Skip to content

Commit 2b5fcb3

Browse files
frederickw082922frederickw082922
authored
Merge pull request #361 from ansible-lockdown/devel
.github standardization + .pre-commit
2 parents a907887 + 545fe1a commit 2b5fcb3

8 files changed

+390
-294
lines changed

‎.github/workflows/add_repo_issue_to_gh_project.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
3+
name: Add Repo Issue to ALD GH project
4+
on:
5+
issues:
6+
types:
7+
- opened
8+
- reopened
9+
- transferred
10+
jobs:
11+
add-to-project:
12+
runs-on: ubuntu-latest
13+
steps:
14+
- uses: actions/add-to-project@main
15+
with:
16+
project-url: https://github.com/orgs/ansible-lockdown/projects/1
17+
github-token: ${{ secrets.ALD_GH_PROJECT }}

‎.github/workflows/benchmark_tracking_controller.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
3+
# GitHub schedules all cron jobs in UTC.
4+
# ──────────────────────────────────────────────────────────────────────────────
5+
# Schedule:
6+
# - '0 13 * * *' runs at 13:00 UTC every day.
7+
# - This corresponds to:
8+
# • 9:00 AM Eastern **during Daylight Saving Time** (mid-Mar → early-Nov)
9+
# • 8:00 AM Eastern **during Standard Time** (early-Nov → mid-Mar)
10+
#
11+
# Job routing:
12+
# - call-benchmark-tracker:
13+
# • Runs on manual dispatch, and on pushes to the 'latest' branch.
14+
# - call-monitor-promotions:
15+
# • Runs on schedule or manual dispatch **only in repos named ansible-lockdown/Private-***.
16+
# • Skips automatically in public repos (e.g., Windows-2022-CIS) to avoid false failures.
17+
#
18+
# Defense-in-depth:
19+
# - The called promotion workflow may still keep its own guard to ensure only Private-* repos execute it.
20+
21+
name: Central Benchmark Orchestrator
22+
23+
on:
24+
push:
25+
branches:
26+
- latest
27+
schedule:
28+
- cron: '0 13 * * *' # 13:00 UTC → 9 AM ET (DST) / 8 AM ET (Standard Time)
29+
workflow_dispatch:
30+
31+
jobs:
32+
call-benchmark-tracker:
33+
# Run on manual dispatch OR when 'latest' branch receives a push
34+
if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref_name == 'latest')
35+
name: Start Benchmark Tracker
36+
uses: ansible-lockdown/github_linux_IaC/.github/workflows/benchmark_track.yml@self_hosted
37+
with:
38+
repo_name: ${{ github.repository }}
39+
secrets:
40+
TEAMS_WEBHOOK_URL: ${{ secrets.TEAMS_WEBHOOK_URL }}
41+
BADGE_PUSH_TOKEN: ${{ secrets.BADGE_PUSH_TOKEN }}
42+
DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
43+
44+
call-monitor-promotions:
45+
# Run on schedule or manual dispatch, but only for Private-* repos
46+
if: (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && startsWith(github.repository, 'ansible-lockdown/Private-')
47+
name: Monitor Promotions and Auto-Promote
48+
uses: ansible-lockdown/github_linux_IaC/.github/workflows/benchmark_promote.yml@self_hosted
49+
with:
50+
repo_name: ${{ github.repository }}
51+
secrets:
52+
TEAMS_WEBHOOK_URL: ${{ secrets.TEAMS_WEBHOOK_URL }}
53+
BADGE_PUSH_TOKEN: ${{ secrets.BADGE_PUSH_TOKEN }}
54+
DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}

‎.github/workflows/devel_pipeline_validation.yml‎

Lines changed: 147 additions & 144 deletions
Original file line numberDiff line numberDiff line change
@@ -4,156 +4,159 @@
44

55
on: # yamllint disable-line rule:truthy
66
pull_request_target:
7-
types: [opened, reopened, synchronize]
8-
branches:
9-
- devel
10-
- benchmark*
11-
paths:
12-
- '**.yml'
13-
- '**.sh'
14-
- '**.j2'
15-
- '**.ps1'
16-
- '**.cfg'
7+
types: [opened, reopened, synchronize]
8+
branches:
9+
- devel
10+
- benchmark*
11+
paths:
12+
- '**.yml'
13+
- '**.sh'
14+
- '**.j2'
15+
- '**.ps1'
16+
- '**.cfg'
1717
# Allow manual running of workflow
1818
workflow_dispatch:
1919

