Skip to content

Commit 1adac2b

Browse files
timirelandtimireland
authored
Merge branch 'main' into dependabot/pip/scripts/docker/examples/python/assets/hello_world/setuptools-70.0.0
2 parents 159e12b + dd543a7 commit 1adac2b

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

56 files changed

+738
-430
lines changed

‎.github/actions/setup/action.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
name: Make Config Action
2+
description: Install dependencies and execute make config
3+
4+
runs:
5+
using: composite
6+
steps:
7+
- name: Install dependencies and execute make config
8+
shell: bash
9+
run: |
10+
scripts/setup/setup.sh

‎.github/actions/tfsec/action.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
name: "TFSec Scan"
2+
description: "Scan HCL using TFSec"
3+
runs:
4+
using: "composite"
5+
steps:
6+
- name: "TFSec Scan - Components"
7+
shell: bash
8+
run: |
9+
for component in $(find infrastructure/terraform/components -mindepth 1 -type d); do
10+
scripts/terraform/tfsec.sh $component
11+
done
12+
- name: "TFSec Scan - Modules"
13+
shell: bash
14+
run: |
15+
for module in $(find infrastructure/terraform/modules -mindepth 1 -type d); do
16+
scripts/terraform/tfsec.sh $module
17+
done

‎.github/workflows/manual-combine-dependabot-prs.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: Combine Dependabot PRs
2+
3+
on:
4+
workflow_dispatch:
5+
6+
permissions:
7+
contents: write
8+
pull-requests: write
9+
checks: read
10+
11+
jobs:
12+
combine-prs:
13+
runs-on: ubuntu-latest
14+
15+
steps:
16+
- name: combine-prs
17+
id: combine-prs
18+
uses: github/[email protected]
19+
with:
20+
ci_required: false
21+
labels: dependencies
22+
pr_title: Combined Dependabot PRs
23+
combine_branch_name: dependabotCombined
24+
pr_body_header: Combined Dependabot PRs

‎.github/workflows/scheduled-repository-template-sync.yaml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: Repository Template Sync
2+
3+
on:
4+
schedule:
5+
- cron: '0 0 1 * *'
6+
workflow_dispatch:
7+
8+
permissions:
9+
contents: write
10+
pull-requests: write
11+
checks: read
12+
13+
jobs:
14+
update-external-repo:
15+
runs-on: ubuntu-latest
16+
17+
steps:
18+
- name: Check out the repository
19+
uses: actions/checkout@v4
20+
21+
- name: Check out external repository
22+
uses: actions/checkout@v4
23+
with:
24+
repository: NHSDigital/nhs-notify-repository-template
25+
path: nhs-notify-repository-template
26+
token: ${{ github.token }}
27+
28+
- name: Run syncronisation script
29+
run: |
30+
./scripts/githooks/sync-template-repo.sh
31+
rm -Rf ./nhs-notify-repository-template
32+
33+
- name: Create Pull Request
34+
if: ${{ !env.ACT }}
35+
uses: peter-evans/[email protected]
36+
with:
37+
token: ${{ secrets.GITHUB_TOKEN }}
38+
commit-message: Drift from template
39+
branch: scheduledTemplateRepositorySync
40+
delete-branch: true
41+
title: '[Template Sync] Drift from template-repository remediation'
42+
body: |
43+
# Resultant drift from repository template
44+
45+
## Who should respond to this PR?
46+
The team which owns the responsibility for this component repository. You may want to consult other contributors.
47+
48+
## How to progress this PR
49+
The repositories guardians should review the contents of the PR and decide how to proceed, you may wish to back-out certain changes or accept them from the upstream `nhsdigital/nhs-notify-repository-template` repository.
50+
51+
If there are changes you do not wish to see again, it is recommended you add exclusions to `scripts/config/.repository-template-sync-ignore`.
52+
labels: |
53+
template
54+
automation
55+
draft: false

