Skip to content

Commit d2d3911

Browse files
kris-szlapakris-szlapa
committed
Initial commit
0 parents  commit d2d3911

28 files changed

+1594
-0
lines changed

‎.devcontainer /Dockerfile‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
FROM python:3.12 as python-base
2+
3+
4+
ENV PYTHONDONTWRITEBYTECODE 1 \
5+
PYTHONUNBUFFERED 1
6+
7+
RUN apt-get update \
8+
&& apt-get install curl -y \
9+
&& curl -sSL https://install.python-poetry.org | python
10+
11+
ENV PATH="/root/.local/bin:$PATH"
12+
13+
WORKDIR /usr/app
14+
15+
COPY pyproject.toml poetry.lock ./
16+
17+
RUN poetry config virtualenvs.create false \
18+
&& poetry install --no-dev --no-interaction --no-ansi
19+
20+
21+
22+
FROM python-base as eps-bot
23+
WORKDIR /app
24+
COPY slackbot/ .
25+
COPY eps_corpus.db eps_corpus.db
26+
27+
CMD [ "python3", "-u", "app.py"]

‎.devcontainer /devcontainer.json‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
// For format details, see https://aka.ms/devcontainer.json. For config options, see the
2+
// README at: https://github.com/devcontainers/templates/tree/main/src/ubuntu
3+
{
4+
"name": "Ubuntu",
5+
// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
6+
"build": {
7+
"dockerfile": "Dockerfile",
8+
"context": "..",
9+
"args": {}
10+
},
11+
"mounts": [
12+
"source=${env:HOME}${env:USERPROFILE}/.aws,target=/home/vscode/.aws,type=bind",
13+
"source=${env:HOME}${env:USERPROFILE}/.ssh,target=/home/vscode/.ssh,type=bind",
14+
"source=${env:HOME}${env:USERPROFILE}/.gnupg,target=/home/vscode/.gnupg,type=bind",
15+
"source=${env:HOME}${env:USERPROFILE}/.npmrc,target=/home/vscode/.npmrc,type=bind"
16+
],
17+
"features": {
18+
"ghcr.io/devcontainers/features/docker-outside-of-docker:1": {
19+
"version": "latest",
20+
"moby": "true",
21+
"installDockerBuildx": "true"
22+
}
23+
},
24+
"remoteEnv": { "LOCAL_WORKSPACE_FOLDER": "${localWorkspaceFolder}/" },
25+
"customizations": {
26+
"vscode": {
27+
"extensions": [
28+
"AmazonWebServices.aws-toolkit-vscode",
29+
"redhat.vscode-yaml",
30+
"ms-python.python",
31+
"ms-python.flake8",
32+
"eamodio.gitlens",
33+
"github.vscode-pull-request-github",
34+
"orta.vscode-jest",
35+
"42crunch.vscode-openapi",
36+
"mermade.openapi-lint",
37+
"dbaeumer.vscode-eslint",
38+
"christian-kohler.npm-intellisense",
39+
"dbaeumer.vscode-eslint",
40+
"lfm.vscode-makefile-term",
41+
"GrapeCity.gc-excelviewer",
42+
"redhat.vscode-xml",
43+
"streetsidesoftware.code-spell-checker",
44+
"timonwong.shellcheck",
45+
"mkhl.direnv",
46+
"github.vscode-github-actions"
47+
],
48+
"settings": {
49+
"python.defaultInterpreterPath": "/workspaces/eps-assist-me/.venv/bin/python",
50+
"python.analysis.autoSearchPaths": true,
51+
"python.analysis.extraPaths": [],
52+
"python.testing.unittestEnabled": false,
53+
"python.testing.pytestEnabled": true,
54+
"python.linting.pylintEnabled": false,
55+
"python.linting.flake8Enabled": true,
56+
"python.linting.enabled": true, // required to format on save
57+
"editor.defaultFormatter": "dbaeumer.vscode-eslint",
58+
"editor.formatOnPaste": false, // required
59+
"editor.formatOnType": false, // required
60+
"editor.formatOnSave": true, // optional
61+
"editor.formatOnSaveMode": "file",
62+
"cSpell.words": ["fhir", "Formik", "pino", "serialisation"],
63+
"eslint.useFlatConfig": true,
64+
"eslint.format.enable": true
65+
}
66+
}
67+
},
68+
"postCreateCommand": "rm -f ~/.docker/config.json; git config --global --add safe.directory /workspaces/eps-assist-me; make install; direnv allow ."
69+
// "features": {},
70+
// Use 'forwardPorts' to make a list of ports inside the container available locally.
71+
// "forwardPorts": [],
72+
// Use 'postCreateCommand' to run commands after the container is created.
73+
// "postCreateCommand": ""
74+
// Configure tool-specific properties.
75+
// "customizations": {},
76+
// Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
77+
// "remoteUser": "root"
78+
}

