Skip to content

Commit 844b2bb

Browse files
anmolnagpalanmolnagpal
authored
chore: standardize repo with security policy, pre-commit, release automation, and editor config (#37)
Co-authored-by: Anmol Nagpal <anmolnagpal@users.noreply.github.com>
1 parent 8f43866 commit 844b2bb

File tree

5 files changed

+224
-15
lines changed

5 files changed

+224
-15
lines changed

‎.editorconfig‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
root = true
2+
3+
[*]
4+
charset = utf-8
5+
end_of_line = lf
6+
indent_size = 2
7+
indent_style = space
8+
insert_final_newline = true
9+
max_line_length = 80
10+
trim_trailing_whitespace = true
11+
12+
[*.{tf,tfvars}]
13+
indent_size = 2
14+
indent_style = space
15+
16+
[*.md]
17+
max_line_length = 0
18+
trim_trailing_whitespace = false
19+
20+
[Makefile]
21+
tab_width = 2
22+
indent_style = tab
23+
24+
[COMMIT_EDITMSG]
25+
max_line_length = 0

‎.pre-commit-config.yaml‎

Lines changed: 23 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,29 @@
11
repos:
2-
3-
- repo: https://github.com/gruntwork-io/pre-commit
4-
rev: v0.1.23 # Get the latest from: https://github.com/gruntwork-io/pre-commit/releases
2+
- repo: https://github.com/antonbabenko/pre-commit-terraform
3+
rev: v1.105.0
54
hooks:
6-
- id: terraform-fmt
7-
- id: shellcheck
8-
- id: tflint
9-
5+
- id: terraform_fmt
6+
- id: terraform_docs
7+
args:
8+
- '--args=--lockfile=false'
9+
- id: terraform_tflint
10+
args:
11+
- '--args=--only=terraform_deprecated_interpolation'
12+
- '--args=--only=terraform_deprecated_index'
13+
- '--args=--only=terraform_unused_declarations'
14+
- '--args=--only=terraform_comment_syntax'
15+
- '--args=--only=terraform_documented_outputs'
16+
- '--args=--only=terraform_documented_variables'
17+
- '--args=--only=terraform_typed_variables'
18+
- '--args=--only=terraform_module_pinned_source'
19+
- '--args=--only=terraform_naming_convention'
20+
- '--args=--only=terraform_required_version'
21+
- '--args=--only=terraform_required_providers'
22+
- '--args=--only=terraform_standard_module_structure'
23+
- id: terraform_validate
1024
- repo: https://github.com/pre-commit/pre-commit-hooks
11-
rev: v5.0.0 # Use the ref you want to point at
25+
rev: v5.0.0
1226
hooks:
27+
- id: check-merge-conflict
1328
- id: end-of-file-fixer
1429
- id: trailing-whitespace
15-
- id: mixed-line-ending
16-
- id: check-byte-order-marker
17-
- id: check-executables-have-shebangs
18-
- id: check-merge-conflict
19-
- id: debug-statements
20-
- id: check-yaml
21-
- id: check-added-large-files

‎.releaserc.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"branches": ["main", "master"],
3+
"ci": false,
4+
"plugins": [
5+
["@semantic-release/commit-analyzer", {"preset": "conventionalcommits"}],
6+
["@semantic-release/release-notes-generator", {"preset": "conventionalcommits"}],
7+
["@semantic-release/github", {
8+
"successComment": "This ${issue.pull_request ? 'PR is included' : 'issue has been resolved'} in version ${nextRelease.version}",
9+
"labels": false
10+
}],
11+
["@semantic-release/changelog", {"changelogFile": "CHANGELOG.md"}],
12+
["@semantic-release/git", {"assets": ["CHANGELOG.md"], "message": "chore(release): version ${nextRelease.version} [skip ci]"}]
13+
]
14+
}

