Skip to content

Commit 889cc0e

Browse files
paddyroddypaddyroddy
committed
Add Safe-Settings app to manage policy as code
1 parent 8f5a983 commit 889cc0e

File tree

6 files changed

+301
-0
lines changed

6 files changed

+301
-0
lines changed

‎.github/workflows/safe-settings.yaml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
---
2+
name: Safe Settings Sync
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
paths:
9+
- safe-settings/**
10+
- .github/workflows/safe-settings.yaml
11+
schedule:
12+
- cron: 0 */4 * * *
13+
workflow_dispatch: {}
14+
15+
concurrency:
16+
cancel-in-progress: true
17+
group: >-
18+
${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
19+
20+
jobs:
21+
safe-settings-sync:
22+
runs-on: ubuntu-latest
23+
env:
24+
SAFE_SETTINGS_VERSION: 2.1.14
25+
SAFE_SETTINGS_CODE_DIR: .safe-settings-code
26+
steps:
27+
- name: Checkout source
28+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
29+
30+
- name: Checkout GitHub Safe-Settings repository
31+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
32+
with:
33+
path: ${{ env.SAFE_SETTINGS_CODE_DIR }}
34+
ref: ${{ env.SAFE_SETTINGS_VERSION }}
35+
repository: github/safe-settings
36+
37+
- name: Setup Node.js
38+
uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
39+
with:
40+
cache-dependency-path:
41+
${{ env.SAFE_SETTINGS_CODE_DIR }}/package-lock.json
42+
cache: npm
43+
node-version-file: ${{ env.SAFE_SETTINGS_CODE_DIR }}/.nvmrc
44+
45+
- name: Install dependencies
46+
run: npm install
47+
working-directory: ${{ env.SAFE_SETTINGS_CODE_DIR }}
48+
49+
- name: Run application
50+
run: npm run full-sync
51+
working-directory: ${{ env.SAFE_SETTINGS_CODE_DIR }}
52+
env:
53+
ADMIN_REPO: .github
54+
APP_ID: ${{ vars.SAFE_SETTINGS_APP_ID }}
55+
BLOCK_REPO_RENAME_BY_HUMAN: false
56+
CONFIG_PATH: safe-settings
57+
DEPLOYMENT_CONFIG_FILE:
58+
${{ github.workspace }}/safe-settings/deployment.yaml
59+
ENABLE_PR_COMMENT: true
60+
GH_ORG: ${{ vars.SAFE_SETTINGS_GH_ORG }}
61+
GITHUB_CLIENT_ID: ${{ vars.SAFE_SETTINGS_GITHUB_CLIENT_ID }}
62+
GITHUB_CLIENT_SECRET:
63+
${{ secrets.SAFE_SETTINGS_GITHUB_CLIENT_SECRET }}
64+
LOG_LEVEL: trace
65+
PRIVATE_KEY: ${{ secrets.SAFE_SETTINGS_PRIVATE_KEY }}
66+
SETTINGS_FILE_PATH: organisation.yaml

‎.renovaterc.json5‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
$schema: "https://docs.renovatebot.com/renovate-schema.json",
3+
extends: [
4+
"github>UCL-ARC/.github//renovate/default-config.json",
5+
":assignAndReview(paddyroddy)",
6+
":automergeAll",
7+
],
8+
customManagers: [
9+
{
10+
customType: "regex",
11+
description: "Update GitHub Safe-Settings version",
12+
fileMatch: [".github/workflows/safe-settings.yaml$"],
13+
matchStrings: ["SAFE_SETTINGS_VERSION:\\s(?<currentValue>.*)"],
14+
depNameTemplate: "github/safe-settings",
15+
datasourceTemplate: "github-releases",
16+
},
17+
],
18+
}

