Skip to content

Commit 8ad6a12

Browse files
jsf9kjsf9k
authored
Merge pull request #259 from cisagov/lineage/skeleton
⚠️ CONFLICT! Lineage pull request for: skeleton
2 parents 917b9bb + cdbe07c commit 8ad6a12

10 files changed

Lines changed: 246 additions & 117 deletions

File tree

‎.github/CODEOWNERS‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -3,22 +3,22 @@
33
# These owners will be the default owners for everything in the
44
# repo. Unless a later match takes precedence, these owners will be
55
# requested for review when someone opens a pull request.
6-
* @dav3r @felddy @IanLee1521 @jasonodoom @jsf9k @mcdonnnj
6+
* @dav3r @felddy @IanLee1521 @jsf9k @mcdonnnj
77

88
# These folks own any files in the .github directory at the root of
99
# the repository and any of its subdirectories.
10-
/.github/ @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
10+
/.github/ @dav3r @felddy @jsf9k @mcdonnnj
1111

1212
# These folks own all linting configuration files.
13-
/.ansible-lint @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
14-
/.bandit.yml @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
15-
/.flake8 @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
16-
/.isort.cfg @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
17-
/.mdl_config.yaml @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
18-
/.pre-commit-config.yaml @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
19-
/.prettierignore @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
20-
/.yamllint @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
21-
/requirements.txt @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
22-
/requirements-dev.txt @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
23-
/requirements-test.txt @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
24-
/setup-env @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
13+
/.ansible-lint @dav3r @felddy @jsf9k @mcdonnnj
14+
/.bandit.yml @dav3r @felddy @jsf9k @mcdonnnj
15+
/.flake8 @dav3r @felddy @jsf9k @mcdonnnj
16+
/.isort.cfg @dav3r @felddy @jsf9k @mcdonnnj
17+
/.mdl_config.yaml @dav3r @felddy @jsf9k @mcdonnnj
18+
/.pre-commit-config.yaml @dav3r @felddy @jsf9k @mcdonnnj
19+
/.prettierignore @dav3r @felddy @jsf9k @mcdonnnj
20+
/.yamllint @dav3r @felddy @jsf9k @mcdonnnj
21+
/requirements.txt @dav3r @felddy @jsf9k @mcdonnnj
22+
/requirements-dev.txt @dav3r @felddy @jsf9k @mcdonnnj
23+
/requirements-test.txt @dav3r @felddy @jsf9k @mcdonnnj
24+
/setup-env @dav3r @felddy @jsf9k @mcdonnnj

‎.github/dependabot.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,12 @@ updates:
1313
- dependency-name: actions/checkout
1414
- dependency-name: actions/setup-go
1515
- dependency-name: actions/setup-python
16+
- dependency-name: cisagov/setup-env-github-action
1617
- dependency-name: crazy-max/ghaction-dump-context
1718
- dependency-name: crazy-max/ghaction-github-labeler
1819
- dependency-name: crazy-max/ghaction-github-status
20+
- dependency-name: GitHubSecurityLab/actions-permissions
21+
- dependency-name: hashicorp/setup-packer
1922
- dependency-name: hashicorp/setup-terraform
2023
- dependency-name: mxschmitt/action-tmate
2124
- dependency-name: step-security/harden-runner

‎.github/workflows/build.yml‎

Lines changed: 73 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ defaults:
2020
shell: bash -Eueo pipefail -x {0}
2121

