Bumps [crazy-max/ghaction-github-status](https://github.com/crazy-max/ghaction-github-status) from 3 to 4.
- [Release notes](https://github.com/crazy-max/ghaction-github-status/releases)
- [Commits](crazy-max/ghaction-github-status@v3...v4)

---
updated-dependencies:
- dependency-name: crazy-max/ghaction-github-status
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Also add a runner hardening task to the labeler job.

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

…up-env files

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

@mcdonnnj correctly pointed out that other projects add their own
configuration files that match, e.g., the /.*.yaml pattern.  We want
to ensure that we only own the linter configuration files from the
skeleton.

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

Bumps [hashicorp/setup-terraform](https://github.com/hashicorp/setup-terraform) from 2 to 3.
- [Release notes](https://github.com/hashicorp/setup-terraform/releases)
- [Changelog](https://github.com/hashicorp/setup-terraform/blob/main/CHANGELOG.md)
- [Commits](hashicorp/setup-terraform@v2...v3)

---
updated-dependencies:
- dependency-name: hashicorp/setup-terraform
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

We prefer block style to flow style for sequences and mappings in YAML.

We prefer to alphabetize mapping keys in YAML documents whenever
possible.

This should improve compatibility with merge queues. We configure it to
only trigger on the `checks_requested` type which is currently the only
supported type for this trigger. If additional types are added in the
future they should be added if appropriate.

Bumps [actions/setup-go](https://github.com/actions/setup-go) from 4 to 5.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@v4...v5)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 4 to 5.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v4...v5)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2 to 3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@v2...v3)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

This was erroneously configured with each of the sub-Actions in the
github/codeql-action repository. They are versioned as one under the
github/codeql-action namespace.

This hook bundles the binaries for shfmt with a Python package which
removes the need to manually install the tool for the hook to function.

The new pre-commit hook provides `shfmt` binaries so we no longer need
to ensure it is installed.

Since shfmt now supports long command line options we should use them
as that is our preference. The single quotes for the number of spaces
to indent is changed to double quotes to align with our usual quotation
style.

These options are baked into the functionality of the old hook but must
be explicitly declared for the new hook.

This sets the default shell for any run steps in the build workflow to
mirror our standard shellscript writing practices. In addition to
enabling our standard options it will also enable errtrace and print
any commands that are run which should make debugging/troubleshooting
more straightforward.

This will run the Go tool `goimports` against the repository if it
contains any Go files. This tool bundles the functionality of `go fmt`
with the additional benefit of sorting Go imports much like the isort
tool we use for Python code.

This is a temporary fix until @mcdonnnj has
his PR approved and merged into the terraform-docs
repo. This fix will perform a shallow clone of his
forked branch, build the binary, and install it.

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

Co-authored-by: Shane Frasier <jeremy.frasier@gwe.cisa.dhs.gov>

PATH is handled by `setup-go` so we can refactor the code setting it. Also we are taking advantage of the -C switch to handle building from the cloned repository.

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

`TODO` was placed on the wrong comment block. Also I am adding a link to the issue for the TODO.

Co-authored-by: dav3r <david.redmin@trio.dhs.gov>

This commit is introducing 2 new flags
into the setup-env script. -l or
--list-versions will list available
Python versions and allow the user to
select a version interactively. The second
flag -v or --version will allow a user
to set the version if installed.
(e.g. ./setup-env -v 3.9.6)

This makes the code a bit cleaner and still accomplishes the same functionality

Co-authored-by: Shane Frasier <jeremy.frasier@gwe.cisa.dhs.gov>

Co-authored-by: Shane Frasier <jeremy.frasier@gwe.cisa.dhs.gov>

If the Python version exists then we want the script to continue
execution.

pyenv local is run below.

If PYTHON_VERSION is an empty string then the system Python will be used.

This commit makes a couple changes. The first
change is adding the BSD getopt tool to
simplify the parsing of flags and arguments.
Second, we are adding the -n flag so the user
can specify the name of the virtual environment
if they choose.

This commit will update the usage documentation
so now it will display all the new flags, how
to use them, and what they do. Since the
long option isn't available for the BSD version
of getopt we have to use short options only.
The force documentation has been updated to
reflect this change. Also removed some redundant
code that wasn't necessary.

This commit will make it so long options are
supported. It also includes some improved
error handling. It will display a message if
a Mac OS user doesn't have gnu-getopt installed
on their system and suggest steps to take to
get it installed via brew.

