Skip to content

Commit 1b503d1

Browse files
jamesiarmesjamesiarmes
authored
Initial commit
0 parents  commit 1b503d1

File tree

14 files changed

+476
-0
lines changed

14 files changed

+476
-0
lines changed

‎.cz.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
commitizen:
3+
changelog_incremental: true
4+
name: cz_conventional_commits
5+
update_changelog_on_bump: true
6+
version: 0.1.0
7+
version_scheme: semver2

‎.editorconfig‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
root = true
2+
3+
[*]
4+
charset = utf-8
5+
end_of_line = lf
6+
indent_size = 2
7+
indent_style = space
8+
insert_final_newline = true
9+
trim_trailing_whitespace = true

‎.github/workflows/codeql.yaml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: CodeQL
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
branches:
9+
- main
10+
schedule:
11+
- cron: '45 13 * * *'
12+
13+
jobs:
14+
analyze:
15+
name: Analyze (${{ matrix.language }})
16+
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
17+
permissions:
18+
security-events: write
19+
packages: read
20+
actions: read
21+
contents: read
22+
strategy:
23+
fail-fast: false
24+
matrix:
25+
include:
26+
- language: actions
27+
build_mode: none
28+
steps:
29+
- name: Checkout repository
30+
uses: actions/checkout@v6
31+
- name: Initialize CodeQL
32+
uses: github/codeql-action/init@v4
33+
with:
34+
languages: ${{ matrix.language }}
35+
build-mode: ${{ matrix.build-mode }}
36+
- name: Perform CodeQL Analysis
37+
uses: github/codeql-action/analyze@v4
38+
with:
39+
category: "/language:${{matrix.language}}"

‎.github/workflows/release.yaml‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
name: Release New Version
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches:
7+
- main
8+
9+
jobs:
10+
# Builds a new release for the module by bumping the version number and
11+
# generating a changelog entry. Commit the changes and open a pull request.
12+
build-release:
13+
name: Build new release
14+
runs-on: ubuntu-latest
15+
if: ${{ !startsWith(github.event.head_commit.message, 'bump:') }}
16+
permissions:
17+
contents: write
18+
pull-requests: write
19+
steps:
20+
- name: Checkout source code
21+
uses: actions/checkout@v6
22+
with:
23+
fetch-depth: 0
24+
- name: Bump version and create changelog
25+
id: bump
26+
uses: commitizen-tools/commitizen-action@0.27.0
27+
with:
28+
push: false
29+
github_token: ${{ secrets.GITHUB_TOKEN }}
30+
git_redirect_stderr: true
31+
- name: Get the commit message
32+
id: message
33+
run: |
34+
MESSAGE=$(git log --format=%B -n 1)
35+
echo "message=${MESSAGE}" >> $GITHUB_OUTPUT
36+
- name: Open a pull request for the release
37+
uses: peter-evans/create-pull-request@v8
38+
with:
39+
branch: release-${{ steps.bump.outputs.version }}
40+
title: ${{ steps.message.outputs.message }}
41+
42+
# Creates a new tag and GitHub release for the module.
43+
release:
44+
name: Release module
45+
runs-on: ubuntu-latest
46+
if: startsWith(github.event.head_commit.message, 'bump:')
47+
permissions:
48+
contents: write
49+
steps:
50+
- name: Checkout source code
51+
uses: actions/checkout@v6
52+
- name: Get the module name
53+
id: module_name
54+
run: |
55+
REPO_NAME="${{ github.event.repository.name }}"
56+
REPO_NAME="${REPO_NAME/tofu-modules-/}"
57+
MODULE_NAME="${REPO_NAME//-/_}"
58+
echo "name=${MODULE_NAME}" >> $GITHUB_OUTPUT
59+
- name: Get the version from the commit message
60+
id: version
61+
uses: actions/github-script@v8
62+
env:
63+
COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
64+
with:
65+
result-encoding: string
66+
# Look for the last version number, expecting it to be in the format:
67+
# `#.#.#-<suffix>.#` where the suffix is optional.
68+
script: |
69+
const message = process.env.COMMIT_MESSAGE;
70+
const regex = /^bump:.+(?<version>\d+\.\d+\.\d+[\da-z.-]*) \(#\d+\)$/m;
71+
const version = message.match(regex).groups.version;
72+
console.log(version);
73+
return version;
74+
- name: Bundle the module
75+
# We create an empty file first, so that tar doesn't complain about the
76+
# contents changing while it's running.
77+
run: |
78+
touch '${{ steps.module_name.outputs.name }}-${{ steps.version.outputs.result }}.tar.gz'
79+
tar \
80+
--exclude='.git' \
81+
--exclude='.gitignore' \
82+
--exclude='.github' \
83+
--exclude='.cz.yaml' \
84+
--exclude='*.tar.gz' \
85+
--exclude='*.tfvars' \
86+
--exclude='release.md' \
87+
--exclude='CODEOWNERS' \
88+
--exclude='trivy.yaml' \
89+
--exclude='*.env' \
90+
-czf '${{ steps.module_name.outputs.name }}-${{ steps.version.outputs.result }}.tar.gz' \
91+
.
92+
- name: Get changelog entry
93+
id: changelog
94+
uses: artlaman/conventional-changelog-reader-action@v1.1.0
95+
with:
96+
version: ${{ steps.version.outputs.result }}
97+
- name: Create release
98+
uses: softprops/action-gh-release@v2
99+
with:
100+
body: |
101+
## ${{ steps.changelog.outputs.version }} (${{ steps.changelog.outputs.date }})
102+
103+
${{ steps.changelog.outputs.changes }}
104+
tag_name: ${{ steps.version.outputs.result }}
105+
files: |
106+
${{ steps.module_name.outputs.name }}-${{ steps.version.outputs.result }}.tar.gz