2222
env:
23-
CURL_CACHE_DIR: ~/.cache/curl
2423
PIP_CACHE_DIR: ~/.cache/pip
2524
PRE_COMMIT_CACHE_DIR: ~/.cache/pre-commit
2625
RUN_TMATE: ${{ secrets.RUN_TMATE }}
@@ -31,10 +30,18 @@ env:
3130
jobs:
3231
diagnostics:
3332
name: Run diagnostics
33+
# This job does not need any permissions
34+
permissions: {}
3435
runs-on: ubuntu-latest
3536
steps:
3637
# Note that a duplicate of this step must be added at the top of
3738
# each job.
39+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
40+
with:
41+
# Uses the organization variable unless overridden
42+
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
43+
# Note that a duplicate of this step must be added at the top of
44+
# each job.
3845
- id: harden-runner
3946
name: Harden the runner
4047
uses: step-security/harden-runner@v2
@@ -49,8 +56,15 @@ jobs:
4956
lint:
5057
needs:
5158
- diagnostics
59+
permissions:
60+
# actions/checkout needs this to fetch code
61+
contents: read
5262
runs-on: ubuntu-latest
5363
steps:
64+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
65+
with:
66+
# Uses the organization variable unless overridden
67+
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
5468
- id: harden-runner
5569
name: Harden the runner
5670
uses: step-security/harden-runner@v2
@@ -78,7 +92,7 @@ jobs:
7892
name: Lookup Go cache directory
7993
run: |
8094
echo "dir=$(go env GOCACHE)" >> $GITHUB_OUTPUT
81-
- uses: actions/cache@v3
95+
- uses: actions/cache@v4
8296
env:
8397
BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\
8498
py${{ steps.setup-python.outputs.python-version }}-\
@@ -103,25 +117,12 @@ jobs:
103117
path: |
104118
${{ env.PIP_CACHE_DIR }}
105119
${{ env.PRE_COMMIT_CACHE_DIR }}
106-
${{ env.CURL_CACHE_DIR }}
107120
${{ steps.go-cache.outputs.dir }}
108121
restore-keys: |
109122
${{ env.BASE_CACHE_KEY }}
110-
- name: Setup curl cache
111-
run: mkdir -p ${{ env.CURL_CACHE_DIR }}
112-
- name: Install Packer
113-
env:
114-
PACKER_VERSION: ${{ steps.setup-env.outputs.packer-version }}
115-
run: |
116-
PACKER_ZIP="packer_${PACKER_VERSION}_linux_amd64.zip"
117-
curl --output ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}" \
118-
--time-cond ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}" \
119-
--location \
120-
"https://releases.hashicorp.com/packer/${PACKER_VERSION}/${PACKER_ZIP}"
121-
sudo unzip -d /opt/packer \
122-
${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}"
123-
sudo mv /usr/local/bin/packer /usr/local/bin/packer-default
124-
sudo ln -s /opt/packer/packer /usr/local/bin/packer
123+
- uses: hashicorp/setup-packer@v3
124+
with:
125+
version: ${{ steps.setup-env.outputs.packer-version }}
125126
- uses: hashicorp/setup-terraform@v3
126127
with:
127128
terraform_version: ${{ steps.setup-env.outputs.terraform-version }}
@@ -177,18 +178,30 @@ jobs:
177178
name: test source - py${{ matrix.python-version }}
178179
needs:
179180
- diagnostics
180-
runs-on: ubuntu-latest
181+
permissions:
182+
# actions/checkout needs this to fetch code
183+
contents: read
184+
runs-on: ${{ matrix.os }}
181185
strategy:
182186
fail-fast: false
183187
matrix:
188+
include:
189+
- os: ubuntu-22.04
190+
python-version: "3.7"
191+
os:
192+
- ubuntu-latest
184193
python-version:
185-
- "3.7"
186194
- "3.8"
187195
- "3.9"
188196
- "3.10"
189197
# - "3.11"
190198
# - "3.12"
199+
# - "3.13"
191200
steps:
201+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
202+
with:
203+
# Uses the organization variable unless overridden
204+
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
192205
- id: harden-runner
193206
name: Harden the runner
194207
uses: step-security/harden-runner@v2
@@ -199,7 +212,7 @@ jobs:
199212
uses: actions/setup-python@v5
200213
with:
201214
python-version: ${{ matrix.python-version }}
202-
- uses: actions/cache@v3
215+
- uses: actions/cache@v4
203216
env:
204217
BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\
205218
py${{ steps.setup-python.outputs.python-version }}-"
@@ -234,11 +247,18 @@ jobs:
234247
uses: mxschmitt/action-tmate@v3
235248
if: env.RUN_TMATE
236249
coveralls-finish:
250+
permissions:
251+
# actions/checkout needs this to fetch code
252+
contents: read
237253
runs-on: ubuntu-latest
238254
needs:
239255
- diagnostics
240256
- test
241257
steps:
258+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
259+
with:
260+
# Uses the organization variable unless overridden
261+
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
242262
- id: harden-runner
243263
name: Harden the runner
244264
uses: step-security/harden-runner@v2
@@ -251,9 +271,9 @@ jobs:
251271
uses: actions/setup-python@v5
252272
with:
253273
# python-version: ${{ steps.setup-env.outputs.python-version }}
254-
# This project cannot currently support Python 3.11 or 3.12.
274+
# This project cannot currently support Python 3.11 or later.
255275
python-version: "3.10"
256-
- uses: actions/cache@v3
276+
- uses: actions/cache@v4
257277
env:
258278
BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\
259279
py${{ steps.setup-python.outputs.python-version }}-"
@@ -285,18 +305,30 @@ jobs:
285305
- diagnostics
286306
- lint
287307
- test
288-
runs-on: ubuntu-latest
308+
permissions:
309+
# actions/checkout needs this to fetch code
310+
contents: read
311+
runs-on: ${{ matrix.os }}
289312
strategy:
290313
fail-fast: false
291314
matrix:
315+
include:
316+
- os: ubuntu-22.04
317+
python-version: "3.7"
318+
os:
319+
- ubuntu-latest
292320
python-version:
293-
- "3.7"
294321
- "3.8"
295322
- "3.9"
296323
- "3.10"
297324
# - "3.11"
298325
# - "3.12"
326+
# - "3.13"
299327
steps:
328+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
329+
with:
330+
# Uses the organization variable unless overridden
331+
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
300332
- id: harden-runner
301333
name: Harden the runner
302334
uses: step-security/harden-runner@v2
@@ -307,7 +339,7 @@ jobs:
307339
uses: actions/setup-python@v5
308340
with:
309341
python-version: ${{ matrix.python-version }}
310-
- uses: actions/cache@v3
342+
- uses: actions/cache@v4
311343
env:
312344
BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\
313345
py${{ steps.setup-python.outputs.python-version }}-"
@@ -340,18 +372,30 @@ jobs:
340372
needs:
341373
- diagnostics
342374
- build
343-
runs-on: ubuntu-latest
375+
permissions:
376+
# actions/checkout needs this to fetch code
377+
contents: read
378+
runs-on: ${{ matrix.os }}
344379
strategy:
345380
fail-fast: false
346381
matrix:
382+
include:
383+
- os: ubuntu-22.04
384+
python-version: "3.7"
385+
os:
386+
- ubuntu-latest
347387
python-version:
348-
- "3.7"
349388
- "3.8"
350389
- "3.9"
351390
- "3.10"
352391
# - "3.11"
353392
# - "3.12"
393+
# - "3.13"
354394
steps:
395+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
396+
with:
397+
# Uses the organization variable unless overridden
398+
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
355399
- id: harden-runner
356400
name: Harden the runner
357401
uses: step-security/harden-runner@v2
@@ -362,7 +406,7 @@ jobs:
362406
uses: actions/setup-python@v5
363407
with:
364408
python-version: ${{ matrix.python-version }}
365-
- uses: actions/cache@v3
409+
- uses: actions/cache@v4
366410
env:
367411
BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\
368412
py${{ steps.setup-python.outputs.python-version }}-"