Co-authored-by: Shane Frasier <jeremy.frasier@gwe.cisa.dhs.gov>

Co-authored-by: Shane Frasier <jeremy.frasier@gwe.cisa.dhs.gov>

Co-authored-by: Shane Frasier <jeremy.frasier@gwe.cisa.dhs.gov>

Co-authored-by: dav3r <david.redmin@trio.dhs.gov>

Co-authored-by: dav3r <david.redmin@trio.dhs.gov>

Co-authored-by: dav3r <david.redmin@trio.dhs.gov>

This commit will clearly differentiate between GNU getopt the tool and gnu-getopt the Homebrew formula. Also updating the URL so that getopt points at the source repository and pyenv and pyenv-virtualenv point at their respective repositories. Updated the ending punctuation.

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

This commit will remove the previous flags
-v or --version for -p or --python-version.
Also it will replace -n or --name for -v or
--venv-name. The usage menu has been updated
to reflect these changes as well.

Co-authored-by: Shane Frasier <jeremy.frasier@gwe.cisa.dhs.gov>

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

Co-authored-by: Shane Frasier <jeremy.frasier@gwe.cisa.dhs.gov>

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

Exit code 2 usually relates to build-ins which does not fit what is failing here. Not sure what alternative would be best so we can just use the generic failure code

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

Since the new function, python_versions expects
pyenv to be installed it makes sense to have it
checked earlier in the script.

- Set exit code to 64 per sysexits.h for clarity.
- Added comment on gnu-getopt handling.

Aligns with Unix standards and enhances readability.

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

Co-authored-by: Shane Frasier <jeremy.frasier@gwe.cisa.dhs.gov>

Co-authored-by: dav3r <david.redmin@trio.dhs.gov>

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

This is done automatically with the `pre-commit autoupdate` command.
The pre-commit/mirrors-prettier was manually held back because the
latest tags are for alpha releases of the next major version.

The hook is manually updated to the last v3 tag available from the
pre-commit/mirrors-prettier repository. We then add the latest release
of v3 available from NPM as an additional depdency.

…max/ghaction-github-status-4

Bump crazy-max/ghaction-github-status from 3 to 4

…abel-sync-workflow

Add a diagnostics job for the label syncing workflow

…-configs

Make the dev team the owners of the linter configuration files

…orp/setup-terraform-3

Bump hashicorp/setup-terraform from 2 to 3

…_queues

Improve merge queue support

…s/setup-go-5

Bump actions/setup-go from 4 to 5

…s/setup-python-5

Bump actions/setup-python from 4 to 5

Update `pre-commit` hooks

…steps

Set the default `shell` for all `run` steps in the `build` workflow

…pecify_python

Allow setup-env to specify Python version

…om_action

Use `cisagov/setup-env-github-action` to provide the Python and Go versions to use

…ok_for_shfmt

Switch the pre-commit hook used to run `shfmt`

Add a pre-commit hook to run `goimports`

…upport_terraform-docs

Add ATX Header Support for `terraform-docs`

This hook bundles the binaries for shellcheck with a Python package
which removes the need to ensure the tool is installed for the hook to
function. It also ties the version of shellcheck used to the hook which
will help guarantee consistency.

…ok_for_shellcheck

Switch the pre-commit hook used to run `shellcheck`

…skeleton

This includes adding the necessary job step to use the
cisagov/setup-env-github-action Action.

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

New versions of ansible-core (2.16.7 and 2.17.0) have been released
that do not suffer from the bug discussed in ansible/ansible#82702.
This bug broke any symlinked files in vars, tasks, etc. for any
Ansible role installed via ansible-galaxy.

All versions later than ansible-core 2.16.7 and 2.17.0 should function
as expected.

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

The line is not only unnecessary, it was commented out to boot!

…lint

On its own ansible-lint does not pull in ansible, only ansible-core.
Therefore, if an Ansible module lives in ansible instead of
ansible-core, the linter will complain that the module is unknown.  In
these cases it is necessary to add the ansible package itself as an
additional dependency, with the same pinning as is done in
requirements-test.txt of cisagov/skeleton-ansible-role.

This is done automatically with the `pre-commit autoupdate` command.
The pre-commit/mirrors-prettier was manually held back because the
latest tags are for alpha releases of the next major version.