‎.github/actions/mark_jira_released/action.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: "Create confluence release notes"
2+
description: "Do release note actions in confluence and jira"
3+
inputs:
4+
RELEASE_TAG:
5+
required: false
6+
description: "The tag we are marking as released in jira"
7+
DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE:
8+
required: true
9+
description: "The role to assume to execute the release notes lambda"
10+
11+
runs:
12+
using: "composite"
13+
steps:
14+
- name: connect to dev account
15+
uses: aws-actions/configure-aws-credentials@v4
16+
with:
17+
aws-region: eu-west-2
18+
role-to-assume: ${{ inputs.DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE }}
19+
role-session-name: aws-dashboards-release-notes-run-lambda
20+
21+
- name: call markJiraReleased lambda
22+
shell: bash
23+
working-directory: .github/scripts
24+
env:
25+
RELEASE_TAG: ${{ inputs.RELEASE_TAG }}
26+
run: ./call_mark_jira_released.sh

‎.github/actions/update_confluence_jira/action.yml‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
name: "Create confluence release notes"
2+
description: "Do release note actions in confluence and jira"
3+
inputs:
4+
TARGET_ENVIRONMENT:
5+
required: true
6+
description: "Target Environment"
7+
RELEASE_TAG:
8+
required: false
9+
description: "The tag we are releasing - only used for create_rc_release_notes"
10+
CONFLUENCE_PAGE_ID:
11+
required: true
12+
description: "The id of confluence page to update or create under"
13+
CREATE_RC_RELEASE_NOTES:
14+
required: true
15+
description: "whether to create rc release notes page instead of normal release notes"
16+
default: "false"
17+
DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE:
18+
required: true
19+
description: "The role to assume to execute the release notes lambda"
20+
DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE:
21+
required: true
22+
description: "The dev cloud formation deploy role"
23+
TARGET_CLOUD_FORMATION_CHECK_VERSION_ROLE:
24+
required: true
25+
description: "The target cloud formation deploy role"
26+
27+
runs:
28+
using: "composite"
29+
steps:
30+
- name: connect to target account
31+
uses: aws-actions/configure-aws-credentials@v4
32+
with:
33+
aws-region: eu-west-2
34+
role-to-assume: ${{ inputs.TARGET_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
35+
role-session-name: cpt-api-release-notes-target
36+
37+
- name: Get deployed tag on target
38+
shell: bash
39+
working-directory: .github/scripts
40+
env:
41+
TARGET_ENVIRONMENT: ${{ inputs.TARGET_ENVIRONMENT }}
42+
run: ./get_target_deployed_tag.sh
43+
44+
- name: connect to dev account
45+
uses: aws-actions/configure-aws-credentials@v4
46+
with:
47+
aws-region: eu-west-2
48+
role-to-assume: ${{ inputs.DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
49+
role-session-name: cpt-api-release-notes-dev
50+
51+
- name: get current dev tag
52+
shell: bash
53+
working-directory: .github/scripts
54+
run: ./get_current_dev_tag.sh
55+
56+
- name: connect to dev account to run release notes lambda
57+
uses: aws-actions/configure-aws-credentials@v4
58+
with:
59+
aws-region: eu-west-2
60+
role-to-assume: ${{ inputs.DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE }}
61+
role-session-name: cpt-api-release-notes-run-lambda
62+
unset-current-credentials: true
63+
64+
- name: create int release notes
65+
shell: bash
66+
working-directory: .github/scripts
67+
if: inputs.TARGET_ENVIRONMENT == 'int' && inputs.CREATE_RC_RELEASE_NOTES == 'false'
68+
env:
69+
ENV: INT
70+
PAGE_ID: ${{ inputs.CONFLUENCE_PAGE_ID }}
71+
run: ./create_env_release_notes.sh
72+
73+
- name: create int rc release notes
74+
shell: bash
75+
working-directory: .github/scripts
76+
if: inputs.TARGET_ENVIRONMENT == 'int' && inputs.CREATE_RC_RELEASE_NOTES == 'true'
77+
env:
78+
RELEASE_TAG: ${{ inputs.RELEASE_TAG }}
79+
PAGE_ID: ${{ inputs.CONFLUENCE_PAGE_ID }}
80+
run: ./create_int_rc_release_notes.sh
81+
82+
- name: create prod release notes
83+
shell: bash
84+
working-directory: .github/scripts
85+
if: inputs.TARGET_ENVIRONMENT == 'prod'
86+
env:
87+
ENV: PROD
88+
PAGE_ID: ${{ inputs.CONFLUENCE_PAGE_ID }}
89+
run: ./create_env_release_notes.sh

