From fe1a04e3a5b11a8e3c68d95ba7286675707e1b89 Mon Sep 17 00:00:00 2001 From: Honest Bot Date: Fri, 24 Nov 2023 05:52:33 +0000 Subject: [PATCH] chore: synced file(s) with honestbank/.github --- .checkov.yaml | 2 ++ .github/pull_request_template.md | 8 ++++++- .github/workflows/checkov.yaml | 27 ++++++++++++++++++++++++ .github/workflows/semantic-pr.yaml | 22 ++++++++++--------- .pre-commit-config.yaml | 34 +++++++++++++++++++----------- Makefile | 30 ++++++++++++-------------- 6 files changed, 83 insertions(+), 40 deletions(-) create mode 100644 .github/workflows/checkov.yaml diff --git a/.checkov.yaml b/.checkov.yaml index 17517ac..28b0676 100644 --- a/.checkov.yaml +++ b/.checkov.yaml @@ -10,3 +10,5 @@ quiet: true skip-path: - .external_modules - modules + - catalog-info.yml +baseline: .checkov.baseline diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index a178f2c..039f966 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -6,7 +6,7 @@ --> -## Pull Request Submission Checklist +### Pull Request Submission Checklist Please confirm that you have done the following before requesting reviews: @@ -17,3 +17,9 @@ Please confirm that you have done the following before requesting reviews: ### Description * + +### Experiment Link + + + +GrowthBook Experiment Link: https://app.growthbook.io/features/ diff --git a/.github/workflows/checkov.yaml b/.github/workflows/checkov.yaml new file mode 100644 index 0000000..1cbe949 --- /dev/null +++ b/.github/workflows/checkov.yaml @@ -0,0 +1,27 @@ +# yamllint disable rule:line-length +# Use template from https://github.com/honestbank/workflows/tree/main/examples/repository-workflows +--- +name: "repository-checkov" +permissions: read-all + +on: # yamllint disable-line rule:truthy + pull_request: + branches: + - test + - dev + - qa + - prod + - main + push: + branches: + - test + - dev + - qa + - prod + - main + +jobs: + repository-checkov: + name: repository-checkov + uses: honestbank/workflows/.github/workflows/shared-checkov.yaml@main + secrets: inherit diff --git a/.github/workflows/semantic-pr.yaml b/.github/workflows/semantic-pr.yaml index 8b16bae..332f9bd 100644 --- a/.github/workflows/semantic-pr.yaml +++ b/.github/workflows/semantic-pr.yaml @@ -1,7 +1,13 @@ -name: "Semantic Pull Request" +# DO NOT CHANGE. This file is being managed from a central repository +# To know more simply visit https://github.com/honestbank/.github/blob/main/docs/about.md + +# yamllint disable rule:line-length +# Use template from https://github.com/honestbank/workflows/tree/main/examples/repository-workflows +--- +name: "repository-semantic-pr" permissions: read-all -on: +on: # yamllint disable-line rule:truthy pull_request: types: - opened @@ -9,11 +15,7 @@ on: - synchronize jobs: - main: - name: Semantic Pull Request - runs-on: ubuntu-latest - steps: - - uses: amannn/action-semantic-pull-request@v4 - name: Semantic Pull Request - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + repository-semantic-pr: + name: repository-semantic-pr + uses: honestbank/workflows/.github/workflows/shared-semantic-pr.yaml@main + secrets: inherit diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 5a55de0..13d71b6 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -6,27 +6,37 @@ repos: - repo: https://github.com/pre-commit/pre-commit-hooks - rev: v4.4.0 # Get the latest from: https://github.com/pre-commit/pre-commit-hooks/releases + rev: v4.5.0 # Get the latest from: https://github.com/pre-commit/pre-commit-hooks/releases hooks: - id: trailing-whitespace - id: end-of-file-fixer - id: check-yaml - id: check-added-large-files + - id: detect-aws-credentials + args: ['--allow-missing-credentials'] - repo: https://github.com/antonbabenko/pre-commit-terraform - rev: v1.83.2 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases + rev: v1.83.5 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases hooks: - id: terraform_fmt - - id: terraform_docs - id: terraform_validate - exclude: (test/|examples/) + args: + - --hook-config=--retry-once-with-cleanup=true + - --tf-init-args=-upgrade - id: terraform_tfsec - exclude: (test/|examples/) + exclude: "test/" - id: terraform_checkov - exclude: (test/|examples/) - - repo: https://github.com/gitguardian/ggshield - rev: v1.18.1 # Update to latest version by running `pre-commit autoupdate` + exclude: "test/" + - repo: https://github.com/gitguardian/ggshield + rev: v1.20.0 + hooks: + - id: ggshield + language: python + stages: [commit] + args: [ 'secret', 'scan', 'pre-commit' ] + - repo: local hooks: - - id: ggshield - language: python - stages: [commit] - args: [ 'secret', 'scan', 'pre-commit' ] + - id: docs + name: docs + entry: make + args: [ 'docs' ] + language: system diff --git a/Makefile b/Makefile index 19da8b5..be634ce 100644 --- a/Makefile +++ b/Makefile @@ -1,23 +1,19 @@ -lint: - terraform fmt --recursive - -validate: lint - cd examples/create_mysql_instance_with_public_ip/; terraform init --upgrade; terraform validate - cd examples/create_mysql_instance_with_private_ip/; terraform init --upgrade; terraform validate - cd examples/mysql_instance_with_read_replica/; terraform init --upgrade; terraform validate - cd examples/postgres_instance_with_read_replica/; terraform init --upgrade; terraform validate +commit: docs validate docs: - terraform-docs -c .terraform-docs.yml . - cd examples/create_mysql_instance_with_public_ip/; terraform-docs markdown . --output-file README.md --output-mode inject - cd examples/create_mysql_instance_with_private_ip/; terraform-docs markdown . --output-file README.md --output-mode inject - cd examples/mysql_instance_with_read_replica/; terraform-docs markdown . --output-file README.md --output-mode inject - cd examples/postgres_instance_with_read_replica/; terraform-docs markdown . --output-file README.md --output-mode inject + terraform-docs --lockfile=false -c .terraform-docs.yml . -commit: docs validate +init: + git submodule update --init --recursive + terraform init -upgrade -apply_and_destroy: - terraform apply -auto-approve && terraform apply -auto-approve -destroy +lint: + terraform fmt --recursive tests: - cd test; go clean -testcache; ./test.sh +# Super long timeout since this Makefile will be used in various repositories + cd test; go clean -testcache; go test -v -timeout 60m + +validate: lint + terraform init --upgrade + terraform validate