Skip to content

Commit 1a93240

Browse files
jamesiarmesjamesiarmes
committed
feat!: Initial release.
1 parent 46c62f4 commit 1a93240

12 files changed

+372
-4
lines changed

‎.cz.yaml

+2-3
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
11
---
22
commitizen:
3+
changelog_incremental: true
34
name: cz_conventional_commits
4-
tag_format: aws_serverless_database-${version}
55
update_changelog_on_bump: true
66
version: 0.1.0
7-
changelog_file: aws/serverless_database/CHANGELOG.md
8-
changelog_incremental: true
7+
version_scheme: semver2

‎.editorconfig

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
root = true
2+
3+
[*]
4+
charset = utf-8
5+
end_of_line = lf
6+
indent_size = 2
7+
indent_style = space
8+
insert_final_newline = true
9+
trim_trailing_whitespace = true

‎.github/workflows/branch.yaml

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: Branch Checks
2+
3+
on:
4+
push:
5+
branches-ignore:
6+
- main
7+
8+
jobs:
9+
lint:
10+
name: Lint updated files
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Checkout source code
14+
uses: actions/checkout@v4
15+
- uses: actions/cache@v4
16+
name: Cache plugin directory
17+
with:
18+
path: ~/.tflint.d/plugins
19+
key: tflint-${{ hashFiles('.tflint.hcl') }}
20+
- uses: terraform-linters/setup-tflint@v4
21+
name: Setup TFLint
22+
- name: Show version
23+
run: tflint --version
24+
- name: Init TFLint
25+
run: tflint --init
26+
- name: Run TFLint
27+
run: tflint --format compact --recursive
28+
29+
trivy:
30+
name: Run security scan
31+
runs-on: ubuntu-latest
32+
steps:
33+
- name: Checkout source code
34+
uses: actions/checkout@v4
35+
- name: Run Trivy vulnarability scanner
36+
uses: aquasecurity/trivy-action@master
37+
with:
38+
scan-type: config
39+
format: sarif
40+
output: "trivy-results.sarif"
41+
- name: Parse SARIF file
42+
# Always run this step, even if a previous step failed.
43+
if: always()
44+
uses: Ayrx/[email protected]
45+
with:
46+
sarif_file: "trivy-results.sarif"

‎.github/workflows/codeql-analysis.yaml

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
name: CodeQL
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
branches:
9+
- main
10+
schedule:
11+
- cron: '45 13 * * *'
12+
13+
jobs:
14+
analyze:
15+
name: Analyze
16+
runs-on: ubuntu-latest
17+
permissions:
18+
actions: read
19+
contents: read
20+
security-events: write
21+
22+
strategy:
23+
fail-fast: false
24+
matrix:
25+
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
26+
# Using "javascript" to scan JSON and YAML files.
27+
language: [ 'javascript' ]
28+
29+
steps:
30+
- name: Checkout repository
31+
uses: actions/checkout@v4
32+
33+
# Initializes the CodeQL tools for scanning.
34+
- name: Initialize CodeQL
35+
uses: github/codeql-action/init@v3
36+
with:
37+
languages: ${{ matrix.language }}
38+
# If you wish to specify custom queries, you can do so here or in a config file.
39+
# By default, queries listed here will override any specified in a config file.
40+
# Prefix the list here with "+" to use these queries and those in the config file.
41+
42+
# Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
43+
queries: security-extended,security-and-quality
44+
- name: Perform CodeQL Analysis
45+
uses: github/codeql-action/analyze@v3
46+
with:
47+
category: "/language:${{matrix.language}}"

‎.github/workflows/main.yaml

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: Main Checks
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
8+
jobs:
9+
lint:
10+
name: Lint updated modules
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Checkout source code
14+
uses: actions/checkout@v4
15+
- uses: actions/cache@v4
16+
name: Cache plugin directory
17+
with:
18+
path: ~/.tflint.d/plugins
19+
key: tflint-${{ hashFiles('.tflint.hcl') }}
20+
- uses: terraform-linters/setup-tflint@v4
21+
name: Setup TFLint
22+
- name: Show version
23+
run: tflint --version
24+
- name: Init TFLint
25+
run: tflint --init
26+
- name: Run TFLint
27+
run: tflint --format compact --recursive
28+
29+
trivy:
30+
name: Run security scan
31+
runs-on: ubuntu-latest
32+
steps:
33+
- name: Checkout source code
34+
uses: actions/checkout@v4
35+
- name: Run Trivy vulnarability scanner
36+
uses: aquasecurity/trivy-action@master
37+
with:
38+
scan-type: config
39+
format: sarif
40+
output: "trivy-results.sarif"
41+
- name: Upload SARIF result
42+
# Always run this step, even if a previous step failed.
43+
if: always()
44+
uses: github/codeql-action/upload-sarif@v3
45+
with:
46+
sarif_file: "trivy-results.sarif"