‎safe-settings/README.md‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# Safe-Settings
2+
3+
[Safe-Settings](https://github.com/github/safe-settings) is a way to manage
4+
policy-as-code and apply repository settings across the organisation. A
5+
[GitHub App](https://github.com/apps/rits-safe-settings) has been set up which
6+
the [GitHub Action](../.github/workflows/safe-settings.yaml) uses to apply the
7+
settings on a cron schedule. The settings here are a reduced set used in the
8+
[https://github.com/UCL-MIRSG/.github repository](https://github.com/UCL-MIRSG/.github/tree/main/safe-settings).
9+
10+
## Configuration Files
11+
12+
There are four types of settings that can be applied:
13+
14+
- [Deployment](https://github.com/github/safe-settings/blob/main-enterprise/docs/sample-settings/sample-deployment-settings.yml)
15+
which defines deployment and runtime settings.
16+
- [Organisation](https://github.com/github/safe-settings/blob/main-enterprise/docs/sample-settings/settings.yml)
17+
which can be used to define org-level settings.
18+
- [Repository](https://github.com/github/safe-settings/blob/main-enterprise/docs/sample-settings/repo.yml)
19+
which can be used to define repo-level settings.
20+
- [Suborganisation](https://github.com/github/safe-settings/blob/main-enterprise/docs/sample-settings/suborg.yml)
21+
which can be used to define suborganisation-level settings.
22+
23+
Beyond these example configurations one can read more about potential settings
24+
to apply in the
25+
[documentation](https://github.com/github/safe-settings/tree/main-enterprise/docs/github-settings).
26+
The precedence order for configuration is `repository` > `suborganisation` >
27+
`organisation`.
28+
29+
## The Settings in This Repository
30+
31+
### Deployment
32+
33+
The [deployment settings](deployment.yaml) are used to exclude archived
34+
repositories from the Safe-Settings app. This is because these repositories are
35+
read-only and hence cannot be modified. Rather than having the GitHub Action
36+
fail on these repositories, they are excluded from the run.
37+
38+
### Organisation
39+
40+
The [organisation settings](organisation.yaml) are used to define general
41+
repository settings for all repositories across the organisation. These settings
42+
are applied to all repositories unless the precedence order is overridden by the
43+
suborganisation settings (or repository settings).
44+
45+
### Suborganisation
46+
47+
The [suborganisation settings](suborgs/rulesets.yaml) are being used to define
48+
[rulesets](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets)
49+
for all repositories across the organisation. The `rulesets` available in the
50+
organisation settings are defined for the organisation itself rather than
51+
individual repositories, so they cannot be set via organisation settings. This
52+
hack is done through
53+
54+
```yaml
55+
suborgrepos:
56+
- "*"
57+
```
58+
59+
at the top of the file. Further explanation can be found in the
60+
[Safe-Settings issues](https://github.com/github/safe-settings/issues/553#issuecomment-2552578978).

