Skip to content

Commit b5505c3

Browse files
marcusburghardtmarcusburghardt
authored
chore: sync repository standards (#84)
* chore: sync repository standards Updated files: - .github/workflows/ci_checks.yml - .github/workflows/ci_dependencies.yml - .github/workflows/ci_scheduled.yml - .github/workflows/ci_security.yml - .github/workflows/ci_crapload.yml - .mega-linter.yml - .yamllint.yml - commitlint.config.js - .golangci.yml - .github/pull_request_template.md - .github/ISSUE_TEMPLATE/bug_report.md - .github/ISSUE_TEMPLATE/feature_request.md * chore: sync repository standards Updated files: - .github/workflows/ci_security.yml
1 parent 623680c commit b5505c3

12 files changed

Lines changed: 405 additions & 0 deletions

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
name: Bug report
3+
about: Create a report to help us improve
4+
title: ''
5+
labels: ''
6+
assignees: ''
7+
8+
---
9+
10+
**Describe the bug**
11+
A clear and concise description of what the bug is.
12+
13+
**To Reproduce**
14+
Steps to reproduce the behavior:
15+
1. Go to '...'
16+
2. Click on '....'
17+
3. Scroll down to '....'
18+
4. See error
19+
20+
**Expected behavior**
21+
A clear and concise description of what you expected to happen.
22+
23+
**Screenshots**
24+
If applicable, add screenshots to help explain your problem.
25+
26+
**Additional context**
27+
Add any other context about the problem here.

‎.github/ISSUE_TEMPLATE/feature_request.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
name: Feature request
3+
about: Suggest an idea for this project
4+
title: ''
5+
labels: ''
6+
assignees: ''
7+
8+
---
9+
10+
**Is your feature request related to a problem? Please describe.**
11+
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
12+
13+
**Describe the solution you'd like**
14+
A clear and concise description of what you want to happen.
15+
16+
**Describe alternatives you've considered**
17+
A clear and concise description of any alternative solutions or features you've considered.
18+
19+
**Additional context**
20+
Add any other context or screenshots about the feature request here.

‎.github/pull_request_template.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
## Summary
2+
_Please include a summary of the changes and the context of this PR._
3+
4+
## Related Issues
5+
_Inform any issues relevant to this PR. For example:_
6+
7+
- _Closes #ISSUE_NUMBER_
8+
9+
## Review Hints
10+
11+
- _Review hints here. Replace this text. Don't use the italics format!_
12+
13+
- _Use this optional section to give any relevant information that could help the reviewer to more quickly and assertively understand and test the changes._
14+
15+
- _Good examples are useful commands, if it is better to review all commits together or in a suggested sequence, any relevant discussion in other PRs or issues, etc._

‎.github/workflows/ci_checks.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
branches:
9+
- main
10+
11+
permissions:
12+
contents: read
13+
issues: none
14+
pull-requests: none
15+
16+
jobs:
17+
call_reusable_ci:
18+
name: Standardized CI
19+
uses: complytime/org-infra/.github/workflows/reusable_ci.yml@baf5b2e21e61581b4a3a129795286e8592e6afbb # v0.1.0
20+
permissions:
21+
contents: read
22+
issues: read