‎CONTRIBUTING.md‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
# Contributing
2+
3+
We welcome contributions! This document provides guidelines for contributing to this project.
4+
5+
## Code of Conduct
6+
7+
Please be respectful and constructive. We are committed to providing a welcoming and inclusive experience for everyone.
8+
9+
## Getting Started
10+
11+
1. Fork the repository
12+
2. Clone your fork locally
13+
3. Create a feature branch from `master`
14+
4. Make your changes
15+
5. Test your changes
16+
6. Submit a pull request
17+
18+
## Development Setup
19+
20+
### Prerequisites
21+
22+
- [Terraform](https://www.terraform.io/downloads.html) >= 1.10.0
23+
- [pre-commit](https://pre-commit.com/#install)
24+
- [TFLint](https://github.com/terraform-linters/tflint)
25+
- [terraform-docs](https://terraform-docs.io/)
26+
27+
### Local Development
28+
29+
```bash
30+
# Install pre-commit hooks
31+
pre-commit install
32+
33+
# Run all pre-commit checks
34+
pre-commit run -a
35+
36+
# Format code
37+
terraform fmt -recursive
38+
39+
# Validate module
40+
terraform init -backend=false
41+
terraform validate
42+
```
43+
44+
## Pull Request Process
45+
46+
### Commit Messages
47+
48+
We use [Conventional Commits](https://www.conventionalcommits.org/). All commit messages and PR titles must follow this format:
49+
50+
```
51+
type: description
52+
```
53+
54+
**Allowed types:** `fix`, `feat`, `docs`, `ci`, `chore`, `test`, `refactor`, `style`, `perf`, `build`, `revert`
55+
56+
**Examples:**
57+
- `feat: add support for custom tags`
58+
- `fix: correct subnet CIDR calculation`
59+
- `docs: update usage examples`
60+
- `ci: pin workflow actions to SHA`
61+
62+
### PR Checklist
63+
64+
- [ ] Code follows the existing style and conventions
65+
- [ ] Updated or added examples in `examples/` directory
66+
- [ ] Ran `pre-commit run -a` locally
67+
- [ ] Updated documentation if needed
68+
- [ ] All CI checks pass
69+
70+
### What to Include
71+
72+
- Clear description of what changed and why
73+
- Link to any related issues
74+
- Example usage if adding new features
75+
- Test evidence (terraform validate output, plan output)
76+
77+
## Module Structure
78+
79+
```
80+
module/
81+
├── main.tf # Primary resources
82+
├── variables.tf # Input variables
83+
├── outputs.tf # Output values
84+
├── versions.tf # Provider and Terraform version constraints
85+
├── locals.tf # Local values (if needed)
86+
├── data.tf # Data sources (if needed)
87+
├── examples/ # Usage examples
88+
│ ├── basic/ # Minimal working example
89+
│ └── complete/ # Full-featured example
90+
├── README.md # Documentation (auto-generated)
91+
├── README.yaml # Documentation source
92+
└── CHANGELOG.md # Version history
93+
```
94+
95+
## Versioning
96+
97+
We follow [Semantic Versioning](https://semver.org/):
98+
- **MAJOR**: Breaking changes
99+
- **MINOR**: New features (backwards compatible)
100+
- **PATCH**: Bug fixes (backwards compatible)
101+
102+
## Questions?
103+
104+
Open an issue or reach out at **support@clouddrove.com**.

‎SECURITY.md‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# Security Policy
2+
3+
## Supported Versions
4+
5+
| Version | Supported |
6+
|---------|--------------------|
7+
| Latest | :white_check_mark: |
8+
| < 1.0 | :x: |
9+
10+
## Reporting a Vulnerability
11+
12+
We take security seriously. If you discover a security vulnerability, please report it responsibly.
13+
14+
**Please do NOT open a public GitHub issue for security vulnerabilities.**
15+
16+
### How to Report
17+
18+
1. Email us at **support@clouddrove.com** with:
19+
- Description of the vulnerability
20+
- Steps to reproduce
21+
- Potential impact
22+
- Suggested fix (if any)
23+
24+
2. You will receive an acknowledgment within **48 hours**
25+
26+
3. We will investigate and provide a timeline for a fix
27+
28+
### Response Timeline
29+
30+
| Severity | Acknowledgment | Fix Target |
31+
|----------|---------------|------------|
32+
| Critical | 24 hours | 7 days |
33+
| High | 48 hours | 14 days |
34+
| Medium | 72 hours | 30 days |
35+
| Low | 1 week | Next release |
36+
37+
### Scope
38+
39+
This policy applies to:
40+
- Terraform module code
41+
- Example configurations
42+
- CI/CD workflows
43+
- Documentation containing sensitive patterns
44+
45+
### Out of Scope
46+
47+
- Vulnerabilities in Terraform itself (report to HashiCorp)
48+
- Vulnerabilities in cloud provider APIs
49+
- Issues in third-party dependencies (report upstream)
50+
51+
## Security Best Practices
52+
53+
When using our modules:
54+
- Always pin module versions in production
55+
- Review `tfsec` and `checkov` findings before deploying
56+
- Use least-privilege IAM policies
57+
- Enable encryption at rest and in transit where available
58+
- Regularly update to the latest module version

0 commit comments

Comments
 (0)