Skip to content

Commit 1eff5dd

Browse files
RalphHightowerRalphHightower
authored
[setup](build): Actions(@RalphHightower/blog)
Signed-off-by: Ralph Hightower <32745442+RalphHightower@users.noreply.github.com>
1 parent db0db86 commit 1eff5dd

18 files changed

+372
-125
lines changed

‎.github/workflows/GitHubActionPermissions.md‎

Lines changed: 2 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,3 @@
1-
---
2-
layout: post
3-
tags: []
4-
categories: []
5-
#date: 2019-06-25 13:14:15
6-
#excerpt: ''
7-
#image: 'BASEURL/assets/blog/img/.png'
8-
#description:
9-
#permalink:
10-
title: 'title'
11-
---
12-
13-
141
permissions:
152
actions: read|write|none
163
checks: read|write|none
@@ -21,4 +8,5 @@ permissions:
218
pull-requests: read|write|none
229
repository-projects: read|write|none
2310
security-events: read|write|none
24-
statuses: read|write|noner
11+
statuses: read|write|none
12+

‎.github/workflows/ci.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: ci.yml – Continuous Integration
2+
on:
3+
push:
4+
branches:
5+
- main
6+
pull_request:
7+
branches:
8+
- main
9+
permissions:
10+
contents: read
11+
12+
jobs:
13+
build:
14+
name: "Test with Jekyll ${{ matrix.jekyll }}"
15+
runs-on: "ubuntu-latest"
16+
strategy:
17+
matrix:
18+
jekyll: ["~> 4.3.4", "~>4.4.1"]
19+
env:
20+
JEKYLL_VERSION: ${{ matrix.jekyll }}
21+
steps:
22+
- name: Harden Runner
23+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
24+
with:
25+
egress-policy: audit
26+
27+
- name: Checkout Repository
28+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
29+
- name: Set Up Ruby 3.4.7
30+
uses: ruby/setup-ruby@4c24fa5ec04b2e79eb40571b1cee2a0d2b705771 # v1.278.0
31+
with:
32+
ruby-version: 3.4.7
33+
bundler-cache: true
34+
# - name: Run tests
35+
# run: script/cibuild

‎.github/workflows/codeql.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
#
12+
name: "CodeQL"
13+
14+
on:
15+
push:
16+
branches: ["main"]
17+
pull_request:
18+
# The branches below must be a subset of the branches above
19+
branches: ["main"]
20+
schedule:
21+
- cron: "0 0 * * 1"
22+
23+
permissions:
24+
contents: read
25+
26+
jobs:
27+
analyze:
28+
name: Analyze
29+
runs-on: ubuntu-latest
30+
permissions:
31+
actions: read
32+
contents: read
33+
security-events: write
34+
35+
strategy:
36+
fail-fast: false
37+
matrix:
38+
language: ["ruby"]
39+
# CodeQL supports [ $supported-codeql-languages ]
40+
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
41+
42+
steps:
43+
- name: Harden the runner (Audit all outbound calls)
44+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
45+
with:
46+
egress-policy: audit
47+
48+
- name: Checkout repository
49+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
50+
51+
# Initializes the CodeQL tools for scanning.
52+
- name: Initialize CodeQL
53+
uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
54+
with:
55+
languages: ${{ matrix.language }}
56+
# If you wish to specify custom queries, you can do so here or in a config file.
57+
# By default, queries listed here will override any specified in a config file.
58+
# Prefix the list here with "+" to use these queries and those in the config file.
59+
60+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
61+
# If this step fails, then you should remove it and run the build manually (see below)
62+
- name: Autobuild
63+
uses: github/codeql-action/autobuild@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
64+
65+
# ℹ️ Command-line programs to run using the OS shell.
66+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
67+
68+
# If the Autobuild fails above, remove it and uncomment the following three lines.
69+
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
70+
71+
# - run: |
72+
# echo "Run, Build Application using script"
73+
# ./location_of_script_within_repo/buildscript.sh
74+
75+
- name: Perform CodeQL Analysis
76+
uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
77+
with:
78+
category: "/language:${{matrix.language}}"

