Skip to content

Commit 7804b88

Browse files
jsf9kjsf9k
authored
Merge pull request #60 from cisagov/lineage/skeleton
Lineage pull request for: skeleton
2 parents b0bd73a + 18eef91 commit 7804b88

File tree

13 files changed

+240
-51
lines changed

13 files changed

+240
-51
lines changed

‎.github/dependabot.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ updates:
1212
- dependency-name: actions/cache
1313
- dependency-name: actions/checkout
1414
- dependency-name: actions/dependency-review-action
15+
- dependency-name: actions/labeler
1516
- dependency-name: actions/setup-go
1617
- dependency-name: actions/setup-python
1718
- dependency-name: cisagov/action-job-preamble
@@ -21,6 +22,12 @@ updates:
2122
- dependency-name: hashicorp/setup-packer
2223
- dependency-name: hashicorp/setup-terraform
2324
- dependency-name: mxschmitt/action-tmate
25+
labels:
26+
# dependabot default we need to replicate
27+
- dependencies
28+
# This matches our label definition in .github/labels.yml as opposed to
29+
# dependabot's default of `github_actions`.
30+
- github-actions
2431
package-ecosystem: github-actions
2532
schedule:
2633
interval: weekly

‎.github/labeler.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
---
2+
# Each entry in this file is a label that will be applied to pull requests
3+
# if there is a match based on the matching rules for the entry. Please see
4+
# the actions/labeler documentation for more information:
5+
# https://github.com/actions/labeler#match-object
6+
#
7+
# Note: Verify that the label you want to use is defined in the
8+
# crazy-max/ghaction-github-labeler configuration file located at
9+
# .github/labels.yml.
10+
11+
# Enable if Ansible playbooks are used in the repository.
12+
# ansible:
13+
# - changed-files:
14+
# - any-glob-to-any-file:
15+
# - "**/ansible/**"
16+
dependencies:
17+
- changed-files:
18+
- any-glob-to-any-file:
19+
# Add any dependency files used.
20+
- .pre-commit-config.yaml
21+
- "**/.terraform.lock.hcl"
22+
- "**/versions.tf"
23+
- requirements*.txt
24+
# Enable if Docker is used in the repository.
25+
# docker:
26+
# - changed-files:
27+
# - any-glob-to-any-file:
28+
# - "**/compose*.yml"
29+
# - "**/docker-compose*.yml"
30+
# - "**/Dockerfile*"
31+
documentation:
32+
- changed-files:
33+
- any-glob-to-any-file:
34+
- "**/*.md"
35+
github-actions:
36+
- changed-files:
37+
- any-glob-to-any-file:
38+
- .github/workflows/**
39+
# Enable if Packer is used in the repository.
40+
# packer:
41+
# - changed-files:
42+
# - any-glob-to-any-file:
43+
# - "**/*.pkr.hcl"
44+
# Enable if Python is used in the repository.
45+
# python:
46+
# - changed-files:
47+
# - any-glob-to-any-file:
48+
# - "**/*.py"
49+
terraform:
50+
- changed-files:
51+
- any-glob-to-any-file:
52+
- "**/*.tf"
53+
test:
54+
- changed-files:
55+
- any-glob-to-any-file:
56+
# Add any test-related files or paths.
57+
- .ansible-lint
58+
- .bandit.yml
59+
- .flake8
60+
- .isort.cfg
61+
- .mdl_config.yaml
62+
- .yamllint
63+
upstream update:
64+
- head-branch:
65+
# Any Lineage pull requests should use this branch.
66+
- lineage/skeleton
67+
version bump:
68+
- changed-files:
69+
- any-glob-to-any-file:
70+
# Ensure this matches your version tracking file(s).
71+
- version.txt

‎.github/labels.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@
22
# Rather than breaking up descriptions into multiline strings we disable that
33
# specific rule in yamllint for this file.
44
# yamllint disable rule:line-length
5+
- color: f15a53
6+
description: Pull requests that update Ansible code
7+
name: ansible
58
- color: eb6420
69
description: This issue or pull request is awaiting the outcome of another issue or pull request
710
name: blocked
@@ -17,6 +20,9 @@
1720
- color: 0366d6
1821
description: Pull requests that update a dependency file
1922
name: dependencies
23+
- color: 2497ed
24+
description: Pull requests that update Docker code
25+
name: docker
2026
- color: 5319e7
2127
description: This issue or pull request improves or adds to documentation
2228
name: documentation
@@ -50,6 +56,12 @@
5056
- color: fcdb45
5157
description: This pull request is awaiting an action or decision to move forward
5258
name: on hold
59+
- color: 02a8ef
60+
description: Pull requests that update Packer code
61+
name: packer
62+
- color: 3772a4
63+
description: Pull requests that update Python code
64+
name: python
5365
- color: ef476c
5466
description: This issue is a request for information or needs discussion
5567
name: question

‎.github/workflows/build.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -99,16 +99,16 @@ jobs:
9999
# this workflow.
100100
permissions_monitoring_config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
101101
- id: setup-env
102-
uses: cisagov/setup-env-github-action@develop
103-
- uses: actions/checkout@v4
102+
uses: cisagov/setup-env-github-action@v1
103+
- uses: actions/checkout@v5
104104
- id: setup-python
105-
uses: actions/setup-python@v5
105+
uses: actions/setup-python@v6
106106
with:
107107
python-version: ${{ steps.setup-env.outputs.python-version }}
108108
# We need the Go version and Go cache location for the actions/cache step,
109109
# so the Go installation must happen before that.
110110
- id: setup-go
111-
uses: actions/setup-go@v5
111+
uses: actions/setup-go@v6
112112
with:
113113
# There is no expectation for actual Go code so we disable caching as
114114
# it relies on the existence of a go.sum file.