‎.github/workflows/scorecard.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# This workflow uses actions that are not certified by GitHub. They are provided
2+
# by a third-party and are governed by separate terms of service, privacy
3+
# policy, and support documentation.
4+
5+
name: Scorecard supply-chain security
6+
on:
7+
# For Branch-Protection check. Only the default branch is supported. See
8+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
9+
branch_protection_rule:
10+
# To guarantee Maintained check is occasionally updated. See
11+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
12+
schedule:
13+
- cron: '15 22 * * 5'
14+
push:
15+
branches: [ "main" ]
16+
17+
# Declare default permissions as read only.
18+
permissions: read-all
19+
20+
jobs:
21+
analysis:
22+
name: Scorecard analysis
23+
runs-on: ubuntu-latest
24+
permissions:
25+
# Needed to upload the results to code-scanning dashboard.
26+
security-events: write
27+
# Needed to publish results and get a badge (see publish_results below).
28+
id-token: write
29+
# Uncomment the permissions below if installing in a private repository.
30+
# contents: read
31+
# actions: read
32+
33+
steps:
34+
- name: "Checkout code"
35+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
36+
with:
37+
persist-credentials: false
38+
39+
- name: "Run analysis"
40+
uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
41+
with:
42+
results_file: results.sarif
43+
results_format: sarif
44+
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
45+
# - you want to enable the Branch-Protection check on a *public* repository, or
46+
# - you are installing Scorecard on a *private* repository
47+
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
48+
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
49+
50+
# Public repositories:
51+
# - Publish results to OpenSSF REST API for easy access by consumers
52+
# - Allows the repository to include the Scorecard badge.
53+
# - See https://github.com/ossf/scorecard-action#publishing-results.
54+
# For private repositories:
55+
# - `publish_results` will always be set to `false`, regardless
56+
# of the value entered here.
57+
publish_results: false
58+
59+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
60+
# format to the repository Actions tab.
61+
- name: "Upload artifact"
62+
uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20
63+
with:
64+
name: SARIF file
65+
path: results.sarif
66+
retention-days: 5
67+
68+
# Upload the results to GitHub's code scanning dashboard (optional).
69+
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
70+
- name: "Upload to code-scanning"
71+
uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
72+
with:
73+
sarif_file: results.sarif

‎.github/workflows/stage-1-commit.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,15 +77,55 @@ jobs:
7777
fetch-depth: 0 # Full history is needed to compare branches
7878
- name: "Check English usage"
7979
uses: ./.github/actions/check-english-usage
80+
detect-terraform-changes:
81+
name: "Detect Terraform Changes"
82+
runs-on: ubuntu-latest
83+
outputs:
84+
terraform_changed: ${{ steps.check.outputs.terraform_changed }}
85+
steps:
86+
- name: "Checkout code"
87+
uses: actions/checkout@v4
88+
89+
- name: "Check for Terraform changes"
90+
id: check
91+
run: |
92+
git fetch origin main || true # Ensure you have the latest main branch
93+
CHANGED_FILES=$(git diff --name-only HEAD origin/main)
94+
echo "Changed files: $CHANGED_FILES"
95+
96+
if echo "$CHANGED_FILES" | grep -qE '\.tf$'; then
97+
echo "Terraform files have changed."
98+
echo "terraform_changed=true" >> $GITHUB_OUTPUT
99+
else
100+
echo "No Terraform changes detected."
101+
echo "terraform_changed=false" >> $GITHUB_OUTPUT
102+
fi
80103
lint-terraform:
81104
name: "Lint Terraform"
82105
runs-on: ubuntu-latest
83106
timeout-minutes: 2
107+
needs: detect-terraform-changes
108+
if: needs.detect-terraform-changes.outputs.terraform_changed == 'true'
84109
steps:
85110
- name: "Checkout code"
86111
uses: actions/checkout@v4
87112
- name: "Lint Terraform"
88113
uses: ./.github/actions/lint-terraform
114+
tfsec:
115+
name: "TFSec Scan"
116+
runs-on: ubuntu-latest
117+
timeout-minutes: 5
118+
needs: detect-terraform-changes
119+
if: needs.detect-terraform-changes.outputs.terraform_changed == 'true'
120+
steps:
121+
- name: "Checkout code"
122+
uses: actions/checkout@v4
123+
- name: "Setup ASDF"
124+
uses: asdf-vm/actions/setup@v3
125+
- name: "Perform Setup"
126+
uses: ./.github/actions/setup
127+
- name: "TFSec Scan"
128+
uses: ./.github/actions/tfsec
89129
count-lines-of-code:
90130
name: "Count lines of code"
91131
runs-on: ubuntu-latest

‎.tool-versions‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
# This file is for you! Please, updated to the versions agreed by your team.
2-
3-
terraform 1.9.1
4-
pre-commit 3.6.0
5-
nodejs 18.18.2
1+
act 0.2.64
62
gitleaks 8.18.4
3+
pre-commit 3.6.0
4+
terraform 1.9.2
5+
tfsec 1.28.10
6+
vale 3.6.0
77