‎.github/workflows/release.yaml

+98
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
name: Release New Version
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
8+
jobs:
9+
# Builds a new release for the module by bumping the version number and
10+
# generating a changelog entry. Commit the changes and open a pull request.
11+
build-release:
12+
name: Build new release
13+
runs-on: ubuntu-latest
14+
if: ${{ !startsWith(github.event.head_commit.message, 'bump:') }}
15+
steps:
16+
- name: Checkout source code
17+
uses: actions/checkout@v4
18+
- name: Bump version and create changelog
19+
id: bump
20+
uses: commitizen-tools/commitizen-action@master
21+
with:
22+
push: false
23+
github_token: ${{ secrets.GITHUB_TOKEN }}
24+
git_redirect_stderr: true
25+
- name: Get the commit message
26+
id: message
27+
run: |
28+
MESSAGE=$(git log --format=%B -n 1)
29+
echo "message=${MESSAGE}" >> $GITHUB_OUTPUT
30+
- name: Open a pull request for the release
31+
uses: peter-evans/create-pull-request@v7
32+
with:
33+
branch: release-${{ steps.bump.outputs.version }}
34+
title: ${{ steps.message.outputs.message }}
35+
36+
# Creates a new tag and GitHub release for the module.
37+
release:
38+
name: Release module
39+
runs-on: ubuntu-latest
40+
if: startsWith(github.event.head_commit.message, 'bump:')
41+
steps:
42+
- name: Checkout source code
43+
uses: actions/checkout@v4
44+
- name: Get the module name
45+
id: module_name
46+
run: |
47+
REPO_NAME="${{ github.event.repository.name }}"
48+
REPO_NAME="${REPO_NAME/tofu-modules-/}"
49+
MODULE_NAME="${REPO_NAME//-/_}"
50+
echo "name=${MODULE_NAME}" >> $GITHUB_OUTPUT
51+
- name: Get the version from the commit message
52+
id: version
53+
uses: actions/github-script@v7
54+
env:
55+
COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
56+
with:
57+
result-encoding: string
58+
# Look for the last version number, expecting it to be in the format:
59+
# `#.#.#-<suffix>.#` where the suffix is optional.
60+
script: |
61+
const message = process.env.COMMIT_MESSAGE;
62+
const regex = /^bump:.+(?<version>\d+\.\d+\.\d+[\da-z.-]*) \(#\d+\)$/m;
63+
const version = message.match(regex).groups.version;
64+
console.log(version);
65+
return version;
66+
- name: Bundle the module
67+
# We create an empty file first, so that tar doesn't complain about the
68+
# contents changing while it's running.
69+
run: |
70+
touch '${{ steps.module_name.outputs.name }}-${{ steps.version.outputs.result }}.tar.gz'
71+
tar \
72+
--exclude='.git' \
73+
--exclude='.gitignore' \
74+
--exclude='.github' \
75+
--exclude='.cz.yaml' \
76+
--exclude='*.tar.gz' \
77+
--exclude='*.tfvars' \
78+
--exclude='release.md' \
79+
--exclude='CODEOWNERS' \
80+
--exclude='trivy.yaml' \
81+
--exclude='*.env' \
82+
-czf '${{ steps.module_name.outputs.name }}-${{ steps.version.outputs.result }}.tar.gz' \
83+
.
84+
- name: Get changelog entry
85+
id: changelog
86+
uses: artlaman/[email protected]
87+
with:
88+
version: ${{ steps.version.outputs.result }}
89+
- name: Create release
90+
uses: softprops/action-gh-release@v2
91+
with:
92+
body: |
93+
## ${{ steps.changelog.outputs.version }} (${{ steps.changelog.outputs.date }})
94+
95+
${{ steps.changelog.outputs.changes }}
96+
tag_name: ${{ steps.version.outputs.result }}
97+
files: |
98+
${{ steps.module_name.outputs.name }}-${{ steps.version.outputs.result }}.tar.gz

