostfile
134+
if: env.ENABLE_DEBUG == 'true'
135+
run: cat hosts.yml
136+
137+
# Run the Ansible Playbook
138+
- name: Run_Ansible_Playbook
139+
env:
140+
ANSIBLE_HOST_KEY_CHECKING: "false"
141+
ANSIBLE_DEPRECATION_WARNINGS: "false"
142+
run: |
143+
/opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml ../../../site.yml
144+
145+
# Destroy The Azure Test System
146+
- name: Tofu Destroy
147+
if: always() && env.ENABLE_DEBUG == 'false'
148+
env:
149+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
150+
GPO_OSVAR: ${{ vars.GPO_OSVAR }}
151+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
152+
run: tofu destroy -var-file "${GPO_OSVAR}.tfvars" --auto-approve

‎.github/workflows/export_badges_private.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
3+
name: Export Private Repo Badges
4+
5+
# Use different minute offsets with the same hourly pattern:
6+
# Repo Group Suggested Cron Expression Explanation
7+
# Group A 0 */6 * * * Starts at top of hour
8+
# Group B 10 */6 * * * Starts art 10 after
9+
# And So On
10+
11+
on:
12+
push:
13+
branches:
14+
- latest
15+
schedule:
16+
- cron: '0 */6 * * *'
17+
workflow_dispatch:
18+
19+
jobs:
20+
export-badges:
21+
if: github.event_name == 'workflow_dispatch' || (github.event_name == 'schedule' && startsWith(github.repository, 'ansible-lockdown/Private-')) || (github.event_name == 'push' && github.ref_name == 'latest')
22+
uses: ansible-lockdown/github_windows_IaC/.github/workflows/export_badges_private.yml@self_hosted
23+
with:
24+
# Full org/repo path passed for GitHub API calls (e.g., ansible-lockdown/Private-Windows-2016-CIS)
25+
repo_name: ${{ github.repository }}
26+
secrets:
27+
BADGE_PUSH_TOKEN: ${{ secrets.BADGE_PUSH_TOKEN }}

0 commit comments

Comments
 (0)