From dfa374c9f0291b7ed0a86cf2439e435485c32263 Mon Sep 17 00:00:00 2001 From: Honest Bot Date: Tue, 9 Jul 2024 08:09:06 +0000 Subject: [PATCH] ci: synced file(s) with honestbank/.github --- .github/CODEOWNERS | 5 ++++- .github/pull_request_template.md | 10 +++++++++ .github/workflows/checkov.yaml | 34 ++++++++++++++++++++++++++++++ .github/workflows/semantic-pr.yaml | 28 ++++++++++++++++++++++++ .github/workflows/terraform.yaml | 33 +++++++++++++++++++++++++++++ .github/workflows/terratest.yaml | 30 ++++++++++++++++++++++++++ 6 files changed, 139 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/checkov.yaml create mode 100644 .github/workflows/semantic-pr.yaml create mode 100644 .github/workflows/terraform.yaml create mode 100644 .github/workflows/terratest.yaml diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 16c3064..533728b 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,3 +1,6 @@ +# DO NOT CHANGE. This file is being managed from a central repository +# To know more simply visit https://github.com/honestbank/.github/blob/main/docs/about.md + # This is a comment. # Each line is a file pattern followed by one or more owners. @@ -5,4 +8,4 @@ # the repo. Unless a later match takes precedence, # @global-owner1 and @global-owner2 will be requested for # review when someone opens a pull request. -* @honestbank/devops-engineers @honestbank/honestbank-engineers +* @honestbank/devops-engineers diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 3d3a091..7e799e2 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -3,8 +3,18 @@ * All PRs should reference an issue in our issue tracker. If one doesn't exist, please create one! * PR titles should follow https://www.conventionalcommits.org. + --> +### Pull Request Submission Checklist + +Please confirm that you have done the following before requesting reviews: + +- [ ] I have confirmed that the PR type is appropriate for the change I am making according to the [Honest Pull Request and Commit Message Naming Conventions](https://www.notion.so/honestbank/Pull-Request-and-Commit-Message-Naming-Conventions-bd97f2cbb34c4c73b1ff3a3e384b850c). +- [ ] I have typed an adequate description that explains **why** I am making this change. +- [ ] I have installed and run standard pre-commit hooks that lints and validates my code. +- [ ] All entities that I am working with are up-to-date in Backstage; if updates are needed, I have linked the relevant PRs. [Backstage guide](https://www.notion.so/honestbank/How-to-Write-a-Backstage-Service-Catalog-Entry-a-catalog-info-yaml-file-21845ff72e404b14aed2ac989fb202cf?pvs=4) + ### Description * diff --git a/.github/workflows/checkov.yaml b/.github/workflows/checkov.yaml new file mode 100644 index 0000000..ccec113 --- /dev/null +++ b/.github/workflows/checkov.yaml @@ -0,0 +1,34 @@ +name: "Checkov GitHub Action" +permissions: read-all + +on: + pull_request: + branches: [test, dev, qa, prod, main] + +jobs: + checkov: + name: checkov + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v3 + with: + submodules: "recursive" + token: ${{ secrets.GITHUB_TOKEN }} + - name: Create empty baseline (if needed) + run: | + if [ -f .checkov.baseline ]; then + echo "⏩⏩⏩ Baseline file exists - do nothing." + else + echo "🆕🆕🆕 Baseline file does not exist - creating empty baseline file." + echo "{}" >> .checkov.baseline + fi + - name: Output baseline contents to console + run: | + echo "Checkov baseline file (.checkov.baseline) contents:" + cat .checkov.baseline + - name: Run Checkov + id: checkov + uses: bridgecrewio/checkov-action@master + with: + config_file: ".checkov.yaml" diff --git a/.github/workflows/semantic-pr.yaml b/.github/workflows/semantic-pr.yaml new file mode 100644 index 0000000..3627556 --- /dev/null +++ b/.github/workflows/semantic-pr.yaml @@ -0,0 +1,28 @@ +# yamllint disable rule:line-length +# Use template from https://github.com/honestbank/workflows/tree/main/examples/repository-workflows + +# Use this workflow for public repos, since public repos cannot access our internal +# workflows repo. +--- +name: public-semantic-pr +permissions: + contents: write + pull-requests: write + +on: + pull_request: + types: + - opened + - edited + - reopened + - synchronize + +jobs: + public-semantic-pr: + name: public-semantic-pr + runs-on: ubuntu-latest + steps: + - uses: amannn/action-semantic-pull-request@v4 + name: Semantic Pull Request + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/terraform.yaml b/.github/workflows/terraform.yaml new file mode 100644 index 0000000..cbdc29f --- /dev/null +++ b/.github/workflows/terraform.yaml @@ -0,0 +1,33 @@ +name: "Terraform GitHub Action" +on: + pull_request: + # This workflow is meant for public Terraform module repositories + # which are generally component modules that follow trunk-based development. + branches: [main] +jobs: + terraform: + name: "terraform" + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + submodules: "recursive" + - name: Set up Terraform + uses: hashicorp/setup-terraform@v3 + with: + cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }} + - name: Terraform Format + id: fmt + run: terraform fmt + continue-on-error: true + - name: Terraform Init + id: init + run: terraform init + - name: Terraform Validate + id: validate + run: terraform validate -no-color + - name: Terraform Plan + id: plan + run: terraform plan -no-color + continue-on-error: true diff --git a/.github/workflows/terratest.yaml b/.github/workflows/terratest.yaml new file mode 100644 index 0000000..05041b1 --- /dev/null +++ b/.github/workflows/terratest.yaml @@ -0,0 +1,30 @@ +name: "Terratest GitHub Action" +on: + pull_request: + branches: [test, dev, qa, prod, main] + push: + branches: [test, dev, qa, prod, main] +env: + AWS_ACCESS_KEY_ID: ${{ secrets.TERRATEST_AWS_ACCESS_KEY_ID }} + AWS_SECRET_KEY: ${{ secrets.TERRATEST_AWS_SECRET_ACCESS_KEY }} + AWS_DEFAULT_REGION: ${{ secrets.TERRATEST_AWS_REGION }} + AWS_REGION: ${{ secrets.TERRATEST_AWS_REGION }} +jobs: + terratest: + name: terratest + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + submodules: true + - name: Set up Go + uses: actions/setup-go@v5 + with: + go-version: 1.20 + id: go + - name: Run 'go test -v -timeout 60m' + run: | + cd test + go mod download + go test -v -timeout 30m