Skip to content

Commit 983879b

Browse files
github-actions[bot]github-actions[bot]
authored
Merge dependabot/go_modules/docs/adr/assets/ADR-003/examples/golang/go_modules-232a611e2d into dependabotCombined
2 parents dd543a7 + f719aef commit 983879b

File tree

13 files changed

+204
-21
lines changed

13 files changed

+204
-21
lines changed

‎.github/actions/create-lines-of-code-report/action.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ runs:
3232
run: zip lines-of-code-report.json.zip lines-of-code-report.json
3333
- name: "Upload CLOC report as an artefact"
3434
if: ${{ !env.ACT }}
35-
uses: actions/upload-artifact@v3
35+
uses: actions/upload-artifact@v4
3636
with:
3737
name: lines-of-code-report.json.zip
3838
path: ./lines-of-code-report.json.zip

‎.github/actions/scan-dependencies/action.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ runs:
3232
run: zip sbom-repository-report.json.zip sbom-repository-report.json
3333
- name: "Upload SBOM report as an artefact"
3434
if: ${{ !env.ACT }}
35-
uses: actions/upload-artifact@v3
35+
uses: actions/upload-artifact@v4
3636
with:
3737
name: sbom-repository-report.json.zip
3838
path: ./sbom-repository-report.json.zip
@@ -47,7 +47,7 @@ runs:
4747
run: zip vulnerabilities-repository-report.json.zip vulnerabilities-repository-report.json
4848
- name: "Upload vulnerabilities report as an artefact"
4949
if: ${{ !env.ACT }}
50-
uses: actions/upload-artifact@v3
50+
uses: actions/upload-artifact@v4
5151
with:
5252
name: vulnerabilities-repository-report.json.zip
5353
path: ./vulnerabilities-repository-report.json.zip

‎.github/actions/tfsec/action.yaml‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,13 @@ runs:
66
- name: "TFSec Scan - Components"
77
shell: bash
88
run: |
9-
for component in $(find infrastructure/terraform/components -mindepth 1 -type d); do
10-
scripts/terraform/tfsec.sh $component
11-
done
12-
- name: "TFSec Scan - Modules"
13-
shell: bash
14-
run: |
15-
for module in $(find infrastructure/terraform/modules -mindepth 1 -type d); do
16-
scripts/terraform/tfsec.sh $module
17-
done
9+
components_exit_code=0
10+
modules_exit_code=0
11+
12+
./scripts/terraform/tfsec.sh ./infrastructure/terraform/components || components_exit_code=$?
13+
./scripts/terraform/tfsec.sh ./infrastructure/terraform/modules || modules_exit_code=$?
14+
15+
if [ $components_exit_code -ne 0 ] || [ $modules_exit_code -ne 0 ]; then
16+
echo "One or more TFSec scans failed."
17+
exit 1
18+
fi

‎.github/workflows/scorecard.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ jobs:
5959
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
6060
# format to the repository Actions tab.
6161
- name: "Upload artifact"
62-
uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20
62+
uses: actions/upload-artifact@v4
6363
with:
6464
name: SARIF file
6565
path: results.sarif
@@ -68,6 +68,6 @@ jobs:
6868
# Upload the results to GitHub's code scanning dashboard (optional).
6969
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
7070
- name: "Upload to code-scanning"
71-
uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
71+
uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
7272
with:
7373
sarif_file: results.sarif

‎docs/adr/assets/ADR-003/examples/golang/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,4 @@ require (
77
github.com/golang-jwt/jwt v3.2.2+incompatible
88
)
99

10-
require golang.org/x/net v0.23.0 // indirect
10+
require golang.org/x/net v0.33.0 // indirect

‎docs/adr/assets/ADR-003/examples/golang/go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@ github.com/go-resty/resty/v2 v2.7.0/go.mod h1:9PWDzw47qPphMRFfhsyk0NnSgvluHcljSM
33
github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY=
44
github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
55
golang.org/x/net v0.0.0-20211029224645-99673261e6eb/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
6-
golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs=
7-
golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
6+
golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
7+
golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
88
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
99
golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
1010
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=