‎.github/workflows/ci_crapload.yml‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
# CRAP Load Check
2+
# ===============
3+
# Runs CRAP load analysis on pull requests targeting main.
4+
# Consumes the reusable workflow from org-infra.
5+
#
6+
# SPDX-License-Identifier: Apache-2.0
7+
8+
name: CRAP Load Check
9+
10+
on:
11+
pull_request:
12+
branches:
13+
- main
14+
15+
permissions:
16+
contents: read
17+
pull-requests: write
18+
19+
jobs:
20+
crapload:
21+
name: CRAP Load Analysis
22+
uses: complytime/org-infra/.github/workflows/reusable_crapload_analysis.yml@baf5b2e21e61581b4a3a129795286e8592e6afbb # v0.1.0
23+
permissions:
24+
contents: read
25+
26+
post-comment:
27+
name: Post PR Comment
28+
needs: crapload
29+
if: ${{ !cancelled() }}
30+
runs-on: ubuntu-latest
31+
permissions:
32+
pull-requests: write
33+
steps:
34+
- name: Download comment body
35+
id: download
36+
continue-on-error: true
37+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
38+
with:
39+
name: crapload-analysis
40+
path: artifact
41+
42+
- name: Post or update PR comment
43+
continue-on-error: true
44+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
45+
with:
46+
script: |
47+
const fs = require('fs');
48+
const marker = '<!-- crapload-analysis-marker -->';
49+
const bodyPath = 'artifact/crapload-comment-body.md';
50+
const runUrl = [
51+
context.serverUrl,
52+
context.repo.owner,
53+
context.repo.repo,
54+
'actions/runs',
55+
context.runId,
56+
].join('/');
57+
const MAX_COMMENT_LENGTH = 60000;
58+
59+
let body;
60+
if (fs.existsSync(bodyPath)) {
61+
body = fs.readFileSync(bodyPath, 'utf8');
62+
if (body.length > MAX_COMMENT_LENGTH) {
63+
const lastNewline = body.lastIndexOf('\n', MAX_COMMENT_LENGTH);
64+
body = body.substring(0, lastNewline > 0 ? lastNewline : MAX_COMMENT_LENGTH);
65+
body += '\n\n---\n';
66+
body += '> **Note:** This report was truncated due to size.';
67+
body += ` [View the full analysis in the Job Summary](${runUrl}).`;
68+
}
69+
} else {
70+
body = [
71+
marker,
72+
'## &#x274C; CRAP Load Analysis',
73+
'',
74+
'The CRAP Load analysis could not generate a detailed report.',
75+
'',
76+
`[View the full analysis in the Job Summary](${runUrl}).`,
77+
].join('\n');
78+
}
79+
80+
const { data: comments } = await github.rest.issues.listComments({
81+
owner: context.repo.owner,
82+
repo: context.repo.repo,
83+
issue_number: context.issue.number,
84+
});
85+
86+
const existing = comments.find(c => c.body.includes(marker));
87+
88+
if (existing) {
89+
await github.rest.issues.updateComment({
90+
owner: context.repo.owner,
91+
repo: context.repo.repo,
92+
comment_id: existing.id,
93+
body,
94+
});
95+
} else {
96+
await github.rest.issues.createComment({
97+
owner: context.repo.owner,
98+
repo: context.repo.repo,
99+
issue_number: context.issue.number,
100+
body,
101+
});
102+
}