‎.gitignore

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# Local .terraform directories
2+
**/.terraform/*
3+
4+
# .tfstate files
5+
*.tfstate
6+
*.tfstate.*
7+
8+
# Crash log files
9+
crash.log
10+
crash.*.log
11+
12+
# Exclude all .tfvars files, which are likely to contain sensitive data, such as
13+
# password, private keys, and other secrets. These should not be part of version
14+
# control as they are data points which are potentially sensitive and subject
15+
# to change depending on the environment.
16+
*.tfvars
17+
*.tfvars.json
18+
.env
19+
20+
# Ignore override files as they are usually used to override resources locally and so
21+
# are not checked in
22+
override.tf
23+
override.tf.json
24+
*_override.tf
25+
*_override.tf.json
26+
27+
# Include override files you do wish to add to version control using negated pattern
28+
# !example_override.tf
29+
30+
# Ignore the plan output of command: terraform plan -out=tfplan
31+
*tfplan*
32+
33+
# Ignore CLI configuration files
34+
.terraformrc
35+
terraform.rc
36+
37+
# Ignore release artifacts
38+
release.md
39+
/*.tar.gz

‎CODEOWNERS

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
* @codeforamerica/devops

‎CONTRIBUTING.md

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Contributing
2+
3+
## Commit message format
4+
5+
All commit messages should follow the [Conventional Commits][commits] format.
6+
This format allows us to automatically generate changelogs and version numbers
7+
based on the commit messages.
8+
9+
Common commit types include:
10+
11+
* `fix`: A bug fix
12+
* `feat`: A new feature
13+
* `ci`: Changes to CI/CD
14+
* `docs`: Changes to documentation
15+
16+
adding `!` after the type indicates a breaking change. For example, `feat!`
17+
would indicate a new feature that breaks existing functionality, and would
18+
therefore require a major version bump.
19+
20+
`bump` is a special type used to indicate a version bump. This is used by the
21+
automated release process, and should be avoided in normal commits.
22+
23+
## Coding standards
24+
25+
Code should follow the [OpenTofu style conventions][style]. This ensures that
26+
all code is consistent and easy to read and maintain.
27+
28+
To make resources easier to find, you may group them together in a single file
29+
within your module. For example, while `main.tf` handles the main configuration,
30+
you may create a `dns.tf` file to handle all DNS-related resources.
31+
32+
Additionally, the following should be grouped together within their own files:
33+
34+
* `data.tf` for data sources
35+
* `local.tf` for local values
36+
* `output.tf` for outputs
37+
38+
## Code reviews
39+
40+
All code should be contributing in the form of a pull request. Pull requests
41+
should have an approval from _at least_ one required reviewer as defined in the
42+
`CODEOWNERS` file. Additional reviews are welcome, and may be requested by
43+
either the submitter or the required reviewer.
44+
45+
[commits]: https://www.conventionalcommits.org/en/v1.0.0/
46+
[style]: https://opentofu.org/docs/language/syntax/style/

‎LICENSE

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2024 Code for America
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md

+7-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
# AWS Serverless Database Module
22

3+
[![Main Checks][badge-checks]][code-checks] [![GitHub Release][badge-release]][latest-release]
4+
35
This module launches an [Aurora Serverless v2][aurora-serverless] database
46
cluster. Aurora serverless clusters measure capacity in [ACUs] (Aurora Capacity
57
Units); each unit is approximately 2 GB of memory with corresponding CPU and
@@ -12,7 +14,7 @@ to match your desired configuration. For example:
1214

1315
```hcl
1416
module "database" {
15-
source = "github.com/codeforamerica/tofu-modules/aws/serverless_database"
17+
source = "github.com/codeforamerica/tofu-modules-aws-serverless-database?ref=1.0.0"
1618
1719
project = "my-project"
1820
environment = "dev"
@@ -72,3 +74,7 @@ tofu init -upgrade
7274

7375
[acus]: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless-v2.how-it-works.html#aurora-serverless-v2.how-it-works.capacity
7476
[aurora-serverless]: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless-v2.html
77+
[badge-checks]: https://github.com/codeforamerica/tofu-modules-template/actions/workflows/main.yaml/badge.svg
78+
[badge-release]: https://img.shields.io/github/v/release/codeforamerica/tofu-modules-template?logo=github&label=Latest%20Release
79+
[code-checks]: https://github.com/codeforamerica/tofu-modules-template/actions/workflows/main.yaml
80+
[latest-release]: https://github.com/codeforamerica/tofu-modules-template/releases/latest

0 commit comments

Comments
 (0)