diff --git a/.checkov.yaml b/.checkov.yaml new file mode 100644 index 0000000..58766d5 --- /dev/null +++ b/.checkov.yaml @@ -0,0 +1,14 @@ +compact: true +directory: + - . +download-external-modules: true +evaluate-variables: true +external-modules-download-path: .external_modules +framework: + - all +quiet: true +skip-path: + - .external_modules + - modules + - catalog-info.yml +baseline: .checkov.baseline diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 16c3064..533728b 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,3 +1,6 @@ +# DO NOT CHANGE. This file is being managed from a central repository +# To know more simply visit https://github.com/honestbank/.github/blob/main/docs/about.md + # This is a comment. # Each line is a file pattern followed by one or more owners. @@ -5,4 +8,4 @@ # the repo. Unless a later match takes precedence, # @global-owner1 and @global-owner2 will be requested for # review when someone opens a pull request. -* @honestbank/devops-engineers @honestbank/honestbank-engineers +* @honestbank/devops-engineers diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 3d3a091..7e799e2 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -3,8 +3,18 @@ * All PRs should reference an issue in our issue tracker. If one doesn't exist, please create one! * PR titles should follow https://www.conventionalcommits.org. + --> +### Pull Request Submission Checklist + +Please confirm that you have done the following before requesting reviews: + +- [ ] I have confirmed that the PR type is appropriate for the change I am making according to the [Honest Pull Request and Commit Message Naming Conventions](https://www.notion.so/honestbank/Pull-Request-and-Commit-Message-Naming-Conventions-bd97f2cbb34c4c73b1ff3a3e384b850c). +- [ ] I have typed an adequate description that explains **why** I am making this change. +- [ ] I have installed and run standard pre-commit hooks that lints and validates my code. +- [ ] All entities that I am working with are up-to-date in Backstage; if updates are needed, I have linked the relevant PRs. [Backstage guide](https://www.notion.so/honestbank/How-to-Write-a-Backstage-Service-Catalog-Entry-a-catalog-info-yaml-file-21845ff72e404b14aed2ac989fb202cf?pvs=4) + ### Description * diff --git a/.github/workflows/checkov.yaml b/.github/workflows/checkov.yaml new file mode 100644 index 0000000..1cbe949 --- /dev/null +++ b/.github/workflows/checkov.yaml @@ -0,0 +1,27 @@ +# yamllint disable rule:line-length +# Use template from https://github.com/honestbank/workflows/tree/main/examples/repository-workflows +--- +name: "repository-checkov" +permissions: read-all + +on: # yamllint disable-line rule:truthy + pull_request: + branches: + - test + - dev + - qa + - prod + - main + push: + branches: + - test + - dev + - qa + - prod + - main + +jobs: + repository-checkov: + name: repository-checkov + uses: honestbank/workflows/.github/workflows/shared-checkov.yaml@main + secrets: inherit diff --git a/.github/workflows/semantic-pr.yaml b/.github/workflows/semantic-pr.yaml new file mode 100644 index 0000000..99eda8b --- /dev/null +++ b/.github/workflows/semantic-pr.yaml @@ -0,0 +1,24 @@ +# DO NOT CHANGE. This file is being managed from a central repository +# To know more simply visit https://github.com/honestbank/.github/blob/main/docs/about.md + +# yamllint disable rule:line-length +# Use template from https://github.com/honestbank/workflows/tree/main/examples/repository-workflows +--- +name: "repository-semantic-pr" +permissions: + contents: write + pull-requests: write + +on: # yamllint disable-line rule:truthy + pull_request: + types: + - opened + - edited + - reopened + - synchronize + +jobs: + repository-semantic-pr: + name: repository-semantic-pr + uses: honestbank/workflows/.github/workflows/shared-semantic-pr.yaml@main + secrets: inherit diff --git a/.github/workflows/terraform.yaml b/.github/workflows/terraform.yaml new file mode 100644 index 0000000..d0cf4a7 --- /dev/null +++ b/.github/workflows/terraform.yaml @@ -0,0 +1,38 @@ +name: "Terraform GitHub Action" +on: + pull_request: + branches: [test, dev, qa, prod, main] +env: + tf_version: "latest" + tf_working_dir: "." + TF_WORKSPACE: ${{ github.base_ref }} +jobs: + terraform: + name: "terraform" + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + submodules: "recursive" + token: ${{ secrets.ENGINEERING_GITHUB_PERSONAL_ACCESS_TOKEN }} + - name: Set up Terraform + uses: hashicorp/setup-terraform@v3 + with: + cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }} + - name: Terraform Format + id: fmt + run: terraform fmt + continue-on-error: true + env: + GITHUB_TOKEN: ${{ secrets.ENGINEERING_GITHUB_PERSONAL_ACCESS_TOKEN }} + - name: Terraform Init + id: init + run: terraform init + - name: Terraform Validate + id: validate + run: terraform validate -no-color + - name: Terraform Plan + id: plan + run: terraform plan -no-color + continue-on-error: true diff --git a/.github/workflows/terratest.yaml b/.github/workflows/terratest.yaml new file mode 100644 index 0000000..05041b1 --- /dev/null +++ b/.github/workflows/terratest.yaml @@ -0,0 +1,30 @@ +name: "Terratest GitHub Action" +on: + pull_request: + branches: [test, dev, qa, prod, main] + push: + branches: [test, dev, qa, prod, main] +env: + AWS_ACCESS_KEY_ID: ${{ secrets.TERRATEST_AWS_ACCESS_KEY_ID }} + AWS_SECRET_KEY: ${{ secrets.TERRATEST_AWS_SECRET_ACCESS_KEY }} + AWS_DEFAULT_REGION: ${{ secrets.TERRATEST_AWS_REGION }} + AWS_REGION: ${{ secrets.TERRATEST_AWS_REGION }} +jobs: + terratest: + name: terratest + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + submodules: true + - name: Set up Go + uses: actions/setup-go@v5 + with: + go-version: 1.20 + id: go + - name: Run 'go test -v -timeout 60m' + run: | + cd test + go mod download + go test -v -timeout 30m diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 1121529..7ca4cad 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,18 +1,70 @@ +# DO NOT CHANGE. This file is being managed from a central repository +# To know more simply visit https://github.com/honestbank/.github/blob/main/docs/about.md + # See https://pre-commit.com for more information # See https://pre-commit.com/hooks.html for more hooks + repos: - - repo: https://github.com/pre-commit/pre-commit-hooks - rev: v3.2.0 - hooks: - - id: trailing-whitespace - - id: end-of-file-fixer - - id: check-yaml - - id: check-added-large-files - - repo: git://github.com/antonbabenko/pre-commit-terraform - rev: v1.48.0 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.5.0 # Get the latest from: https://github.com/pre-commit/pre-commit-hooks/releases + hooks: + - id: check-yaml + args: ["--allow-multiple-documents"] + - id: check-added-large-files + - id: detect-aws-credentials + args: ["--allow-missing-credentials"] + - repo: local + hooks: + - id: create-checkov-baseline + name: Create Checkov Baseline + entry: bash -c 'if [ ! -f .checkov.baseline ]; then echo "{}" > .checkov.baseline && touch baseline-created; fi' + language: system + stages: [commit] + pass_filenames: false + - repo: https://github.com/antonbabenko/pre-commit-terraform + rev: v1.88.4 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases hooks: - id: terraform_fmt - - id: terraform_docs - - id: terraform_validate # Disabled due to flakiness -# - id: terraform_tfsec # Temporarily disabled due to PSP warnings on GKE -# - id: checkov # Disabled due to crashing + - id: terraform_validate + args: + - --hook-config=--retry-once-with-cleanup=true + - --tf-init-args=-upgrade + - id: terraform_tfsec + exclude: "test/" + args: + - --args=--exclude-downloaded-modules + - id: terraform_checkov + exclude: "test/" + args: + - --args=--baseline __GIT_WORKING_DIR__/.checkov.baseline + - repo: local + hooks: + - id: delete-checkov-baseline + name: Delete Checkov Baseline + entry: bash -c 'if [ -f baseline-created ]; then rm .checkov.baseline && rm baseline-created; fi' + language: system + stages: [commit] + pass_filenames: false + - repo: https://github.com/gitguardian/ggshield + rev: v1.26.0 + hooks: + - id: ggshield + language: python + stages: [commit] + args: ["secret", "scan", "pre-commit"] + - repo: local + hooks: + - id: docs + name: docs + entry: make + args: ["docs"] + language: system + pass_filenames: false + # Run this at the end so that we don't end up in infinite loop + # where the end of line fixer runs first and then the docs and fmt + # and other hooks that modify files will break it again. + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.5.0 # Get the latest from: https://github.com/pre-commit/pre-commit-hooks/releases + hooks: + - id: trailing-whitespace + - id: end-of-file-fixer diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..be634ce --- /dev/null +++ b/Makefile @@ -0,0 +1,19 @@ +commit: docs validate + +docs: + terraform-docs --lockfile=false -c .terraform-docs.yml . + +init: + git submodule update --init --recursive + terraform init -upgrade + +lint: + terraform fmt --recursive + +tests: +# Super long timeout since this Makefile will be used in various repositories + cd test; go clean -testcache; go test -v -timeout 60m + +validate: lint + terraform init --upgrade + terraform validate