Skip to content

Commit 40d15a3

Browse files
m-houstonm-houston
committed
CCM-8881: Apply synced template repo changes
1 parent 8383fdb commit 40d15a3

File tree

15 files changed

+348
-74
lines changed

15 files changed

+348
-74
lines changed

‎.github/actions/lint-terraform/action.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,6 @@ inputs:
77
runs:
88
using: "composite"
99
steps:
10-
- uses: hashicorp/setup-terraform@v3
11-
- uses: asdf-vm/actions/setup@v3
1210
- name: "Check Terraform format"
1311
shell: bash
1412
run: |
@@ -18,5 +16,6 @@ runs:
1816
run: |
1917
stacks=${{ inputs.root-modules }}
2018
for dir in $(find infrastructure/environments -maxdepth 1 -mindepth 1 -type d; echo ${stacks//,/$'\n'}); do
19+
dir=$dir opts='-backend=false' make terraform-init
2120
dir=$dir make terraform-validate
2221
done

‎.github/actions/tfsec/action.yaml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,6 @@ description: "Scan HCL using TFSec"
33
runs:
44
using: "composite"
55
steps:
6-
- uses: hashicorp/setup-terraform@v3
7-
- uses: asdf-vm/actions/setup@v3
86
- name: "TFSec Scan - Components"
97
shell: bash
108
run: |

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
*sbom*report*.json
66
*vulnerabilities*report*.json
77
*report*json.zip
8+
version.json
89
.version
910

1011
*.code-workspace

‎infrastructure/terraform/bin/terraform.sh‎

Lines changed: 29 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
##
99
# Set Script Version
1010
##
11-
readonly script_ver="1.8.0";
11+
readonly script_ver="1.8.1";
1212

1313
##
1414
# Standardised failure function
@@ -399,13 +399,16 @@ fi;
399399
pushd "${component_path}";
400400
readonly component_name=$(basename ${component_path});
401401

402-
# Check for presence of tfenv (https://github.com/kamatama41/tfenv)
403-
# and a .terraform-version file. If both present, ensure required
404-
# version of terraform for this component is installed automagically.
405-
tfenv_bin="$(which tfenv 2>/dev/null)";
406-
if [[ -n "${tfenv_bin}" && -x "${tfenv_bin}" && -f .terraform-version ]]; then
407-
${tfenv_bin} install;
408-
fi;
402+
# install terraform
403+
# verify terraform version matches .tool-versions
404+
echo ${PWD}
405+
tool_version=$(grep "terraform " .tool-versions | cut -d ' ' -f 2)
406+
asdf plugin-add terraform && asdf install terraform "${tool_version}"
407+
current_version=$(terraform --version | head -n 1 | cut -d 'v' -f 2)
408+
409+
if [ -z "${current_version}" ] || [ "${current_version}" != "${tool_version}" ]; then
410+
error_and_die "Terraform version mismatch. Expected: ${tool_version}, Actual: ${current_version}"
411+
fi
409412

410413
# Regardless of bootstrapping or not, we'll be using this string.
411414
# If bootstrapping, we will fill it with variables,
@@ -536,26 +539,24 @@ fi;
536539
[ -f "${dynamic_file_path}" ] && tf_var_file_paths+=("${dynamic_file_path}");
537540

538541
# Warn on duplication
539-
if [ ${#tf_var_file_paths[@]} -gt 0 ]; then
540-
duplicate_variables="$(cat "${tf_var_file_paths[@]}" | sed -n -e 's/\(^[a-zA-Z0-9_\-]\+\)\s*=.*$/\1/p' | sort | uniq -d)";
541-
[ -n "${duplicate_variables}" ] \
542-
&& echo -e "
543-
###################################################################
544-
# WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING #
545-
###################################################################
546-
The following input variables appear to be duplicated:
547-
548-
${duplicate_variables}
549-
550-
This could lead to unexpected behaviour. Overriding of variables
551-
has previously been unpredictable and is not currently supported,
552-
but it may work.
553-
554-
Recent changes to terraform might give you useful overriding and
555-
map-merging functionality, please use with caution and report back
556-
on your successes & failures.
557-
###################################################################";
558-
fi
542+
duplicate_variables="$(cat "${tf_var_file_paths[@]}" | sed -n -e 's/\(^[a-zA-Z0-9_\-]\+\)\s*=.*$/\1/p' | sort | uniq -d)";
543+
[ -n "${duplicate_variables}" ] \
544+
&& echo -e "
545+
###################################################################
546+
# WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING #
547+
###################################################################
548+
The following input variables appear to be duplicated:
549+
550+
${duplicate_variables}
551+
552+
This could lead to unexpected behaviour. Overriding of variables
553+
has previously been unpredictable and is not currently supported,
554+
but it may work.
555+
556+
Recent changes to terraform might give you useful overriding and
557+
map-merging functionality, please use with caution and report back
558+
on your successes & failures.
559+
###################################################################";
559560

560561
# Build up the tfvars arguments for terraform command line
561562
for file_path in "${tf_var_file_paths[@]}"; do

‎scripts/config/.repository-template-sync-ignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,4 @@ scripts/config/sonar-scanner.properties
2121
*/examples/
2222
docs/
2323
infrastructure/terraform/components/
24+
docker/examples/

‎scripts/config/gitleaks.toml‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SEE: https://github.com/gitleaks/gitleaks/#configuration
2+
# Do not edit this file directly as it will be overwritten by changes from the nhs-notify-repository-template on next sync
23