‎.github/workflows/tflint.yaml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
name: TFLint Checks
2+
3+
on:
4+
push:
5+
pull_request:
6+
branches:
7+
- main
8+
9+
permissions:
10+
contents: read
11+
security-events: write
12+
13+
jobs:
14+
lint:
15+
runs-on: ubuntu-latest
16+
env:
17+
# Required to avoid rate limiting when downloading plugins.
18+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
19+
steps:
20+
- name: Checkout source code
21+
uses: actions/checkout@v6
22+
- name: Cache plugin directory
23+
uses: actions/cache@v5
24+
with:
25+
path: ~/.tflint.d/plugins
26+
key: tflint-${{ hashFiles('.tflint.hcl') }}
27+
- uses: terraform-linters/setup-tflint@v6
28+
name: Setup TFLint
29+
- name: Show version
30+
run: tflint --version
31+
- name: Init TFLint
32+
run: tflint --init
33+
- name: Run TFLint
34+
# Run TFLint, outputting the results to a SARIF file. We use `tee` so
35+
# that we can still see the output in the logs, and capture the exit
36+
# code properly with `pipefail`.
37+
run: |
38+
set -o pipefail
39+
tflint --format sarif --recursive \
40+
--config "$GITHUB_WORKSPACE/.tflint.hcl" \
41+
| tee tflint-results.sarif
42+
exit "${PIPESTATUS[0]}"
43+
- name: Parse SARIF file for annotations
44+
if: always()
45+
uses: jontyms/sarif-annotations@v0.0.3
46+
with:
47+
annotation-level: notice
48+
sarif-file: tflint-results.sarif
49+
- name: Upload SARIF result
50+
if: always()
51+
uses: github/codeql-action/upload-sarif@v4
52+
with:
53+
sarif_file: tflint-results.sarif

‎.github/workflows/trivy.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: Trivy Analysis
2+
3+
on:
4+
push:
5+
pull_request:
6+
branches:
7+
- main
8+
9+
permissions:
10+
contents: read
11+
security-events: write
12+
13+
jobs:
14+
trivy:
15+
runs-on: ubuntu-latest
16+
steps:
17+
- name: Checkout source code
18+
uses: actions/checkout@v6
19+
- name: Run Trivy vulnerability scanner
20+
uses: aquasecurity/trivy-action@0.33.1
21+
with:
22+
format: sarif
23+
output: trivy-results.sarif
24+
scan-type: config
25+
trivy-config: trivy.yaml
26+
- name: Parse SARIF file for annotations
27+
if: always()
28+
uses: jontyms/sarif-annotations@v0.0.3
29+
with:
30+
annotation-level: notice
31+
sarif-file: trivy-results.sarif
32+
- name: Upload SARIF result
33+
if: always()
34+
uses: github/codeql-action/upload-sarif@v4
35+
with:
36+
sarif_file: trivy-results.sarif

‎.gitignore‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# Local .terraform directories
2+
**/.terraform/*
3+
4+
# .tfstate files
5+
*.tfstate
6+
*.tfstate.*
7+
8+
# Crash log files
9+
crash.log
10+
crash.*.log
11+
12+
# Exclude all .tfvars files, which are likely to contain sensitive data, such as
13+
# password, private keys, and other secrets. These should not be part of version
14+
# control as they are data points which are potentially sensitive and subject
15+
# to change depending on the environment.
16+
*.tfvars
17+
*.tfvars.json
18+
.env
19+
20+
# Ignore override files as they are usually used to override resources locally and so
21+
# are not checked in
22+
override.tf
23+
override.tf.json
24+
*_override.tf
25+
*_override.tf.json
26+
27+
# Include override files you do wish to add to version control using negated pattern
28+
# !example_override.tf
29+
30+
# Ignore the plan output of command: terraform plan -out=tfplan
31+
*tfplan*
32+
33+
# Ignore CLI configuration files
34+
.terraformrc
35+
terraform.rc
36+
37+
# Ignore release artifacts
38+
release.md
39+
/*.tar.gz

‎.tflint.hcl‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Uncomment if your module uses the aws provider.
2+
# plugin "aws" {
3+
# enabled = true
4+
# version = "0.37.0"
5+
# source = "github.com/terraform-linters/tflint-ruleset-aws"
6+
# }
7+
8+
plugin "terraform" {
9+
preset = "all"
10+
enabled = true
11+
}
12+
13+
# TFLint doesn't understand the provider for_each syntax introduced with
14+
# OpenTofu 1.9, so we need to disable these rules so it doesn't error out.
15+
rule "terraform_required_providers" {
16+
enabled = false
17+
}
18+
rule "terraform_unused_required_providers" {
19+
enabled = false
20+
}

‎CHANGELOG.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Changelog
2+
3+
All notable changes to this project will be documented in this file.
4+
5+
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
6+
and this project adheres to
7+
[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
8+
9+
## Unreleased
10+
11+
Initial release.

‎CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
* @codeforamerica/devops

0 commit comments

Comments
 (0)