Skip to content

Commit aea40a0

Browse files
matt-mercermatt-mercer
authored
Initial commit
0 parents  commit aea40a0

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

81 files changed

+4705
-0
lines changed

‎.ansible-lint‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
parseable: true
2+
use_default_rules: true
3+
skip_list:
4+
- name[casing]
5+
- fqcn[action-core]
6+
- yaml[line-length]
7+
- var-naming[no-role-prefix]
8+
- name[template]

‎.dockerignore‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
.dockerignore
2+
.git/
3+
.idea
4+
.venv/
5+
.vscode/
6+
**/*.pyc
7+
**/__pycache__
8+
**/.venv
9+
dist/
10+
**/dist/
11+
build/
12+
**/build/
13+
.pytest_cache/
14+
**/.pytest_cache/
15+
.lock-hash
16+
poetry-cmd.sh
17+
.coverage
18+
.coverage-out/
19+
.mypy_cache/
20+
**/.mypy_cache/
21+
reports/
22+
resources/
23+
scripts/
24+
*.pem
25+
.behave.log

‎.gitallowed‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
.gitallowed:[0-9]+:.*
2+
.gitdisallowed:[0-9]+:.*
3+
.git/(?!COMMIT_EDITMSG|OTHERFILE)\w+:.*
4+
terraform/modules/account/s3.tf:[0-9]+:\s+"arn:aws:iam::652711504416:root"

‎.gitdisallowed‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8,12}/[a-zA-Z0-9_]{24}
2+
amzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}
3+
arn:aws:iam::0*[0-9][0-9]*
4+
ghp_[0-9a-zA-Z]{36}
5+
gho_[0-9a-zA-Z]{36}
6+
(ghu|ghs)_[0-9a-zA-Z]{36}
7+
ghr_[0-9a-zA-Z]{76}
8+
xox[baprs]-([0-9a-zA-Z]{10,48})?
9+
-----BEGIN\ ((EC|PGP|DSA|RSA|OPENSSH)\ )?PRIVATE KEY( BLOCK)?-----
10+
AIza[0-9A-Za-z\\-_]{35}
11+
'"type": "service_account"'
12+
[a-z]{2}-[a-z-]*-[1,2,3]\.rds\.amazonaws\.com
13+
[a-z]{2}-[a-z-]*-[1,2,3]\.es\.amazonaws\.com
14+
[a-z]*[1-3]\.cache\.amazonaws\.com
15+
-----BEGIN[[:blank:]]CERTIFICATE-----
16+
[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}
17+
(CLIENT|client|Client)(_|\s)(SECRET|secret|Secret)\s*(:|=>|=)\s*("|')?(\{)?[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\})?("|')?
18+
("|'?)[Pp][Aa][Ss][Ss][Ww][Oo][Rr][Dd]("|'?)\s*(=|:)\s*.+
19+
("|'?)[Tt][Oo][Kk][Ee][Nn]("|'?)\s*(=|:)\s*.+
20+
21+
###_NOTE_REMOVED_PREVIOUS_IP_RULE_:[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}###

‎.github/dependabot.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# To get started with Dependabot version updates, you'll need to specify which
2+
# package ecosystems to update and where the package manifests are located.
3+
# Please see the documentation for all configuration options:
4+
# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
5+
6+
version: 2
7+
updates:
8+
- package-ecosystem: "github-actions"
9+
directory: "/"
10+
open-pull-requests-limit: 2
11+
schedule:
12+
interval: "monthly"
13+
commit-message:
14+
prefix: "github actions "
15+
include: scope
16+
17+
- package-ecosystem: "pip"
18+
directory: "/" # Location of package manifests
19+
schedule:
20+
interval: "weekly"
21+
time: "08:00"
22+
23+
groups:
24+
dev-dependencies:
25+
patterns:
26+
- "ansible-lint"
27+
- "black"
28+
- "boto3"
29+
- "coverage"
30+
- "black"
31+
- "ipython"
32+
- "mypy"
33+
- "petname"
34+
- "pytest"
35+
- "pytest-*"
36+
- "ruff"
37+
- "types-*"