88
# ==============================================================================
99
# The section below is reserved for Docker image versions.
@@ -17,7 +17,7 @@ gitleaks 8.18.4
1717
# docker/ghcr.io/nhs-england-tools/github-runner-image 20230909-321fd1e-rt@sha256:ce4fd6035dc450a50d3cbafb4986d60e77cb49a71ab60a053bb1b9518139a646 # SEE: https://github.com/nhs-england-tools/github-runner-image/pkgs/container/github-runner-image
1818
# docker/hadolint/hadolint 2.12.0-alpine@sha256:7dba9a9f1a0350f6d021fb2f6f88900998a4fb0aaf8e4330aa8c38544f04db42 # SEE: https://hub.docker.com/r/hadolint/hadolint/tags
1919
# docker/hashicorp/terraform 1.5.6@sha256:180a7efa983386a27b43657ed610e9deed9e6c3848d54f9ea9b6cb8a5c8c25f5 # SEE: https://hub.docker.com/r/hashicorp/terraform/tags
20-
# docker/jdkato/vale v2.29.7@sha256:5ccfac574231b006284513ac3e4e9f38833989d83f2a68db149932c09de85149 # SEE: https://hub.docker.com/r/jdkato/vale/tags
20+
# docker/jdkato/vale v3.6.0@sha256:0ef22c8d537f079633cfff69fc46f69a2196072f69cab1ab232e8a79a388e425 # SEE: https://hub.docker.com/r/jdkato/vale/tags
2121
# docker/koalaman/shellcheck latest@sha256:e40388688bae0fcffdddb7e4dea49b900c18933b452add0930654b2dea3e7d5c # SEE: https://hub.docker.com/r/koalaman/shellcheck/tags
2222
# docker/mstruebing/editorconfig-checker 2.7.1@sha256:dd3ca9ea50ef4518efe9be018d669ef9cf937f6bb5cfe2ef84ff2a620b5ddc24 # SEE: https://hub.docker.com/r/mstruebing/editorconfig-checker/tags
2323
# docker/sonarsource/sonar-scanner-cli 5.0.1@sha256:494ecc3b5b1ee1625bd377b3905c4284e4f0cc155cff397805a244dee1c7d575 # SEE: https://hub.docker.com/r/sonarsource/sonar-scanner-cli/tags

‎.vscode/settings.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
"**/CVS": true,
1010
"**/Thumbs.db": true,
1111
".devcontainer": true,
12-
".github": true,
12+
".github": false,
1313
".vscode": false
1414
}
1515
}

‎infrastructure/environments/dev/.gitkeep‎

Whitespace-only changes.

‎infrastructure/terraform/bin/terraform.sh‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
##
99
# Set Script Version
1010
##
11-
readonly script_ver="1.8.0";
11+
readonly script_ver="1.8.1";
1212

1313
##
1414
# Standardised failure function
@@ -399,13 +399,16 @@ fi;
399399
pushd "${component_path}";
400400
readonly component_name=$(basename ${component_path});
401401

402-
# Check for presence of tfenv (https://github.com/kamatama41/tfenv)
403-
# and a .terraform-version file. If both present, ensure required
404-
# version of terraform for this component is installed automagically.
405-
tfenv_bin="$(which tfenv 2>/dev/null)";
406-
if [[ -n "${tfenv_bin}" && -x "${tfenv_bin}" && -f .terraform-version ]]; then
407-
${tfenv_bin} install;
408-
fi;
402+
# install terraform
403+
# verify terraform version matches .tool-versions
404+
echo ${PWD}
405+
tool_version=$(grep "terraform " .tool-versions | cut -d ' ' -f 2)
406+
asdf plugin-add terraform && asdf install terraform "${tool_version}"
407+
current_version=$(terraform --version | head -n 1 | cut -d 'v' -f 2)
408+
409+
if [ -z "${current_version}" ] || [ "${current_version}" != "${tool_version}" ]; then
410+
error_and_die "Terraform version mismatch. Expected: ${tool_version}, Actual: ${current_version}"
411+
fi
409412

410413
# Regardless of bootstrapping or not, we'll be using this string.
411414
# If bootstrapping, we will fill it with variables,

0 commit comments

Comments
 (0)