Skip to content

Commit 95c0db7

Browse files
wildjameswildjames
authored
Merge pull request #2 from NHSDigital/add_cdk
New: [AEA-0000] - add cdk checks
2 parents 74f8431 + d561069 commit 95c0db7

File tree

2 files changed

+164
-34
lines changed

2 files changed

+164
-34
lines changed

‎.github/workflows/quality-checks.yml‎

Lines changed: 159 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -58,10 +58,65 @@ jobs:
5858
id: check_poetry
5959
run: |
6060
if [ -f pyproject.toml ] && grep -q '\[tool.poetry\]' pyproject.toml; then
61+
echo "****************"
62+
echo "Project uses poetry"
63+
echo "****************"
6164
echo "uses_poetry=true" >> $GITHUB_OUTPUT
6265
else
66+
echo "****************"
67+
echo "Project does not use poetry"
68+
echo "****************"
6369
echo "uses_poetry=false" >> $GITHUB_OUTPUT
6470
fi
71+
72+
- name: Check for SAM templates
73+
id: check_sam_templates
74+
run: |
75+
if [ -d "SAMtemplates" ]; then
76+
echo "****************"
77+
echo "Project has SAM templates"
78+
echo "****************"
79+
echo "sam_exists=true" >> $GITHUB_OUTPUT
80+
else
81+
echo "****************"
82+
echo "Project does not have SAM templates"
83+
echo "****************"
84+
echo "sam_exists=false" >> $GITHUB_OUTPUT
85+
fi
86+
87+
- name: Check for cloudformation templates
88+
id: check_cf_templates
89+
run: |
90+
if [ -d "cloudformation" ]; then
91+
echo "****************"
92+
echo "Project has cloudformation templates"
93+
echo "****************"
94+
echo "cf_exists=true" >> $GITHUB_OUTPUT
95+
else
96+
echo "****************"
97+
echo "Project does not have cloudformation templates"
98+
echo "****************"
99+
echo "cf_exists=false" >> $GITHUB_OUTPUT
100+
fi
101+
102+
- name: Check for cdk
103+
id: check_cdk
104+
run: |
105+
if [ -d "packages/cdk" ]; then
106+
echo "****************"
107+
echo "Project has cdk"
108+
echo "****************"
109+
echo "cdk_exists=true" >> $GITHUB_OUTPUT
110+
else
111+
echo "****************"
112+
echo "Project does not have cdk"
113+
echo "****************"
114+
echo "cdk_exists=false" >> $GITHUB_OUTPUT
115+
fi
116+
117+
- name: Check licenses (Makefile)
118+
run: |
119+
make check-licenses
65120
66121
- name: Check licenses (Python)
67122
if: steps.check_poetry.outputs.uses_poetry == 'true'
@@ -87,20 +142,6 @@ jobs:
87142
exit 1
88143
fi
89144
90-
- name: Generate and check SBOMs
91-
uses: NHSDigital/eps-action-sbom@v1
92-
with:
93-
node_version: ${{ inputs.node_version }}
94-
95-
- name: Upload SBOMs
96-
uses: actions/upload-artifact@v3
97-
with:
98-
name: SBOMS
99-
path: '**/*sbom*.json'
100-
101-
- name: Run linting for TypeScript and Python
102-
run: make lint
103-
104145
- name: actionlint
105146
uses: raven-actions/actionlint@v2
106147