20-
# Allow permissions for AWS auth
21-
permissions:
22-
id-token: write
23-
contents: read
24-
pull-requests: read
25-
2620
# A workflow run is made up of one or more jobs
2721
# that can run sequentially or in parallel
2822
jobs:
2923
# This will create messages for first time contributers and direct them to the Discord server
30-
welcome:
31-
runs-on: ubuntu-latest
32-
33-
steps:
34-
- uses: actions/first-interaction@main
35-
with:
36-
repo-token: ${{ secrets.GITHUB_TOKEN }}
37-
pr-message: |-
38-
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
39-
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
40-
41-
# This workflow contains a single job that tests the playbook
42-
playbook-test:
43-
# The type of runner that the job will run on
44-
runs-on: self-hosted
45-
env:
46-
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
47-
# Imported as a variable by terraform
48-
TF_VAR_repository: ${{ github.event.repository.name }}
49-
AWS_REGION: "us-east-1"
50-
ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
51-
defaults:
52-
run:
53-
shell: bash
54-
working-directory: .github/workflows/github_linux_IaC
55-
# working-directory: .github/workflows
56-
57-
steps:
58-
59-
- name: Git clone the lockdown repository to test
60-
uses: actions/checkout@v4
61-
with:
62-
ref: ${{ github.event.pull_request.head.sha }}
63-
64-
- name: If a variable for IAC_BRANCH is set use that branch
65-
working-directory: .github/workflows
66-
run: |
67-
if [ ${{ vars.IAC_BRANCH }} != '' ]; then
68-
echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
69-
echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
70-
else
71-
echo IAC_BRANCH=main >> $GITHUB_ENV
72-
fi
73-
74-
# Pull in terraform code for linux servers
75-
- name: Clone GitHub IaC plan
76-
uses: actions/checkout@v4
77-
with:
78-
repository: ansible-lockdown/github_linux_IaC
79-
path: .github/workflows/github_linux_IaC
80-
ref: ${{ env.IAC_BRANCH }}
81-
82-
# Uses dedicated restricted role and policy to enable this only for this task
83-
# No credentials are part of github for AWS auth
84-
- name: configure aws credentials
85-
uses: aws-actions/configure-aws-credentials@main
86-
with:
87-
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
88-
role-session-name: ${{ secrets.AWS_ROLE_SESSION }}
89-
aws-region: ${{ env.AWS_REGION }}
90-
91-
- name: DEBUG - Show IaC files
92-
if: env.ENABLE_DEBUG == 'true'
93-
run: |
94-
echo "OSVAR = $OSVAR"
95-
echo "benchmark_type = $benchmark_type"
96-
echo "PRIVSUBNET_ID = $AWS_PRIVSUBNET_ID"
97-
echo "VPC_ID" = $AWS_VPC_SECGRP_ID"
98-
pwd
99-
ls
100-
env:
101-
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
102-
OSVAR: ${{ vars.OSVAR }}
103-
benchmark_type: ${{ vars.BENCHMARK_TYPE }}
104-
PRIVSUBNET_ID: ${{ secrets.AWS_PRIVSUBNET_ID }}
105-
VPC_ID: ${{ secrets.AWS_VPC_SECGRP_ID }}
106-
107-
- name: Tofu init
108-
id: init
109-
run: tofu init
110-
env:
111-
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
112-
OSVAR: ${{ vars.OSVAR }}
113-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
114-
115-
- name: Tofu validate
116-
id: validate
117-
run: tofu validate
118-
env:
119-
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
120-
OSVAR: ${{ vars.OSVAR }}
121-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
122-
123-
- name: Tofu apply
124-
id: apply
125-
env:
126-
OSVAR: ${{ vars.OSVAR }}
127-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
128-
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
129-
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
130-
run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false
24+
welcome:
25+
runs-on: ubuntu-latest
26+
27+
permissions:
28+
issues: write
29+
pull-requests: write
30+
31+
steps:
32+
- uses: actions/first-interaction@main
33+
with:
34+
repo_token: ${{ secrets.GITHUB_TOKEN }}
35+
issue_message: |-
36+
Congrats on opening your first issue and thank you for taking the time to help improve Ansible-Lockdown!
37+
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
38+
pr_message: |-
39+
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
40+
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
41+
42+
# This workflow contains a single job that tests the playbook
43+
playbook-test:
44+
# The type of runner that the job will run on
45+
runs-on: self-hosted
46+
47+
# Allow permissions for AWS auth
48+
permissions:
49+
id-token: write
50+
contents: read
51+
pull-requests: read
52+
53+
env:
54+
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
55+
# Imported as a variable by terraform
56+
TF_VAR_repository: ${{ github.event.repository.name }}
57+
AWS_REGION: "us-east-1"
58+
ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
59+
defaults:
60+
run:
61+
shell: bash
62+
working-directory: .github/workflows/github_linux_IaC
63+
# working-directory: .github/workflows
64+
65+
steps:
66+
67+
- name: Git clone the lockdown repository to test
68+
uses: actions/checkout@v4
69+
with:
70+
ref: ${{ github.event.pull_request.head.sha }}
71+
72+
- name: If a variable for IAC_BRANCH is set use that branch
73+
working-directory: .github/workflows
74+
run: |
75+
if [ ${{ vars.IAC_BRANCH }} != '' ]; then
76+
echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
77+
echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
78+
else
79+
echo IAC_BRANCH=main >> $GITHUB_ENV
80+
fi
81+
82+
# Pull in terraform code for linux servers
83+
- name: Clone GitHub IaC plan
84+
uses: actions/checkout@v4
85+
with:
86+
repository: ansible-lockdown/github_linux_IaC
87+
path: .github/workflows/github_linux_IaC
88+
ref: ${{ env.IAC_BRANCH }}
89+
90+
# Uses dedicated restricted role and policy to enable this only for this task
91+
# No credentials are part of github for AWS auth
92+
- name: configure aws credentials
93+
uses: aws-actions/configure-aws-credentials@main
94+
with:
95+
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
96+
role-session-name: ${{ secrets.AWS_ROLE_SESSION }}
97+
aws-region: ${{ env.AWS_REGION }}
98+
99+
- name: DEBUG - Show IaC files
100+
if: env.ENABLE_DEBUG == 'true'
101+
run: |
102+
echo "OSVAR = $OSVAR"
103+
echo "benchmark_type = $benchmark_type"
104+
pwd
105+
env:
106+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
107+
OSVAR: ${{ vars.OSVAR }}
108+
benchmark_type: ${{ vars.BENCHMARK_TYPE }}
109+
110+
- name: Tofu init
111+
id: init
112+
run: tofu init
113+
env:
114+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
115+
OSVAR: ${{ vars.OSVAR }}
116+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
117+
118+
- name: Tofu validate
119+
id: validate
120+
run: tofu validate
121+
env:
122+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
123+
OSVAR: ${{ vars.OSVAR }}
124+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
125+
126+
- name: Tofu apply
127+
id: apply
128+
env:
129+
OSVAR: ${{ vars.OSVAR }}
130+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
131+
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
132+
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
133+
run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false
131134

