Skip to content

Commit d51afb0

Browse files
kvinwangkvinwang
authored
Merge pull request #49 from Dstack-TEE/devex
Enhanced developer experience
2 parents af88222 + 909262c commit d51afb0

File tree

19 files changed

+1127
-69
lines changed

19 files changed

+1127
-69
lines changed

‎.github/workflows/security-scan.yml‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
name: Security Scan
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
schedule:
9+
# Run security scan weekly
10+
- cron: '0 2 * * 1'
11+
12+
jobs:
13+
basic-checks:
14+
runs-on: ubuntu-latest
15+
name: Basic Checks (dev.sh)
16+
steps:
17+
- uses: actions/checkout@v4
18+
19+
- name: Install dependencies
20+
run: |
21+
# Install shellcheck
22+
sudo apt-get update
23+
sudo apt-get install -y shellcheck
24+
25+
# Install yamllint
26+
pip install yamllint
27+
28+
- name: Run all checks
29+
run: ./dev.sh check-all
30+
31+
advanced-security:
32+
runs-on: ubuntu-latest
33+
name: Advanced Security Scans
34+
permissions:
35+
actions: read
36+
contents: read
37+
security-events: write
38+
steps:
39+
- uses: actions/checkout@v4
40+
with:
41+
fetch-depth: 0
42+
43+
- name: Run TruffleHog OSS
44+
uses: trufflesecurity/trufflehog@main
45+
with:
46+
path: ./
47+
base: main
48+
head: HEAD
49+
extra_args: --debug --only-verified
50+
51+
- name: Find and scan Dockerfiles
52+
run: |
53+
# Find all Dockerfiles and run hadolint on each
54+
dockerfiles=$(find . -name "Dockerfile*" -type f | grep -v node_modules | grep -v .git)
55+
if [ -n "$dockerfiles" ]; then
56+
echo "Found Dockerfiles:"
57+
echo "$dockerfiles"
58+
# Run hadolint on all found Dockerfiles
59+
docker run --rm -i hadolint/hadolint:latest-debian hadolint --format sarif - < <(cat $dockerfiles) > hadolint-results.sarif || true
60+
else
61+
echo "No Dockerfiles found"
62+
echo '{"version": "2.1.0", "runs": []}' > hadolint-results.sarif
63+
fi
64+
65+
- name: Upload Hadolint results
66+
uses: github/codeql-action/upload-sarif@v3
67+
if: always()
68+
with:
69+
sarif_file: hadolint-results.sarif
70+
71+
- name: Initialize CodeQL
72+
uses: github/codeql-action/init@v3
73+
with:
74+
languages: python
75+
queries: security-and-quality
76+
77+
- name: Autobuild
78+
uses: github/codeql-action/autobuild@v3
79+
80+
- name: Perform CodeQL Analysis
81+
uses: github/codeql-action/analyze@v3
82+
with:
83+
category: "/language:python"
84+
85+
security-summary:
86+
runs-on: ubuntu-latest
87+
needs: [basic-checks, advanced-security]
88+
if: always()
89+
name: Security Summary
90+
91+
steps:
92+
- name: Security Scan Summary
93+
run: |
94+
echo "## Security Scan Results" >> $GITHUB_STEP_SUMMARY
95+
echo "" >> $GITHUB_STEP_SUMMARY
96+
97+
# Check job results
98+
basic_result="${{ needs.basic-checks.result }}"
99+
advanced_result="${{ needs.advanced-security.result }}"
100+
101+
echo "| Security Check | Status |" >> $GITHUB_STEP_SUMMARY
102+
echo "|----------------|--------|" >> $GITHUB_STEP_SUMMARY
103+
echo "| Basic Checks (dev.sh) | $basic_result |" >> $GITHUB_STEP_SUMMARY
104+
echo "| Advanced Security | $advanced_result |" >> $GITHUB_STEP_SUMMARY
105+
echo "" >> $GITHUB_STEP_SUMMARY
106+
107+
# Overall status
108+
if [[ "$basic_result $advanced_result" == *"failure"* ]]; then
109+
echo "🔴 **Security issues detected!** Please review the scan results." >> $GITHUB_STEP_SUMMARY
110+
else
111+
echo "🟢 **All security scans passed successfully.**" >> $GITHUB_STEP_SUMMARY
112+
fi