@@ -113,35 +154,27 @@ jobs:
113154
node_modules
114155
.git
115156
116-
- name: Check for CloudFormation templates
117-
id: check_cfn_templates
118-
run: |
119-
if [ -d "cloudformation" ] || [ -d "SAMtemplates" ]; then
120-
echo "exists=true" >> $GITHUB_OUTPUT
121-
else
122-
echo "exists=false" >> $GITHUB_OUTPUT
123-
fi
124-
125-
- name: Install cfn-lint
126-
if: steps.check_cfn_templates.outputs.exists == 'true'
127-
run: pip install cfn-lint
128-
129157
- name: Run cfn-lint
130-
if: steps.check_cfn_templates.outputs.exists == 'true'
158+
if: steps.check_sam_templates.outputs.sam_exists == 'true' || steps.check_cf_templates.outputs.cf_exists == 'true'
131159
run: |
160+
pip install cfn-lint
132161
cfn-lint -I "cloudformation/**/*.y*ml" 2>&1 | awk '/Run scan/ { print } /^[EW][0-9]/ { print; getline; print }'
133162
cfn-lint -I "SAMtemplates/**/*.y*ml" 2>&1 | awk '/Run scan/ { print } /^[EW][0-9]/ { print; getline; print }'
134163
135164
- name: Run unit tests
136165
run: make test
137-
166+
167+
- name: Run cdk-synth
168+
if: steps.check_cdk.outputs.cdk_exists == 'true'
169+
run: |
170+
make cdk-synth
171+
138172
- name: Install AWS SAM CLI
139-
if: steps.check_cfn_templates.outputs.exists == 'true'
173+
if: steps.check_sam_templates.outputs.sam_exists == 'true'
140174
run: |
141175
pip install aws-sam-cli
142176
143-
- name: Run cfn-guard script
144-
if: steps.check_cfn_templates.outputs.exists == 'true'
177+
- name: Init cfn-guard
145178
run: |
146179
#!/usr/bin/env bash
147180
set -eou pipefail
@@ -156,6 +189,12 @@ jobs:
156189
157190
mkdir -p cfn_guard_output
158191
192+
- name: Run cfn-guard script for sam templates
193+
if: steps.check_sam_templates.outputs.sam_exists == 'true'
194+
run: |
195+
#!/usr/bin/env bash
196+
set -eou pipefail
197+
159198
declare -a rulesets=("ncsc" "ncsc-cafv3" "wa-Reliability-Pillar" "wa-Security-Pillar")
160199
for ruleset in "${rulesets[@]}"
161200
do
@@ -175,7 +214,39 @@ jobs:
175214
done < <(find ./SAMtemplates -name '*.y*ml' -print0)
176215
done
177216
178-
rm -rf /tmp/ruleset
217+
- name: Run cfn-guard script for cloudformation templates
218+
if: steps.check_cf_templates.outputs.cf_exists == 'true'
219+
run: |
220+
#!/usr/bin/env bash
221+
222+
declare -a rulesets=("ncsc" "ncsc-cafv3" "wa-Reliability-Pillar" "wa-Security-Pillar")
223+
for ruleset in "${rulesets[@]}"
224+
do
225+
echo "Checking all templates in cloudformation folder with ruleest $ruleset"
226+
227+
~/.guard/bin/cfn-guard validate \
228+
--data cloudformation \
229+
--rules "/tmp/ruleset/output/$ruleset.guard" \
230+
--show-summary fail \
231+
> "cfn_guard_output/cloudformation_$ruleset.txt"
232+
done
233+
234+
- name: Run cfn-guard script for cdk templates
235+
if: steps.check_cdk.outputs.cdk_exists == 'true'
236+
run: |
237+
#!/usr/bin/env bash
238+
239+
declare -a rulesets=("ncsc" "ncsc-cafv3" "wa-Reliability-Pillar" "wa-Security-Pillar")
240+
for ruleset in "${rulesets[@]}"
241+
do
242+
echo "Checking all templates in cdk.out folder with ruleest $ruleset"
243+
244+
~/.guard/bin/cfn-guard validate \
245+
--data cdk.out \
246+
--rules "/tmp/ruleset/output/$ruleset.guard" \
247+
--show-summary fail \
248+
> "cfn_guard_output/cdk.out_$ruleset.txt"
249+
done
179250
180251
- name: Show cfn-guard output
181252
if: failure()
@@ -193,3 +264,58 @@ jobs:
193264
env:
194265
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
195266
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
267+
268+
sbom_checks:
269+
runs-on: ubuntu-latest
270+
steps:
271+
- name: Checkout code
272+
uses: actions/checkout@v4
273+
with:
274+
ref: ${{ env.BRANCH_NAME }}
275+
fetch-depth: 0
276+
277+
# using git commit sha for version of action to ensure we have stable version
278+
- name: Install asdf
279+
uses: asdf-vm/actions/setup@05e0d2ed97b598bfce82fd30daf324ae0c4570e6
280+
with:
281+
asdf_branch: v0.14.1
282+
283+
- name: Cache asdf
284+
uses: actions/cache@v4
285+
with:
286+
path: |
287+
~/.asdf
288+
key: ${{ runner.os }}-asdf-${{ hashFiles('**/.tool-versions') }}
289+
restore-keys: |
290+
${{ runner.os }}-asdf-
291+
292+
- name: Install asdf dependencies in .tool-versions
293+
uses: asdf-vm/actions/install@05e0d2ed97b598bfce82fd30daf324ae0c4570e6
294+
with:
295+
asdf_branch: v0.14.1
296+
env:
297+
PYTHON_CONFIGURE_OPTS: --enable-shared
298+
299+
- name: Setting up .npmrc
300+
env:
301+
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
302+
run: |
303+
echo "//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}" >> ~/.npmrc
304+
echo "@nhsdigital:registry=https://npm.pkg.github.com" >> ~/.npmrc
305+
306+
- name: make install
307+
run: |
308+
make install
309+
310+
- name: Generate and check SBOMs
311+
uses: NHSDigital/[email protected]
312+
with:
313+
node_version: ${{ inputs.node_version }}
314+
315+
- name: Upload SBOMs
316+
uses: actions/upload-artifact@v3
317+
if: success() || failure()
318+
with:
319+
name: SBOMS
320+
path: '**/*sbom*.json'
321+

‎README.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,9 @@ A workflow to run the quality checks for EPS repositories. The steps executed by
66
- **Run Linting**
77
- **Run Unit Tests**
88
- **SonarCloud Scan**: Performs code analysis using SonarCloud to detect quality issues and vulnerabilities.
9-
- **Validate CloudFormation Templates** (*Conditional*): If CloudFormation or AWS SAM templates are present, runs `cfn-lint` and `cfn-guard` to validate templates against AWS best practices and security rules.
9+
- **Validate CloudFormation Templates** (*Conditional*): If CloudFormation, AWS SAM templates or CDK are present, runs `cfn-lint` (SAM and cloudformation only) and `cfn-guard` to validate templates against AWS best practices and security rules.
10+
- **CDK Synth** (*Conditional*): Runs `make cdk-synth` if packages/cdk folder exists
11+
- **Check Licenses**: Runs `make check-licenses`.
1012
- **Check Python Licenses** (*Conditional*): If the project uses Poetry, scans Python dependencies for incompatible licenses.
1113

1214
# Usage
@@ -24,6 +26,8 @@ In order to run, these `make` commands must be present. They may be mocked, if t
2426
- `install`
2527
- `lint`
2628
- `test`
29+
- `check-licenses`
30+
- `cdk-synth` - only needed if packages/cdk folder exists
2731

2832
## Environment variables
2933

0 commit comments

Comments
 (0)