‎.github/workflows/ci_dependencies.yml‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
name: Dependencies
2+
3+
# --------------------------------------------------------------------------
4+
# Orchestrates dependency review for all PRs and dependabot-specific
5+
# processing: structured PR comments with review data and auto-approval
6+
# for safe dependency updates (non-major, 24h+ release age, no vulnerabilities).
7+
# --------------------------------------------------------------------------
8+
9+
on:
10+
push:
11+
branches:
12+
- main
13+
pull_request:
14+
branches:
15+
- main
16+
17+
permissions:
18+
contents: read
19+
issues: none
20+
pull-requests: none
21+
22+
env:
23+
MIN_RELEASE_AGE_HOURS: 24
24+
25+
jobs:
26+
call_deps_reviewer:
27+
name: General
28+
uses: complytime/org-infra/.github/workflows/reusable_deps_reviewer.yml@baf5b2e21e61581b4a3a129795286e8592e6afbb # v0.1.0
29+
30+
call_dependabot_reviewer:
31+
name: Dependabot
32+
uses: complytime/org-infra/.github/workflows/reusable_dependabot_reviewer.yml@baf5b2e21e61581b4a3a129795286e8592e6afbb # v0.1.0
33+
34+
comment_on_dependabot_prs:
35+
name: Dependabot Comment
36+
if: github.actor == 'dependabot[bot]'
37+
runs-on: ubuntu-latest
38+
needs: [call_deps_reviewer, call_dependabot_reviewer]
39+
permissions:
40+
issues: read
41+
pull-requests: write # Necessary to write a comment
42+
steps:
43+
- name: Comment from Dependabot Reviewer
44+
uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
45+
env:
46+
REVIEW_CONCLUSION: ${{ needs.call_deps_reviewer.outputs.review_conclusion }}
47+
RISK_LEVEL: ${{ needs.call_dependabot_reviewer.outputs.risk_level }}
48+
UPDATES_COUNT: ${{ needs.call_dependabot_reviewer.outputs.updates_count }}
49+
DEP_NAME: ${{ needs.call_dependabot_reviewer.outputs.dep_name }}
50+
DEP_VERSION: ${{ needs.call_dependabot_reviewer.outputs.dep_version }}
51+
RELEASE_AGE_HOURS: ${{ needs.call_dependabot_reviewer.outputs.release_age_hours }}
52+
with:
53+
issue-number: ${{ github.event.pull_request.number }}
54+
edit-mode: replace
55+
body: |
56+
🤖 **Standardized Dependabot Review Summary** 🤖
57+
58+
This PR was processed by the organization's reusable CI pipeline.
59+
60+
| Criterion | Status | Detail |
61+
|-----------|--------|--------|
62+
| **Dependencies Review** | **${{ env.REVIEW_CONCLUSION }}** | [View logs](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) |
63+
| **Calculated Risk** | **${{ env.RISK_LEVEL }}** | `${{ env.DEP_NAME }}` v${{ env.DEP_VERSION }} |
64+
| **Release Age** | **${{ (env.RELEASE_AGE_HOURS == '-1' || env.RELEASE_AGE_HOURS == '') && 'unknown' || format('{0}h', env.RELEASE_AGE_HOURS) }}** | ${{ (env.RELEASE_AGE_HOURS == '-1' || env.RELEASE_AGE_HOURS == '') && 'Release date unavailable — manual review required' || format('Released {0} hours ago', env.RELEASE_AGE_HOURS) }} |
65+
| **Dependency Usage** | ${{ env.UPDATES_COUNT == '0' && 'unavailable' || format('{0} repos', env.UPDATES_COUNT) }} | Informational only — does not affect approval |
66+
67+
**Auto-approval:** ${{ env.RISK_LEVEL != 'high' && env.REVIEW_CONCLUSION == 'success' && env.RELEASE_AGE_HOURS != '-1' && fromJSON(env.RELEASE_AGE_HOURS) >= fromJSON(env.MIN_RELEASE_AGE_HOURS) && '✅ Approved' || '⏳ Manual review required' }}
68+
69+
---
70+
71+
Maintainer check list:
72+
1. Ensure the PR passed all CI tests (required status checks).
73+
2. Investigate failures for Major updates or any manual review requirement.
74+
3. Don't overlook breaking changes and changelog information.
75+
4. If the scorecard value is low, consider to contribute to make it higher. Everybody wins!
76+
5. Be diligent. When in doubt, ask another maintainer for additional review.
77+
78+
approve_dependabot_prs:
79+
name: Dependabot Auto-approve
80+
if: github.actor == 'dependabot[bot]'
81+
runs-on: ubuntu-latest
82+
needs: [call_deps_reviewer, call_dependabot_reviewer]
83+
permissions:
84+
pull-requests: write # Necessary to approve a PR
85+
steps:
86+
- name: Auto-approve if Confident
87+
if: >-
88+
needs.call_dependabot_reviewer.outputs.risk_level != 'high' &&
89+
needs.call_deps_reviewer.outputs.review_conclusion == 'success' &&
90+
needs.call_dependabot_reviewer.outputs.release_age_hours != '-1' &&
91+
fromJSON(needs.call_dependabot_reviewer.outputs.release_age_hours) >= fromJSON(env.MIN_RELEASE_AGE_HOURS)
92+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
93+
with:
94+
script: |
95+
const risk = '${{ needs.call_dependabot_reviewer.outputs.risk_level }}';
96+
const review = '${{ needs.call_deps_reviewer.outputs.review_conclusion }}';
97+
const releaseAge = '${{ needs.call_dependabot_reviewer.outputs.release_age_hours }}';
98+
99+
github.rest.pulls.createReview({
100+
owner: context.repo.owner,
101+
repo: context.repo.repo,
102+
pull_number: context.issue.number,
103+
event: 'APPROVE',
104+
body: `Automatically approved: risk=${risk}, review=${review}, release_age=${releaseAge}h.`
105+
});
106+
console.log(`Dependabot PR approved: risk=${risk}, review=${review}, release_age=${releaseAge}h`);