132135
## Debug Section
133-
- name: DEBUG - Show Ansible hostfile
134-
if: env.ENABLE_DEBUG == 'true'
135-
run: cat hosts.yml
136-
137-
# Aws deployments taking a while to come up insert sleep or playbook fails
138-
139-
- name: Sleep to allow system to come up
140-
run: sleep ${{ vars.BUILD_SLEEPTIME }}
141-
142-
# Run the Ansible playbook
143-
- name: Run_Ansible_Playbook
144-
env:
145-
ANSIBLE_HOST_KEY_CHECKING: "false"
146-
ANSIBLE_DEPRECATION_WARNINGS: "false"
147-
run: |
148-
/opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml --private-key ~/.ssh/le_runner ../../../site.yml
149-
150-
# Remove test system - User secrets to keep if necessary
151-
152-
- name: Tofu Destroy
153-
if: always() && env.ENABLE_DEBUG == 'false'
154-
env:
155-
OSVAR: ${{ vars.OSVAR }}
156-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
157-
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
158-
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
159-
run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve -input=false
136+
- name: DEBUG - Show Ansible hostfile
137+
if: env.ENABLE_DEBUG == 'true'
138+
run: cat hosts.yml
139+
140+
# Aws deployments taking a while to come up insert sleep or playbook fails
141+
142+
- name: Sleep to allow system to come up
143+
run: sleep ${{ vars.BUILD_SLEEPTIME }}
144+
145+
# Run the Ansible playbook
146+
- name: Run_Ansible_Playbook
147+
env:
148+
ANSIBLE_HOST_KEY_CHECKING: "false"
149+
ANSIBLE_DEPRECATION_WARNINGS: "false"
150+
run: |
151+
/opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml --private-key ~/.ssh/le_runner ../../../site.yml
152+
153+
# Remove test system - User secrets to keep if necessary
154+
155+
- name: Tofu Destroy
156+
if: always() && env.ENABLE_DEBUG == 'false'
157+
env:
158+
OSVAR: ${{ vars.OSVAR }}
159+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
160+
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
161+
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
162+
run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve -input=false

0 commit comments

Comments
 (0)