‎.github/workflows/dependabot.txt‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# Basic `dependabot.yml` file with
2+
# minimum configuration for two package managers
3+
4+
version: 2
5+
updates:
6+
permissions:
7+
contents: write
8+
# Enable version updates for npm
9+
- package-ecosystem: "npm"
10+
# Look for `package.json` and `lock` files in the `root` directory
11+
directory: "/"
12+
# Check the npm registry for updates every day (weekdays)
13+
schedule:
14+
interval: "daily"
15+
commit-message:
16+
prefix: "[info](sec) npm:"
17+
18+
# Enable version updates for Ruby
19+
- package-ecosystem: "bundler"
20+
# Look for `Ruby Gems` in the following directories
21+
directories:
22+
- "/"
23+
# - "_plugins"
24+
# Check for updates once a week
25+
schedule:
26+
interval: "daily"
27+
commit-message:
28+
prefix: "[info](sec) bundler:"
29+
30+
- package-ecosystem: github-actions
31+
directory: /
32+
schedule:
33+
interval: daily
34+
commit-message:
35+
prefix: "[info](sec) gh-actions:"

‎.github/workflows/dependency-review.yml‎

Lines changed: 26 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,26 +2,43 @@
22
#
33
# This Action will scan dependency manifest files that change as part of a Pull Request,
44
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
5-
# Once installed, if the workflow run is marked as required,
6-
# PRs introducing known-vulnerable packages will be blocked from merging.
5+
# Once installed, if the workflow run is marked as required, PRs introducing known-vulnerable
6+
# packages will be blocked from merging.
77
#
88
# Source repository: https://github.com/actions/dependency-review-action
9-
name: 'dependency – Dependency Review'
10-
on: [pull_request]
9+
# Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement
10+
name: 'Dependency review'
11+
on:
12+
pull_request:
13+
branches: [ "main", "main*" ]
1114

15+
# If using a dependency submission action in this workflow this permission will need to be set to:
16+
#
17+
# permissions:
18+
# contents: write
19+
#
20+
# https://docs.github.com/en/enterprise-cloud@latest/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api
1221
permissions:
1322
contents: read
23+
# Write permissions for pull-requests are required for using the `comment-summary-in-pr` option, comment out if you aren't using this option
24+
pull-requests: write
1425

1526
jobs:
1627
dependency-review:
1728
runs-on: ubuntu-latest
1829
steps:
19-
- name: Harden Runner
20-
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
30+
- name: Harden the runner (Audit all outbound calls)
31+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
2132
with:
2233
egress-policy: audit
2334

24-
- name: 'Checkout Repository'
25-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
35+
- name: 'Checkout repository'
36+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
2637
- name: 'Dependency Review'
27-
uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0
38+
uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
39+
# Commonly enabled options, see https://github.com/actions/dependency-review-action#configuration-options for all available options.
40+
with:
41+
comment-summary-in-pr: always
42+
# fail-on-severity: moderate
43+
# deny-licenses: GPL-1.0-or-later, LGPL-2.0-or-later
44+
# retry-on-snapshot-warnings: true

‎.github/workflows/issueQuarterlyRelease.yml‎

Lines changed: 26 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7,25 +7,41 @@ on:
77
- cron: 30 5 31 12 *
88
#workflow_dispatch:
99

10-
permissions: read-all
10+
permissions:
11+
contents: read
1112

1213
jobs:
1314
create-issue:
1415
runs-on: ubuntu-latest
1516
permissions:
1617
issues: write
18+
1719
steps:
1820
- name: Harden the runner (Audit all outbound calls)
19-
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
21+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
2022
with:
2123
egress-policy: audit
2224