‎infrastructure/terraform/components/acct/iam_policy_github_deploy_overload.tf‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
resource "aws_iam_policy" "github_deploy_overload" {
2+
name = "${local.csi}-github-deploy-overload"
3+
description = "Overloads the github permission to perform build actions for services in this account"
4+
policy = data.aws_iam_policy_document.github_deploy.json
5+
}
6+
7+
resource "aws_iam_role_policy_attachment" "github_deploy_overload" {
8+
role = local.bootstrap.iam_github_deploy_role["name"]
9+
policy_arn = aws_iam_policy.github_deploy_overload.arn
10+
}
11+
12+
#tfsec:ignore:aws-iam-no-policy-wildcards Policy voilation expected for CI user role
13+
data "aws_iam_policy_document" "github_deploy" {
14+
statement {
15+
effect = "Allow"
16+
17+
actions = [
18+
"grafana:*",
19+
]
20+
resources = ["*"]
21+
}
22+
}

‎infrastructure/terraform/components/acct/locals_remote_state.tf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
locals {
2+
bootstrap = data.terraform_remote_state.bootstrap.outputs
3+
}
4+
5+
data "terraform_remote_state" "bootstrap" {
6+
backend = "s3"
7+
8+
config = {
9+
bucket = local.terraform_state_bucket
10+
11+
key = format(
12+
"%s/%s/%s/%s/bootstrap.tfstate",
13+
var.project,
14+
var.aws_account_id,
15+
"eu-west-2",
16+
"bootstrap"
17+
)
18+
19+
region = "eu-west-2"
20+
}
21+
}

‎infrastructure/terraform/components/examplecomponent/locals_remote_state.tf‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
locals {
2+
bootstrap = data.terraform_remote_state.bootstrap.outputs
3+
acct = data.terraform_remote_state.acct.outputs
4+
}
5+
6+
data "terraform_remote_state" "bootstrap" {
7+
backend = "s3"
8+
9+
config = {
10+
bucket = local.terraform_state_bucket
11+
12+
key = format(
13+
"%s/%s/%s/%s/bootstrap.tfstate",
14+
var.project,
15+
var.aws_account_id,
16+
"eu-west-2",
17+
"bootstrap"
18+
)
19+
20+
region = "eu-west-2"
21+
}
22+
}
23+
24+
data "terraform_remote_state" "acct" {
25+
backend = "s3"
26+
27+
config = {
28+
bucket = local.terraform_state_bucket
29+
30+
key = format(
31+
"%s/%s/%s/%s/acct.tfstate",
32+
var.project,
33+
var.aws_account_id,
34+
"eu-west-2",
35+
var.parent_acct_environment
36+
)
37+
38+
region = "eu-west-2"
39+
}
40+
}

‎infrastructure/terraform/components/examplecomponent/locals_tfscaffold.tf‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
locals {
2+
terraform_state_bucket = format(
3+
"%s-tfscaffold-%s-%s",
4+
var.project,
5+
var.aws_account_id,
6+
var.region,
7+
)
8+
9+
csi = replace(
10+
format(
11+
"%s-%s-%s",
12+
var.project,
13+
var.environment,
14+
var.component,
15+
),
16+
"_",
17+
"",
18+
)
19+
20+
# CSI for use in resources with a global namespace, i.e. S3 Buckets
21+
csi_global = replace(
22+
format(
23+
"%s-%s-%s-%s-%s",
24+
var.project,
25+
var.aws_account_id,
26+
var.region,
27+
var.environment,
28+
var.component,
29+
),
30+
"_",
31+
"",
32+
)
33+
34+
default_tags = merge(
35+
var.default_tags,
36+
{
37+
Project = var.project
38+
Environment = var.environment
39+
Component = var.component
40+
Group = var.group
41+
Name = local.csi
42+
},
43+
)
44+
}

0 commit comments

Comments
 (0)