34
[extend]
45
useDefault = true # SEE: https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml
@@ -16,4 +17,15 @@ regexes = [
1617
]
1718

1819
[allowlist]
19-
paths = ['''.terraform.lock.hcl''', '''poetry.lock''', '''yarn.lock''']
20+
paths = [
21+
'''.terraform.lock.hcl''',
22+
'''poetry.lock''',
23+
'''yarn.lock''',
24+
'''Gemfile.lock''',
25+
]
26+
27+
# Exclude Chrome version in user agent
28+
regexTarget = "line"
29+
regexes = [
30+
'''Chrome/[\d.]+'''
31+
]

‎scripts/config/pre-commit.yaml‎

Lines changed: 48 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,62 @@
11
repos:
2+
- repo: https://github.com/pre-commit/pre-commit-hooks
3+
rev: v4.6.0 # Use the ref you want to point at
4+
hooks:
5+
- id: trailing-whitespace
6+
- id: detect-aws-credentials
7+
args: [--allow-missing-credentials]
8+
- id: check-added-large-files
9+
- id: check-symlinks
10+
- id: detect-private-key
11+
- id: end-of-file-fixer
12+
exclude: .+\.cs
13+
- id: forbid-new-submodules
14+
- id: mixed-line-ending
15+
- id: pretty-format-json
16+
args: ['--autofix']
17+
# - id: ...
218
- repo: local
319
hooks:
4-
- id: scan-secrets
5-
name: Scan secrets
6-
entry: ./scripts/githooks/scan-secrets.sh
7-
args: ["check=staged-changes"]
8-
language: script
9-
pass_filenames: false
20+
- id: sort-dictionary
21+
name: Sort dictionary
22+
entry: ./scripts/githooks/sort-dictionary.sh
23+
language: script
24+
pass_filenames: false
1025
- repo: local
1126
hooks:
12-
- id: check-file-format
13-
name: Check file format
14-
entry: ./scripts/githooks/check-file-format.sh
15-
args: ["check=staged-changes"]
16-
language: script
17-
pass_filenames: false
27+
- id: scan-secrets
28+
name: Scan secrets
29+
entry: /usr/bin/env check=whole-history ./scripts/githooks/scan-secrets.sh
30+
language: script
31+
pass_filenames: false
1832
- repo: local
1933
hooks:
20-
- id: check-markdown-format
21-
name: Check Markdown format
22-
entry: ./scripts/githooks/check-markdown-format.sh
23-
args: ["check=staged-changes"]
24-
language: script
25-
pass_filenames: false
34+
- id: check-file-format
35+
name: Check file format
36+
entry: /usr/bin/env check=branch ./scripts/githooks/check-file-format.sh
37+
language: script
38+
pass_filenames: false
2639
- repo: local
2740
hooks:
28-
- id: check-english-usage
29-
name: Check English usage
30-
entry: ./scripts/githooks/check-english-usage.sh
31-
args: ["check=staged-changes"]
32-
language: script
33-
pass_filenames: false
41+
- id: check-markdown-format
42+
name: Check Markdown format
43+
entry: /usr/bin/env check=branch ./scripts/githooks/check-markdown-format.sh
44+
language: script
45+
pass_filenames: false
3446
- repo: local
3547
hooks:
36-
- id: lint-terraform
37-
name: Lint Terraform
38-
entry: ./scripts/githooks/check-terraform-format.sh
39-
language: script
40-
pass_filenames: false
48+
- id: check-english-usage
49+
name: Check English usage
50+
entry: /usr/bin/env check=branch ./scripts/githooks/check-english-usage.sh
51+
language: script
52+
pass_filenames: false
53+
- repo: local
54+
hooks:
55+
- id: lint-terraform
56+
name: Lint Terraform
57+
entry: ./scripts/githooks/check-terraform-format.sh
58+
language: script
59+
pass_filenames: false
4160
- repo: local
4261
hooks:
4362
- id: generate-terraform-docs

‎scripts/git-repo/auto-link.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# GitHub
2+
3+
## Auto link Protection Rules
4+
5+
This will create the auto link to Jira.
6+
7+
```sh
8+
./auto-link.sh $reponame $PAT
9+
```
10+
11+
PAT must have `administration:write`. [Create an auto link](https://docs.github.com/en/rest/repos/autolinks?apiVersion=2022-11-28#create-an-autolink-for-a-repository)

‎scripts/git-repo/auto-link.sh‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/bin/bash
2+
3+
curl -L \
4+
-X POST \
5+
-H "Accept: application/vnd.github+json" \
6+
-H "Authorization: Bearer $2" \
7+
-H "X-GitHub-Api-Version: 2022-11-28" \
8+
https://api.github.com/repos/NHSDigital/$1/autolinks \
9+
-d '{"key_prefix":"CCM-","url_template":" https://nhsd-jira.digital.nhs.uk/browse/CCM-<num>","is_alphanumeric":true}'

‎scripts/git-repo/branch-protection.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# GitHub
2+
3+
## Branch Protection Rules
4+
5+
This will create the default branch protection rules using GitHub API.
6+
7+
```sh
8+
./branch-protection.sh $reponame $PAT
9+
```
10+
11+
PAT must have `administration:write`. [Create a repository rule set](https://docs.github.com/en/rest/repos/rules?apiVersion=2022-11-28#create-a-repository-ruleset)

0 commit comments

Comments
 (0)