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,29 +22,39 @@ on:
2222
jobs:
2323
diagnostics:
2424
name: Run diagnostics
25+
# This job does not need any permissions
26+
permissions: {}
2527
runs-on: ubuntu-latest
2628
steps:
2729
# Note that a duplicate of this step must be added at the top of
2830
# each job.
31+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
32+
with:
33+
# Uses the organization variable unless overridden
34+
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
35+
# Note that a duplicate of this step must be added at the top of
36+
# each job.
2937
- id: harden-runner
3038
name: Harden the runner
3139
uses: step-security/harden-runner@v2
3240
with:
3341
egress-policy: audit
3442
- id: github-status
3543
name: Check GitHub status
36-
uses: crazy-max/ghaction-github-status@v3
44+
uses: crazy-max/ghaction-github-status@v4
3745
- id: dump-context
3846
name: Dump context
3947
uses: crazy-max/ghaction-dump-context@v2
4048
analyze:
4149
name: Analyze
4250
needs:
4351
- diagnostics
44-
runs-on: ubuntu-latest
4552
permissions:
53+
# actions/checkout needs this to fetch code
54+
contents: read
4655
# required for all workflows
4756
security-events: write
57+
runs-on: ubuntu-latest
4858
strategy:
4959
fail-fast: false
5060
matrix:
@@ -56,6 +66,10 @@ jobs:
5666
# https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
5767

5868
steps:
69+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
70+
with:
71+
# Uses the organization variable unless overridden
72+
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
5973
- id: harden-runner
6074
name: Harden the runner
6175
uses: step-security/harden-runner@v2

‎.github/workflows/sync-labels.yml‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,27 +4,36 @@ name: sync-labels
44
on:
55
push:
66
paths:
7-
- '.github/labels.yml'
8-
- '.github/workflows/sync-labels.yml'
7+
- .github/labels.yml
8+
- .github/workflows/sync-labels.yml
9+
workflow_dispatch:
910

1011
permissions:
1112
contents: read
1213

1314
jobs:
1415
diagnostics:
1516
name: Run diagnostics
17+
# This job does not need any permissions
18+
permissions: {}
1619
runs-on: ubuntu-latest
1720
steps:
1821
# Note that a duplicate of this step must be added at the top of
1922
# each job.
23+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
24+
with:
25+
# Uses the organization variable unless overridden
26+
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
27+
# Note that a duplicate of this step must be added at the top of
28+
# each job.
2029
- id: harden-runner
2130
name: Harden the runner
2231
uses: step-security/harden-runner@v2
2332
with:
2433
egress-policy: audit
2534
- id: github-status
2635
name: Check GitHub status
27-
uses: crazy-max/ghaction-github-status@v3
36+
uses: crazy-max/ghaction-github-status@v4
2837
- id: dump-context
2938
name: Dump context
3039
uses: crazy-max/ghaction-dump-context@v2
@@ -38,6 +47,10 @@ jobs:
3847
issues: write
3948
runs-on: ubuntu-latest
4049
steps:
50+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
51+
with:
52+
# Uses the organization variable unless overridden
53+
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
4154
- id: harden-runner
4255
name: Harden the runner
4356
uses: step-security/harden-runner@v2

0 commit comments

Comments
 (0)