‎.github/dependabot.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
#########################################################################
2+
# Dependabot configuration file
3+
#########################################################################
4+
5+
version: 2
6+
registries:
7+
npm-github:
8+
type: npm-registry
9+
url: https://npm.pkg.github.com
10+
token: ${{secrets.DEPENDABOT_TOKEN}}
11+
12+
updates:
13+
- package-ecosystem: "github-actions"
14+
# Workflow files stored in the
15+
# default location of `.github/workflows`
16+
directory: "/"
17+
open-pull-requests-limit: 20
18+
schedule:
19+
interval: "daily"
20+
commit-message:
21+
prefix: "Upgrade: [dependabot] - "
22+
23+
###################################
24+
# NPM workspace ##################
25+
###################################
26+
- package-ecosystem: "npm"
27+
directory: "/"
28+
schedule:
29+
interval: "daily"
30+
versioning-strategy: increase
31+
open-pull-requests-limit: 20
32+
commit-message:
33+
prefix: "Upgrade: [dependabot] - "
34+
registries:
35+
- npm-github
36+
37+
###################################
38+
# Poetry #########################
39+
###################################
40+
- package-ecosystem: "pip"
41+
directory: "/"
42+
schedule:
43+
interval: "daily"
44+
versioning-strategy: increase
45+
open-pull-requests-limit: 20
46+
commit-message:
47+
prefix: "Upgrade: [dependabot] - "