‎.github/workflows/merge-develop.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: odin-merge
2+
on:
3+
push:
4+
branches:
5+
- develop
6+
7+
env:
8+
ACCOUNT_ID: ${{ secrets.DEV_ACCOUNT_ID }}
9+
10+
jobs:
11+
12+
on-merge:
13+
uses: NHSDigital/odin-actions/.github/workflows/on-merge-pipeline.yml@v1
14+
with:
15+
repo-name: odin-template
16+
terraform-approvals: false
17+
18+
create-release:
19+
needs:
20+
- on-merge
21+
# - tests
22+
uses: NHSDigital/odin-actions/.github/workflows/on-merge-create-release.yml@v1
23+
with:
24+
repo-name: odin-template
25+
application: "replace-me"
26+
# stack: "main"
27+
on-merge-execution-id: "${{ needs.on-merge.outputs.on-merge-execution-id }}"

‎.github/workflows/pull-request.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: pull-request
2+
on:
3+
workflow_dispatch:
4+
pull_request:
5+
branches:
6+
- develop
7+
8+
env:
9+
ACCOUNT_ID: "${{ secrets.DEV_ACCOUNT_ID }}"
10+
11+
jobs:
12+
13+
lint:
14+
uses: NHSDigital/odin-actions/.github/workflows/standard-linting.yml@v1
15+
16+
validate-build:
17+
18+
runs-on:
19+
- codebuild-runner-odin-template-${{ github.run_id }}-${{ github.run_attempt }}
20+
- buildspec-override:true
21+
steps:
22+
23+
- name: checkout the calling repo
24+
uses: actions/checkout@v4
25+
with:
26+
fetch-depth: 0
27+
28+
- name: common build setup
29+
uses: NHSDigital/odin-actions/.github/actions/build-common@v1
30+
31+
- name: build artifacts
32+
id: build-artifacts
33+
uses: NHSDigital/odin-actions/.github/actions/build-artifacts@v1
34+
with:
35+
application: "replace-me"
36+
37+
# - name: terraform-plan
38+
# uses: NHSDigital/odin-actions/.github/actions/terraform-stack-plan-no-lock-codepipeline@v1
39+
# with:
40+
# application: "replace-me"
41+
# version: ${{ steps.build-artifacts.outputs.version }}
42+
43+
auto-merge-dependabot:
44+
needs:
45+
- lint
46+
- validate-build
47+
if: github.event.pull_request.user.login == 'dependabot[bot]'
48+
uses: NHSDigital/odin-actions/.github/workflows/dependabot-automation.yml@v1
49+
with:
50+
repo-name: "${{ github.repository }}"
51+
auto-approve: true
52+
auto-merge: true

‎.gitignore‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# IDE and various other developer tools
2+
.idea
3+
.ipynb_checkpoints
4+
*.swp
5+
6+
# Misc
7+
!.gitkeep
8+
*.orig
9+
.github-artifacts
10+
scanner
11+
.scannerwork
12+
docker-compose.override.yml
13+
.vscode/*.log
14+
coverage.xml
15+
.coverage.*
16+
docker/digests.yml
17+
18+
# Packaging
19+
build/
20+
dist/
21+
reports/
22+
23+
#Ansible
24+
*.retry
25+
.ansible/
26+
27+
# Python
28+
.env
29+
.venv
30+
venv
31+
*.pyc
32+
__pycache__
33+
.mypy_cache
34+
**/.pytest_cache/
35+
.python-version
36+
.coverage
37+
.coverage-out/
38+
requirements.txt
39+
**/requirements.txt
40+
.lock-hash
41+
42+
# Node
43+
node_modules/
44+
45+
# Terraform
46+
**/.terraform/*
47+
*.tfstate
48+
*.tfstate.*
49+
.terraform/
50+
.terraform.plan
51+
terraform.log
52+
.tfplan.out
53+
.tfplan.exit
54+
terraform/stacks/local/.terraform.lock.hcl
55+
terraform/**/external-vars.json
56+
terraform.d/
57+
58+
# certs/keys/pems
59+
*.crt
60+
*.csr
61+
*.key
62+
*.pem
63+
*.pfx
64+
*.srl*
65+
*.csr.cfg
66+
*id_rsa*
67+
68+
# mailbox passwords etc.
69+
*secrets.json
70+
71+
# Big binaries
72+
*.bz2
73+
*.gz
74+
*.jar
75+
*.tar.gz
76+
*.tgz
77+
*.zip