‎.github/workflows/ci_scheduled.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: Scheduled Jobs
2+
3+
on:
4+
schedule:
5+
- cron: '0 0 * * *'
6+
7+
permissions:
8+
contents: read
9+
actions: none
10+
id-token: none
11+
security-events: none
12+
13+
jobs:
14+
call_reusable_scheduled:
15+
name: OSV-Scanner and Scorecards
16+
permissions:
17+
contents: read
18+
actions: read # Required to upload SARIF file to CodeQL. See: https://github.com/github/codeql-action/issues/2117
19+
security-events: write # Require writing security events to upload SARIF file to security tab
20+
id-token: write # Needed to access GitHub's OIDC token which verifies the authenticity of the result when publishing it.
21+
uses: complytime/org-infra/.github/workflows/reusable_scheduled.yml@baf5b2e21e61581b4a3a129795286e8592e6afbb # v0.1.0

‎.github/workflows/ci_security.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: Security Checks
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
branches:
9+
- main
10+
11+
permissions:
12+
contents: read
13+
actions: none
14+
id-token: none
15+
security-events: none
16+
packages: none
17+
18+
jobs:
19+
call_reusable_vuln_scan:
20+
name: OSV-Scanner
21+
permissions:
22+
contents: read
23+
actions: read
24+
security-events: write
25+
uses: complytime/org-infra/.github/workflows/reusable_vuln_scan.yml@baf5b2e21e61581b4a3a129795286e8592e6afbb # v0.1.0
26+
with:
27+
# OSV focuses on known CVEs in dependencies; Trivy adds broader coverage
28+
enable_trivy_source: false
29+
30+
call_reusable_security:
31+
name: OpenSSF Scorecards
32+
permissions:
33+
contents: read
34+
id-token: write
35+
security-events: write
36+
uses: complytime/org-infra/.github/workflows/reusable_security.yml@baf5b2e21e61581b4a3a129795286e8592e6afbb # v0.1.0

‎.golangci.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
version: "2"
2+
run:
3+
skip-dirs:
4+
- vendor
5+
linters:
6+
default: standard # https://golangci-lint.run/usage/linters/#enabled-by-default
7+
enable:
8+
- gosec # Security checks for Go code
9+
exclusions:
10+
generated: lax
11+
presets:
12+
- comments
13+
- common-false-positives
14+
- legacy
15+
- std-error-handling
16+
formatters:
17+
enable:
18+
- goimports # Checks import statements are formatted
19+
exclusions:
20+
generated: lax

‎.mega-linter.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# https://megalinter.io/latest/supported-linters/
2+
ADDITIONAL_EXCLUDED_DIRECTORIES:
3+
- vendor
4+
ENABLE_LINTERS:
5+
- ACTION_ACTIONLINT
6+
- ANSIBLE_ANSIBLE_LINT
7+
- BASH_SHELLCHECK
8+
- DOCKERFILE_HADOLINT
9+
- GO_GOLANGCI_LINT
10+
- MARKDOWN_MARKDOWNLINT
11+
- PYTHON_RUFF
12+
- PROTOBUF_PROTOLINT
13+
- REPOSITORY_GITLEAKS
14+
- REPOSITORY_KICS
15+
- YAML_YAMLLINT
16+
REPOSITORY_KICS_ARGUMENTS: "--fail-on high"

0 commit comments

Comments
 (0)