2325
- name: Create Quarterly Release
24-
uses: peter-evans/create-issue-from-file@fca9117c27cdc29c6c4db3b86c48e4115a786710 # v6.0.0
25-
with:
26-
title: "Issue Quarterly Release"
27-
content-filepath: .github/quarterlyRelease.md
28-
assignees: RalphHightower
29-
labels: |
30-
maintenance
31-
license
26+
run: |
27+
new_issue_url=$(gh issue create \
28+
--title "$TITLE" \
29+
--assignee "$ASSIGNEES" \
30+
--label "$LABELS" \
31+
--body "$BODY")
32+
if [[ $PINNED == true ]]; then
33+
gh issue pin "$new_issue_url"
34+
fi
35+
env:
36+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
37+
GH_REPO: ${{ github.repository }}
38+
TITLE: "Maintenance: Quarterly Release"
39+
ASSIGNEES: "RalphHightower"
40+
LABELS: "maintenance,release – minor"
41+
BODY: |
42+
# Quarterly Release
43+
44+
- [ ] Create Quarterly Release.
45+
46+
PINNED: false
47+
CLOSE_PREVIOUS: false

‎.github/workflows/jekyll.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -32,18 +32,18 @@ jobs:
3232
runs-on: ubuntu-22.04
3333
steps:
3434
- name: Harden Runner
35-
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
35+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
3636
with:
3737
egress-policy: audit
3838

3939
- name: Checkout
40-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
40+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
4141
- name: Setup Ruby
42-
uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0
42+
uses: ruby/setup-ruby@4c24fa5ec04b2e79eb40571b1cee2a0d2b705771 # v1.278.0
4343
with:
44-
ruby-version: '3.4.5' # Not needed with a .ruby-version file
44+
ruby-version: '3.4.7' # Not needed with a .ruby-version file
4545
bundler-cache: true # runs 'bundle install' and caches installed gems automatically
46-
cache-version: 4 # Increment this number if you need to re-download cached gems
46+
cache-version: 5 # Increment this number if you need to re-download cached gems
4747
- name: Setup Pages
4848
id: pages
4949
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
@@ -67,10 +67,10 @@ jobs:
6767
needs: build
6868
steps:
6969
- name: Harden Runner
70-
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
70+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
7171
with:
7272
egress-policy: audit
7373

7474
- name: Deploy to GitHub Pages
7575
id: deployment
76-
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
76+
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

‎.github/workflows/newYearUpdateCopyright.yml‎

Lines changed: 30 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,40 @@
1-
name: newYearUpdateCopyright.yml – New Year LICENSE Reminder
2-
1+
name: Create Issue to Update Year In Relevant Files
2+
# developer: @RalphHightower
33
on:
44
schedule:
5-
- cron: '0 5 1 1 *' # Midnight EST on Jan 1 America/New_York
5+
- cron: "0 5 1 1 *" # America/New_York (UTC-5:00)
66
#workflow_dispatch:
77

8-
permissions: read-all
9-
8+
permissions:
9+
contents: read
10+
1011
jobs:
11-
create-issue:
12+
create_issue:
13+
name: Create issue to update copyright year
1214
runs-on: ubuntu-latest
1315
permissions:
1416
issues: write
1517
steps:
16-
- name: Harden the runner (Audit all outbound calls)
17-
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
18-
with:
19-
egress-policy: audit
18+
- name: Happy New Year!
19+
run: |
20+
new_issue_url=$(gh issue create \
21+
--title "$TITLE" \
22+
--assignee "$ASSIGNEES" \
23+
--label "$LABELS" \
24+
--body "$BODY")
25+
if [[ $PINNED == true ]]; then
26+
gh issue pin "$new_issue_url"
27+
fi
28+
env:
29+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
30+
GH_REPO: ${{ github.repository }}
31+
TITLE: Happy New Year! 🎆 – 🍾 Update License Year
32+
ASSIGNEES: RalphHightower
33+
LABELS: "maintenance"
34+
BODY: |
35+
# New Year's Maintenance
36+
37+
- [ ] Update LICENSE. Add new year to year's span.
2038
21-
- name: Create LICENSE update issue
22-
uses: peter-evans/create-issue-from-file@fca9117c27cdc29c6c4db3b86c48e4115a786710 # v6.0.0
23-
with:
24-
title: "Update LICENSE for the new year"
25-
content-filepath: .github/license-reminder.md
26-
assignees: RalphHightower
27-
labels: |
28-
maintenance
29-
license
39+
PINNED: false
40+
CLOSE_PREVIOUS: false

0 commit comments

Comments
 (0)