‎.github/pull_request_template.md‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
## Summary
2+
3+
**Remove items from this list if they are not relevant. Remove this line once this has been done**
4+
5+
- Routine Change
6+
- :exclamation: Breaking Change
7+
- :robot: Operational or Infrastructure Change
8+
- :sparkles: New Feature
9+
- :warning: Potential issues that might be caused by this change
10+
11+
### Details
12+
13+
Add any summary information of what is in the change. **Remove this line if you have nothing to add.**
14+
15+
## Pull Request Naming
16+
17+
Pull requests should be named using the following format:
18+
19+
```text
20+
Tag: [AEA-NNNN] - Short description
21+
```
22+
23+
Tag can be one of:
24+
25+
- `Fix` - for a bug fix. (Patch release)
26+
- `Update` - either for a backwards-compatible enhancement or for a rule change that adds reported problems. (Patch release)
27+
- `New` - implemented a new feature. (Minor release)
28+
- `Breaking` - for a backwards-incompatible enhancement or feature. (Major release)
29+
- `Docs` - changes to documentation only. (Patch release)
30+
- `Build` - changes to build process only. (No release)
31+
- `Upgrade` - for a dependency upgrade. (Patch release)
32+
- `Chore` - for refactoring, adding tests, etc. (anything that isn't user-facing). (Patch release)
33+
34+
If the current release is x.y.z then
35+
- a patch release increases z by 1
36+
- a minor release increases y by 1
37+
- a major release increases x by 1
38+
39+
Correct tagging is necessary for our automated versioning and release process.
40+
41+
The description of your pull request will be used as the commit message for the merge, and also be included in the changelog. Please ensure that your title is sufficiently descriptive.
42+
43+
### Rerunning Checks
44+
45+
If you need to rename your pull request, you can restart the checks by either:
46+
47+
- Closing and reopening the pull request
48+
- pushing an empty commit
49+
```bash
50+
git commit --allow-empty -m 'trigger build'
51+
git push
52+
```
53+
- Amend your last commit and force push to the branch
54+
```bash
55+
git commit --amend --no-edit
56+
git push --force
57+
```
58+
59+
Rerunning the checks from within the pull request will not use the updated title.

‎.github/scripts/call_mark_jira_released.sh‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/usr/bin/env bash
2+
3+
echo "calling mark jira released"
4+
5+
cat <<EOF > payload.json
6+
{
7+
"releaseVersion": "EPS-Assist-AWS-$RELEASE_TAG"
8+
}
9+
EOF
10+
cat payload.json
11+
12+
function_arn=$(aws cloudformation list-exports --query "Exports[?Name=='release-notes:MarkJiraReleasedLambdaArn'].Value" --output text)
13+
aws lambda invoke --function-name "${function_arn}" --cli-binary-format raw-in-base64-out --payload file://payload.json out.txt
14+
cat out.txt

‎.github/scripts/check-sbom-issues-against-ignores.sh‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
#!/bin/bash
2+
3+
# Usage: ./check-sbom-issues-against-ignores.sh <ignored_issues_file> <scan_results_file>
4+
IGNORED_ISSUES_FILE="$1"
5+
SCAN_RESULTS_FILE="$2"
6+
7+
# Check if files exist
8+
if [[ ! -f "$IGNORED_ISSUES_FILE" || ! -f "$SCAN_RESULTS_FILE" ]]; then
9+
echo "Error: One or both of the required files do not exist."
10+
exit 1
11+
fi
12+
13+
# Read ignored issues into an array
14+
mapfile -t IGNORED_ISSUES < <(jq -r '.[]' "$IGNORED_ISSUES_FILE")
15+
16+
# Read scan results and check for critical vulnerabilities
17+
CRITICAL_FOUND=false
18+
19+
# Loop through vulnerabilities in the scan results
20+
while IFS= read -r MATCH; do
21+
VULN_ID=$(echo "$MATCH" | jq -r '.vulnerability.id')
22+
23+
# Check if the vulnerability ID is in the ignored list
24+
FOUND=false
25+
for IGNORED in "${IGNORED_ISSUES[@]}"; do
26+
if [[ "$IGNORED" == "$VULN_ID" ]]; then
27+
FOUND=true
28+
echo "Warning: Ignored vulnerability found: $VULN_ID"
29+
break
30+
fi
31+
done
32+
33+
# If the vulnerability is not found in the ignored list, mark critical as found
34+
if [[ "$FOUND" == false ]]; then
35+
echo "Error: Critical vulnerability found that is not in the ignore list: $VULN_ID"
36+
CRITICAL_FOUND=true
37+
fi
38+
done < <(jq -c '.matches[] | select(.vulnerability.severity == "Critical")' "$SCAN_RESULTS_FILE")
39+
40+
# Exit with error if critical vulnerability is found
41+
if [[ "$CRITICAL_FOUND" == true ]]; then
42+
exit 1
43+
fi
44+
45+
echo "No unignored critical vulnerabilities found."
46+
exit 0

0 commit comments

Comments
 (0)