‎.github/workflows/validate-examples.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
name: Validate Examples
2+
3+
on:
4+
push:
5+
branches: [main, develop]
6+
pull_request:
7+
branches: [main, develop]
8+
schedule:
9+
# Run weekly to catch dependency issues
10+
- cron: '0 0 * * 0'
11+
12+
jobs:
13+
check-all:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- uses: actions/checkout@v4
17+
18+
- name: Install dependencies
19+
run: |
20+
# Install shellcheck
21+
sudo apt-get update
22+
sudo apt-get install -y shellcheck
23+
24+
# Install yamllint
25+
pip install yamllint
26+
27+
- name: Run all checks
28+
run: ./dev.sh check-all
29+
30+
- name: Create summary
31+
if: always()
32+
run: |
33+
echo "## Validation Summary" >> $GITHUB_STEP_SUMMARY
34+
echo "" >> $GITHUB_STEP_SUMMARY
35+
echo "✅ Ran comprehensive checks including:" >> $GITHUB_STEP_SUMMARY
36+
echo "- Structure validation for all examples" >> $GITHUB_STEP_SUMMARY
37+
echo "- Docker Compose syntax validation" >> $GITHUB_STEP_SUMMARY
38+
echo "- Security scanning" >> $GITHUB_STEP_SUMMARY
39+
echo "- Shell script linting" >> $GITHUB_STEP_SUMMARY
40+
echo "- YAML linting" >> $GITHUB_STEP_SUMMARY

‎.yamlfmt‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
formatter:
2+
type: basic
3+
retain_line_breaks: true
4+
trim_trailing_whitespace: true
5+
scan_folded_as_literal: true
6+
include_document_start: false
7+
line_ending: lf
8+
indent: 2

‎.yamllint‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
# yamllint configuration for dstack-examples
3+
4+
extends: default
5+
6+
rules:
7+
# Don't require document start marker (---)
8+
document-start: disable
9+
10+
# Reasonable line length for docker-compose files
11+
line-length:
12+
max: 160
13+
level: warning
14+
15+
# Allow both styles of bracketed lists
16+
brackets:
17+
min-spaces-inside: 0
18+
max-spaces-inside: 1
19+
20+
# Be flexible with truthy values (yes, true, on, etc.)
21+
truthy:
22+
allowed-values: ['true', 'false', 'yes', 'no', 'on', 'off']
23+
24+
# Don't be too strict about comments
25+
comments:
26+
min-spaces-from-content: 1
27+
28+
# Allow empty values which are common in docker-compose
29+
empty-values: enable

