From 85b4c2c9eb3f028958a7f598d890b976834b9ad0 Mon Sep 17 00:00:00 2001 From: Honest Bot Date: Fri, 24 Nov 2023 07:48:18 +0000 Subject: [PATCH] chore: synced file(s) with honestbank/.github --- .checkov.yaml | 14 ++++++ .github/CODEOWNERS | 5 ++- .github/pull_request_template.md | 15 +++++++ .github/workflows/checkov.yaml | 27 ++++++++++++ .github/workflows/semantic-pr.yaml | 21 +++++++++ .pre-commit-config.yaml | 68 ++++++++++++++++++++++++------ Makefile | 19 +++++++++ 7 files changed, 155 insertions(+), 14 deletions(-) create mode 100644 .checkov.yaml create mode 100644 .github/workflows/checkov.yaml create mode 100644 .github/workflows/semantic-pr.yaml create mode 100644 Makefile diff --git a/.checkov.yaml b/.checkov.yaml new file mode 100644 index 0000000..28b0676 --- /dev/null +++ b/.checkov.yaml @@ -0,0 +1,14 @@ +compact: true +directory: +- . +download-external-modules: true +evaluate-variables: true +external-modules-download-path: .external_modules +framework: +- all +quiet: true +skip-path: + - .external_modules + - modules + - catalog-info.yml +baseline: .checkov.baseline diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 16c3064..533728b 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,3 +1,6 @@ +# DO NOT CHANGE. This file is being managed from a central repository +# To know more simply visit https://github.com/honestbank/.github/blob/main/docs/about.md + # This is a comment. # Each line is a file pattern followed by one or more owners. @@ -5,4 +8,4 @@ # the repo. Unless a later match takes precedence, # @global-owner1 and @global-owner2 will be requested for # review when someone opens a pull request. -* @honestbank/devops-engineers @honestbank/honestbank-engineers +* @honestbank/devops-engineers diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 3d3a091..039f966 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -3,8 +3,23 @@ * All PRs should reference an issue in our issue tracker. If one doesn't exist, please create one! * PR titles should follow https://www.conventionalcommits.org. + --> +### Pull Request Submission Checklist + +Please confirm that you have done the following before requesting reviews: + +- [ ] I have confirmed that the PR type is appropriate for the change I am making according to the [Honest Pull Request and Commit Message Naming Conventions](https://www.notion.so/honestbank/Pull-Request-and-Commit-Message-Naming-Conventions-bd97f2cbb34c4c73b1ff3a3e384b850c). +- [ ] I have typed an adequate description that explains **why** I am making this change. +- [ ] I have installed and run standard pre-commit hooks that lints and validates my code. + ### Description * + +### Experiment Link + + + +GrowthBook Experiment Link: https://app.growthbook.io/features/ diff --git a/.github/workflows/checkov.yaml b/.github/workflows/checkov.yaml new file mode 100644 index 0000000..1cbe949 --- /dev/null +++ b/.github/workflows/checkov.yaml @@ -0,0 +1,27 @@ +# yamllint disable rule:line-length +# Use template from https://github.com/honestbank/workflows/tree/main/examples/repository-workflows +--- +name: "repository-checkov" +permissions: read-all + +on: # yamllint disable-line rule:truthy + pull_request: + branches: + - test + - dev + - qa + - prod + - main + push: + branches: + - test + - dev + - qa + - prod + - main + +jobs: + repository-checkov: + name: repository-checkov + uses: honestbank/workflows/.github/workflows/shared-checkov.yaml@main + secrets: inherit diff --git a/.github/workflows/semantic-pr.yaml b/.github/workflows/semantic-pr.yaml new file mode 100644 index 0000000..332f9bd --- /dev/null +++ b/.github/workflows/semantic-pr.yaml @@ -0,0 +1,21 @@ +# DO NOT CHANGE. This file is being managed from a central repository +# To know more simply visit https://github.com/honestbank/.github/blob/main/docs/about.md + +# yamllint disable rule:line-length +# Use template from https://github.com/honestbank/workflows/tree/main/examples/repository-workflows +--- +name: "repository-semantic-pr" +permissions: read-all + +on: # yamllint disable-line rule:truthy + pull_request: + types: + - opened + - edited + - synchronize + +jobs: + repository-semantic-pr: + name: repository-semantic-pr + uses: honestbank/workflows/.github/workflows/shared-semantic-pr.yaml@main + secrets: inherit diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 1121529..7cf5986 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,18 +1,60 @@ +# DO NOT CHANGE. This file is being managed from a central repository +# To know more simply visit https://github.com/honestbank/.github/blob/main/docs/about.md + # See https://pre-commit.com for more information # See https://pre-commit.com/hooks.html for more hooks + repos: - - repo: https://github.com/pre-commit/pre-commit-hooks - rev: v3.2.0 - hooks: - - id: trailing-whitespace - - id: end-of-file-fixer - - id: check-yaml - - id: check-added-large-files - - repo: git://github.com/antonbabenko/pre-commit-terraform - rev: v1.48.0 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.5.0 # Get the latest from: https://github.com/pre-commit/pre-commit-hooks/releases + hooks: + - id: trailing-whitespace + - id: end-of-file-fixer + - id: check-yaml + - id: check-added-large-files + - id: detect-aws-credentials + args: ['--allow-missing-credentials'] + - repo: local + hooks: + - id: create-checkov-baseline + name: Create Checkov Baseline + entry: bash -c 'if [ ! -f .checkov.baseline ]; then echo "{}" > .checkov.baseline && touch baseline-created; fi' + language: system + stages: [commit] + pass_filenames: false + - repo: https://github.com/antonbabenko/pre-commit-terraform + rev: v1.83.6 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases hooks: - id: terraform_fmt - - id: terraform_docs - - id: terraform_validate # Disabled due to flakiness -# - id: terraform_tfsec # Temporarily disabled due to PSP warnings on GKE -# - id: checkov # Disabled due to crashing + - id: terraform_validate + args: + - --hook-config=--retry-once-with-cleanup=true + - --tf-init-args=-upgrade + - id: terraform_tfsec + exclude: "test/" + - id: terraform_checkov + exclude: "test/" + args: + - --args=--baseline __GIT_WORKING_DIR__/.checkov.baseline + - repo: local + hooks: + - id: delete-checkov-baseline + name: Delete Checkov Baseline + entry: bash -c 'if [ -f baseline-created ]; then rm .checkov.baseline && rm baseline-created; fi' + language: system + stages: [commit] + pass_filenames: false + - repo: https://github.com/gitguardian/ggshield + rev: v1.21.0 + hooks: + - id: ggshield + language: python + stages: [commit] + args: [ 'secret', 'scan', 'pre-commit' ] + - repo: local + hooks: + - id: docs + name: docs + entry: make + args: [ 'docs' ] + language: system diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..be634ce --- /dev/null +++ b/Makefile @@ -0,0 +1,19 @@ +commit: docs validate + +docs: + terraform-docs --lockfile=false -c .terraform-docs.yml . + +init: + git submodule update --init --recursive + terraform init -upgrade + +lint: + terraform fmt --recursive + +tests: +# Super long timeout since this Makefile will be used in various repositories + cd test; go clean -testcache; go test -v -timeout 60m + +validate: lint + terraform init --upgrade + terraform validate