‎.pre-commit-config.yaml‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
fail_fast: false
2+
exclude: '^.venv/.*'
3+
default_install_hook_types: [pre-commit, pre-push, commit-msg, prepare-commit-msg]
4+
default_stages: [pre-commit]
5+
repos:
6+
- repo: https://github.com/pre-commit/pre-commit-hooks
7+
rev: v5.0.0
8+
hooks:
9+
- id: check-ast
10+
- id: check-toml
11+
- id: check-yaml
12+
exclude: |
13+
(?x)(^helm/.*/templates)
14+
- id: check-json
15+
- id: end-of-file-fixer
16+
- id: fix-byte-order-marker
17+
- id: trailing-whitespace
18+
- id: check-executables-have-shebangs
19+
- id: check-symlinks
20+
- id: destroyed-symlinks
21+
- id: mixed-line-ending
22+
- id: detect-aws-credentials
23+
- id: detect-private-key
24+
- id: fix-byte-order-marker
25+
- id: requirements-txt-fixer
26+
27+
- repo: local
28+
hooks:
29+
- id: black
30+
name: black
31+
entry: make black
32+
language: system
33+
types_or: [python, pyi, jupyter]
34+
pass_filenames: false
35+
- id: ruff
36+
name: ruff
37+
entry: make ruff
38+
language: system
39+
types_or: [python, pyi, jupyter]
40+
pass_filenames: false
41+
- id: mypy
42+
name: mypy
43+
entry: make mypy
44+
language: system
45+
types_or: [python, pyi, jupyter]
46+
pass_filenames: false
47+
- id: trivy
48+
name: trivy
49+
entry: make tf-trivy
50+
language: system
51+
files: \.tf(vars)?$
52+
pass_filenames: false
53+
- id: tf-format
54+
name: tf-format
55+
entry: make tf-format
56+
language: system
57+
files: (\.tf|\.tfvars)$
58+
exclude: \.terraform/.*$
59+
pass_filenames: false
60+
- id: tf-lint
61+
name: tf-lint
62+
entry: make tf-lint
63+
language: system
64+
files: (\.tf|\.tfvars)$
65+
exclude: \.terraform/.*$
66+
pass_filenames: false
67+
- id: shellcheck
68+
name: shellcheck
69+
entry: make shellcheck
70+
language: system
71+
files: (\.sh)$
72+
pass_filenames: false
73+
- id: ansible-lint
74+
name: ansible-lint
75+
entry: make ansible-lint
76+
language: system
77+
files: (.*/)?ansible/.*(\.yml)$
78+
pass_filenames: false
79+
- id: hadolint
80+
name: docker lint
81+
entry: make hadolint
82+
language: system
83+
files: (/Dockerfile)$
84+
pass_filenames: false
85+
- id: secrets
86+
name: git secrets
87+
entry: scripts/check-secrets.sh
88+
language: script
89+
pass_filenames: false
90+
- id: secrets-commit-msg
91+
name: git secrets check commit message
92+
entry: scripts/check-secrets.sh commit-msg
93+
language: system
94+
stages: [commit-msg]
95+
- id: secrets-prep-commit-msg
96+
name: git secrets pre check commit message
97+
entry: scripts/check-secrets.sh commit-msg
98+
language: system
99+
stages: [prepare-commit-msg]
100+
- id: commit-msg
101+
name: validate commit message contains a ticket
102+
language: pygrep
103+
entry: '(?i)\A(?!(odin|mesh|obs|spinecore)-[0-9]+)'
104+
args: [--multiline]
105+
stages: [commit-msg]
106+
types: [text]

‎.tflint.hcl‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
2+
plugin "aws" {
3+
enabled = true
4+
version = "0.37.0"
5+
source = "github.com/terraform-linters/tflint-ruleset-aws"
6+
}
7+
8+
config {
9+
plugin_dir = "~/.tflint.d/plugins"
10+
call_module_type = "local"
11+
ignore_module = {
12+
"does-not-work" = true
13+
}
14+
}

0 commit comments

Comments
 (0)