‎CODE_OF_CONDUCT.md‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
# Contributor Covenant Code of Conduct
2+
3+
## Our Pledge
4+
5+
We as members, contributors, and leaders pledge to make participation in our
6+
community a harassment-free experience for everyone, regardless of age, body
7+
size, visible or invisible disability, ethnicity, sex characteristics, gender
8+
identity and expression, level of experience, education, socio-economic status,
9+
nationality, personal appearance, race, religion, or sexual identity
10+
and orientation.
11+
12+
We pledge to act and interact in ways that contribute to an open, welcoming,
13+
diverse, inclusive, and healthy community.
14+
15+
## Our Standards
16+
17+
Examples of behavior that contributes to a positive environment for our
18+
community include:
19+
20+
* Demonstrating empathy and kindness toward other people
21+
* Being respectful of differing opinions, viewpoints, and experiences
22+
* Giving and gracefully accepting constructive feedback
23+
* Accepting responsibility and apologizing to those affected by our mistakes,
24+
and learning from the experience
25+
* Focusing on what is best not just for us as individuals, but for the
26+
overall community
27+
28+
Examples of unacceptable behavior include:
29+
30+
* The use of sexualized language or imagery, and sexual attention or
31+
advances of any kind
32+
* Trolling, insulting or derogatory comments, and personal or political attacks
33+
* Public or private harassment
34+
* Publishing others' private information, such as a physical or email
35+
address, without their explicit permission
36+
* Other conduct which could reasonably be considered inappropriate in a
37+
professional setting
38+
39+
## Enforcement Responsibilities
40+
41+
Community leaders are responsible for clarifying and enforcing our standards of
42+
acceptable behavior and will take appropriate and fair corrective action in
43+
response to any behavior that they deem inappropriate, threatening, offensive,
44+
or harmful.
45+
46+
Community leaders have the right and responsibility to remove, edit, or reject
47+
comments, commits, code, wiki edits, issues, and other contributions that are
48+
not aligned to this Code of Conduct, and will communicate reasons for moderation
49+
decisions when appropriate.
50+
51+
## Scope
52+
53+
This Code of Conduct applies within all community spaces, and also applies when
54+
an individual is officially representing the community in public spaces.
55+
Examples of representing our community include using an official e-mail address,
56+
posting via an official social media account, or acting as an appointed
57+
representative at an online or offline event.
58+
59+
## Enforcement
60+
61+
Instances of abusive, harassing, or otherwise unacceptable behavior may be
62+
reported to the community leaders responsible for enforcement at
63+
[email protected].
64+
All complaints will be reviewed and investigated promptly and fairly.
65+
66+
All community leaders are obligated to respect the privacy and security of the
67+
reporter of any incident.
68+
69+
## Enforcement Guidelines
70+
71+
Community leaders will follow these Community Impact Guidelines in determining
72+
the consequences for any action they deem in violation of this Code of Conduct:
73+
74+
### 1. Correction
75+
76+
**Community Impact**: Use of inappropriate language or other behavior deemed
77+
unprofessional or unwelcome in the community.
78+
79+
**Consequence**: A private, written warning from community leaders, providing
80+
clarity around the nature of the violation and an explanation of why the
81+
behavior was inappropriate. A public apology may be requested.
82+
83+
### 2. Warning
84+
85+
**Community Impact**: A violation through a single incident or series
86+
of actions.
87+
88+
**Consequence**: A warning with consequences for continued behavior. No
89+
interaction with the people involved, including unsolicited interaction with
90+
those enforcing the Code of Conduct, for a specified period of time. This
91+
includes avoiding interactions in community spaces as well as external channels
92+
like social media. Violating these terms may lead to a temporary or
93+
permanent ban.
94+
95+
### 3. Temporary Ban
96+
97+
**Community Impact**: A serious violation of community standards, including
98+
sustained inappropriate behavior.
99+
100+
**Consequence**: A temporary ban from any sort of interaction or public
101+
communication with the community for a specified period of time. No public or
102+
private interaction with the people involved, including unsolicited interaction
103+
with those enforcing the Code of Conduct, is allowed during this period.
104+
Violating these terms may lead to a permanent ban.
105+
106+
### 4. Permanent Ban
107+
108+
**Community Impact**: Demonstrating a pattern of violation of community
109+
standards, including sustained inappropriate behavior, harassment of an
110+
individual, or aggression toward or disparagement of classes of individuals.
111+
112+
**Consequence**: A permanent ban from any sort of public interaction within
113+
the community.
114+
115+
## Attribution
116+
117+
This Code of Conduct is adapted from the [Contributor Covenant][homepage],
118+
version 2.0, available at
119+
https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
120+
121+
Community Impact Guidelines were inspired by [Mozilla's code of conduct
122+
enforcement ladder](https://github.com/mozilla/diversity).
123+
124+
[homepage]: https://www.contributor-covenant.org
125+
126+
For answers to common questions about this code of conduct, see the FAQ at
127+
https://www.contributor-covenant.org/faq. Translations are available at
128+
https://www.contributor-covenant.org/translations.

0 commit comments

Comments
 (0)