‎safe-settings/deployment.yaml‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
# https://github.com/github/safe-settings/blob/main-enterprise/docs/sample-settings/sample-deployment-settings.yml
2+
---
3+
restrictedRepos:
4+
# these repos are all archived and will cause the GHA to fail
5+
# https://github.com/github/safe-settings/issues/443
6+
exclude:
7+
- ^2014-11-06-ucl$
8+
- ^2015-11-10-UCL_software_carpentry$
9+
- ^2016-02-17-UCL_software_carpentry$
10+
- ^2016-06-22-UCL_software_carpentry$
11+
- ^2016-09-22-UCL_software_carpentry$
12+
- ^2016-12-13-UCL_software_carpentry$
13+
- ^2017-04-27-UCL_software_carpentry$
14+
- ^2017-07-25-UCL_software_carpentry$
15+
- ^2017-09-25-UCL_software_carpentry$
16+
- ^2017-10-31-UCL_software_carpentry$
17+
- ^2017-12-14-UCL_software_carpentry$
18+
- ^2018-04-25-UCL_software_carpentry$
19+
- ^2018-06-26-UCL_software_carpentry$
20+
- ^2018-08-28-UCL_software_carpentry$
21+
- ^2018-09-26-UCL_software_carpentry$
22+
- ^2018-11-07-UCL_software_carpentry$
23+
- ^2019-04-08-UCL_software_carpentry$
24+
- ^2019-07-15-UCL_software_carpentry$
25+
- ^2019-09-25-UCL_software_carpentry$
26+
- ^2019-11-04-UCL_software_carpentry$
27+
- ^2020-02-18_UCL_software_carpentry$
28+
- ^2020-07-27-UCL_hpc_carpentry$
29+
- ^2020-09-30_UCL_software_carpentry$
30+
- ^2020-11-25-rslondon$
31+
- ^2021-03-09_UCL_software_carpentry$
32+
- ^2021-05-17-UCL_hpc_carpentry$
33+
- ^2021-07-19-UCL-software-carpentry-online$
34+
- ^2021-09-29-ucl-online$
35+
- ^2021-11-22-UCL-HPCCarpentry-online$
36+
- ^2023-02-13-swc-ucl$
37+
- ^201711_ciHPC$
38+
- ^A-Team-Roadmap-2017-notes$
39+
- ^bash-give$
40+
- ^bempp-clientapp$
41+
- ^bempp-marketplace$
42+
- ^BinaryBlobs-dependencies$
43+
- ^black-garlic$
44+
- ^CAF_play$
45+
- ^ci-helpers$
46+
- ^clinician-carpentry-python$
47+
- ^CloudLabs$
48+
- ^ClusterStats-Gold$
49+
- ^CMakeCatchMPI$
50+
- ^COVID-19-website$
51+
- ^CSB-structural-bio-tools$
52+
- ^DashPykpi$
53+
- ^data-classification$
54+
- ^DeCon-Export$
55+
- ^DECOVID-projectmgmt$
56+
- ^django-shibboleth-remoteuser$
57+
- ^doctoral-programming-intro$
58+
- ^emerald_play$
59+
- ^exams$
60+
- ^ExCALIBUR-HES$
61+
- ^friend-group-2020$
62+
- ^GeographyTraining$
63+
- ^getcwd-autoretry-preload$
64+
- ^GFR-calculator$
65+
- ^gh-action-docker$
66+
- ^gitter-test$
67+
- ^gitworkshop$
68+
- ^go-ldap$
69+
- ^Gold$
70+
- ^GridEngine-OpenSSH$
71+
- ^hello_ci$
72+
- ^hemelb$
73+
- ^homebrew-rsdt$
74+
- ^homebrew-science$
75+
- ^HPC-Acceptance-Tests$
76+
- ^icu-dashboard$
77+
- ^indigo-dexy$
78+
- ^indigo_django$
79+
- ^intro-research-prog$
80+
- ^intro-to-shell$
81+
- ^ipls-workshop$
82+
- ^iwos$
83+
- ^jekyll-idio$
84+
- ^jenkins-hpc-scheduler$
85+
- ^jenkins-job-builder-files$
86+
- ^keyscan$
87+
- ^Legion-Fabric-Scaffold$
88+
- ^licenselogparse$
89+
- ^marking_tool$
90+
- ^MMMHub-SAFE$
91+
- ^MPHYG_Exams$
92+
- ^OnlineCourses$
93+
- ^oracc-corpus$
94+
- ^Packaging$
95+
- ^parkingSpace$
96+
- ^PHAS0100_Caching$
97+
- ^PHAS0100_Optimisation$
98+
- ^PHAS0100_Profiling$
99+
- ^PHAS0100_Sorting$
100+
- ^puppeteer-rampart-screenshot$
101+
- ^rc-docs$
102+
- ^rc_puppet$
103+
- ^rcps-intro-training-materials-beamer$
104+
- ^rcps-singularity-recipes$
105+
- ^research-computing-with-cpp-demo$
106+
- ^research-se-python$
107+
- ^research-software-teaching$
108+
- ^rhel6-install$
109+
- ^rhel7-ldap-nfs$
110+
- ^rits-reporting$
111+
- ^RSD-Dashboard-puppet-module$
112+
- ^RSD-Infrastructure$
113+
- ^rsd-rag$
114+
- ^rsd-sagital_average$
115+
- ^rsd-web-resources$
116+
- ^rsd_puppet$
117+
- ^rsdg-ci-reboot$
118+
- ^RSDG_HPC$
119+
- ^rse-classwork-2020$
120+
- ^sge-to-icinga$
121+
- ^sopt$
122+
- ^spack4jenkins$
123+
- ^spack_packages$
124+
- ^SpringDatabaseMultiplexing$
125+
- ^tailoredrcstats$
126+
- ^test-pages-custom$
127+
- ^travis_example$
128+
- ^ucl-gtr$
129+
- ^ucl-rits.github.io$
130+
- ^ucl_reprohack_2020$
131+
- ^UsefulModuleFunctions$
132+
- ^vetii$

‎safe-settings/organisation.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# https://github.com/github/safe-settings/blob/main-enterprise/docs/sample-settings/settings.yml
2+
---
3+
repository:
4+
allow_auto_merge: true
5+
allow_update_branch: true
6+
delete_branch_on_merge: true

‎safe-settings/suborgs/rulesets.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# https://github.com/github/safe-settings/blob/main-enterprise/docs/sample-settings/suborg.yml
2+
# ---
3+
# suborgrepos:
4+
# - "*"
5+
6+
# rulesets:
7+
# - name: Default
8+
# target: branch
9+
# enforcement: active
10+
11+
# conditions:
12+
# ref_name:
13+
# include:
14+
# - ~DEFAULT_BRANCH
15+
# exclude: []
16+
17+
# rules:
18+
# - type: deletion
19+
# - type: non_fast_forward # prevents force pushes

0 commit comments

Comments
 (0)