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ jobs:
113113
permissions_monitoring_config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
114114

115115
- name: Checkout repository
116-
uses: actions/checkout@v4
116+
uses: actions/checkout@v5
117117

118118
# Initializes the CodeQL tools for scanning.
119119
- name: Initialize CodeQL

‎.github/workflows/dependency-review.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ jobs:
8989
permissions_monitoring_config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
9090
- id: checkout-repo
9191
name: Checkout the repository
92-
uses: actions/checkout@v4
92+
uses: actions/checkout@v5
9393
- id: dependency-review
9494
name: Review dependency changes for vulnerabilities and license changes
9595
uses: actions/dependency-review-action@v4

‎.github/workflows/label-prs.yml‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
---
2+
name: Label pull requests
3+
4+
on: # yamllint disable-line rule:truthy
5+
pull_request:
6+
types:
7+
- edited
8+
- opened
9+
- synchronize
10+
11+
# Set a default shell for any run steps. The `-Eueo pipefail` sets errtrace,
12+
# nounset, errexit, and pipefail. The `-x` will print all commands as they are
13+
# run. Please see the GitHub Actions documentation for more information:
14+
# https://docs.github.com/en/actions/using-jobs/setting-default-values-for-jobs
15+
defaults:
16+
run:
17+
shell: bash -Eueo pipefail -x {0}
18+
19+
jobs:
20+
diagnostics:
21+
name: Run diagnostics
22+
# This job does not need any permissions
23+
permissions: {}
24+
runs-on: ubuntu-latest
25+
steps:
26+
# Note that a duplicate of this step must be added at the top of
27+
# each job.
28+
- name: Apply standard cisagov job preamble
29+
uses: cisagov/action-job-preamble@v1
30+
with:
31+
check_github_status: "true"
32+
# This functionality is poorly implemented and has been
33+
# causing problems due to the MITM implementation hogging or
34+
# leaking memory. As a result we disable it by default. If
35+
# you want to temporarily enable it, simply set
36+
# monitor_permissions equal to "true".
37+
#
38+
# TODO: Re-enable this functionality when practical. See
39+
# cisagov/skeleton-generic#207 for more details.
40+
monitor_permissions: "false"
41+
output_workflow_context: "true"
42+
# Use a variable to specify the permissions monitoring
43+
# configuration. By default this will yield the
44+
# configuration stored in the cisagov organization-level
45+
# variable, but if you want to use a different configuration
46+
# then simply:
47+
# 1. Create a repository-level variable with the name
48+
# ACTIONS_PERMISSIONS_CONFIG.
49+
# 2. Set this new variable's value to the configuration you
50+
# want to use for this repository.
51+
#
52+
# Note in particular that changing the permissions
53+
# monitoring configuration *does not* require you to modify
54+
# this workflow.
55+
permissions_monitoring_config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
56+
label:
57+
needs:
58+
- diagnostics
59+
permissions:
60+
# Permissions required by actions/labeler
61+
contents: read
62+
issues: write
63+
pull-requests: write
64+
runs-on: ubuntu-latest
65+
steps:
66+
- name: Apply standard cisagov job preamble
67+
uses: cisagov/action-job-preamble@v1
68+
with:
69+
# This functionality is poorly implemented and has been
70+
# causing problems due to the MITM implementation hogging or
71+
# leaking memory. As a result we disable it by default. If
72+
# you want to temporarily enable it, simply set
73+
# monitor_permissions equal to "true".
74+
#
75+
# TODO: Re-enable this functionality when practical. See
76+
# cisagov/skeleton-generic#207 for more details.
77+
monitor_permissions: "false"
78+
# Use a variable to specify the permissions monitoring
79+
# configuration. By default this will yield the
80+
# configuration stored in the cisagov organization-level
81+
# variable, but if you want to use a different configuration
82+
# then simply:
83+
# 1. Create a repository-level variable with the name
84+
# ACTIONS_PERMISSIONS_CONFIG.
85+
# 2. Set this new variable's value to the configuration you
86+
# want to use for this repository.
87+
#
88+
# Note in particular that changing the permissions
89+
# monitoring configuration *does not* require you to modify
90+
# this workflow.
91+
permissions_monitoring_config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
92+
- name: Apply suitable labels to a pull request
93+
uses: actions/labeler@v6

‎.github/workflows/sync-labels.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ jobs:
8484
# monitoring configuration *does not* require you to modify
8585
# this workflow.
8686
permissions_monitoring_config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
87-
- uses: actions/checkout@v4
87+
- uses: actions/checkout@v5
8888
- name: Sync repository labels
8989
if: success()
9090
uses: crazy-max/ghaction-github-labeler@v5

0 commit comments

Comments
 (0)