Skip to content

Commit 31d0b8a

Browse files
gillgcloudpossebotnitrocode
authored
Prevent unexpected privileges escalation (#136)
* Prevent unexpected privileges escalation * Auto Format * Update README.md * Auto Format --------- Co-authored-by: cloudpossebot <[email protected]> Co-authored-by: nitrocode <[email protected]>
1 parent ea8401e commit 31d0b8a

File tree

16 files changed

+393
-189
lines changed

16 files changed

+393
-189
lines changed

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
---
2+
name: Bug report
3+
description: Create a report to help us improve
4+
labels: ["bug"]
5+
assignees: [""]
6+
body:
7+
- type: markdown
8+
attributes:
9+
value: |
10+
Found a bug?
11+
12+
Please checkout our [Slack Community](https://slack.cloudposse.com)
13+
or visit our [Slack Archive](https://archive.sweetops.com/).
14+
15+
[![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com)
16+
17+
- type: textarea
18+
id: concise-description
19+
attributes:
20+
label: Describe the Bug
21+
description: A clear and concise description of what the bug is.
22+
placeholder: What is the bug about?
23+
validations:
24+
required: true
25+
26+
- type: textarea
27+
id: expected
28+
attributes:
29+
label: Expected Behavior
30+
description: A clear and concise description of what you expected.
31+
placeholder: What happened?
32+
validations:
33+
required: true
34+
35+
- type: textarea
36+
id: reproduction-steps
37+
attributes:
38+
label: Steps to Reproduce
39+
description: Steps to reproduce the behavior.
40+
placeholder: How do we reproduce it?
41+
validations:
42+
required: true
43+
44+
- type: textarea
45+
id: screenshots
46+
attributes:
47+
label: Screenshots
48+
description: If applicable, add screenshots or logs to help explain.
49+
validations:
50+
required: false
51+
52+
- type: textarea
53+
id: environment
54+
attributes:
55+
label: Environment
56+
description: Anything that will help us triage the bug.
57+
placeholder: |
58+
- OS: [e.g. Linux, OSX, WSL, etc]
59+
- Version [e.g. 10.15]
60+
- Module version
61+
- Terraform version
62+
validations:
63+
required: false
64+
65+
- type: textarea
66+
id: additional
67+
attributes:
68+
label: Additional Context
69+
description: |
70+
Add any other context about the problem here.
71+
validations:
72+
required: false

‎.github/ISSUE_TEMPLATE/feature_request.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
---
2+
name: Feature Request
3+
description: Suggest an idea for this project
4+
labels: ["feature request"]
5+
assignees: [""]
6+
body:
7+
- type: markdown
8+
attributes:
9+
value: |
10+
Have a question?
11+
12+
Please checkout our [Slack Community](https://slack.cloudposse.com)
13+
or visit our [Slack Archive](https://archive.sweetops.com/).
14+
15+
[![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com)
16+
17+
- type: textarea
18+
id: concise-description
19+
attributes:
20+
label: Describe the Feature
21+
description: A clear and concise description of what the feature is.
22+
placeholder: What is the feature about?
23+
validations:
24+
required: true
25+
26+
- type: textarea
27+
id: expected
28+
attributes:
29+
label: Expected Behavior
30+
description: A clear and concise description of what you expected.
31+
placeholder: What happened?
32+
validations:
33+
required: true
34+
35+
- type: textarea
36+
id: use-case
37+
attributes:
38+
label: Use Case
39+
description: |
40+
Is your feature request related to a problem/challenge you are trying
41+
to solve?
42+
43+
Please provide some additional context of why this feature or
44+
capability will be valuable.
45+
validations:
46+
required: true
47+
48+
- type: textarea
49+
id: ideal-solution
50+
attributes:
51+
label: Describe Ideal Solution
52+
description: A clear and concise description of what you want to happen.
53+
validations:
54+
required: true
55+
56+
- type: textarea
57+
id: alternatives-considered
58+
attributes:
59+
label: Alternatives Considered
60+
description: Explain alternative solutions or features considered.
61+
validations:
62+
required: false
63+
64+
- type: textarea
65+
id: additional
66+
attributes:
67+
label: Additional Context
68+
description: |
69+
Add any other context about the problem here.
70+
validations:
71+
required: false

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,21 @@
11
## what
2-
* Describe high-level what changed as a result of these commits (i.e. in plain-english, what do these changes mean?)
3-
* Use bullet points to be concise and to the point.
2+
3+
<!--
4+
- Describe high-level what changed as a result of these commits (i.e. in plain-english, what do these changes mean?)
5+
- Use bullet points to be concise and to the point.
6+
-->
47

58
## why
6-
* Provide the justifications for the changes (e.g. business case).
7-
* Describe why these changes were made (e.g. why do these commits fix the problem?)
8-
* Use bullet points to be concise and to the point.
9+
10+
<!--
11+
- Provide the justifications for the changes (e.g. business case).
12+
- Describe why these changes were made (e.g. why do these commits fix the problem?)
13+
- Use bullet points to be concise and to the point.
14+
-->
915

1016
## references
11-
* Link to any supporting github issues or helpful documentation to add some context (e.g. stackoverflow).
12-
* Use `closes #123`, if this PR closes a GitHub issue `#123`
1317

18+
<!--
19+
- Link to any supporting github issues or helpful documentation to add some context (e.g. stackoverflow).
20+
- Use `closes #123`, if this PR closes a GitHub issue `#123`
21+
-->

‎.github/workflows/auto-context.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727
make init
2828
make github/init/context.tf
2929
make readme/build
30-
echo "::set-output name=create_pull_request::true"
30+
echo "create_pull_request=true" >> "$GITHUB_OUTPUT"
3131
fi
3232
else
3333
echo "This module has not yet been updated to support the context.tf pattern! Please update in order to support automatic updates."
@@ -37,7 +37,7 @@ jobs:
3737
if: steps.update.outputs.create_pull_request == 'true'
3838
uses: cloudposse/actions/github/[email protected]
3939
with:
40-
token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
40+
token: ${{ secrets.REPO_ACCESS_TOKEN }}
4141
committer: 'cloudpossebot <[email protected]>'
4242
author: 'cloudpossebot <[email protected]>'
4343
commit-message: Update context.tf from origin source

‎.github/workflows/auto-format.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
if: github.event.pull_request.state == 'open'
2020
name: Privileged Checkout
2121
with:
22-
token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
22+
token: ${{ secrets.REPO_ACCESS_TOKEN }}
2323
repository: ${{ github.event.pull_request.head.repo.full_name }}
2424
# Check out the PR commit, not the merge commit
2525
# Use `ref` instead of `sha` to enable pushing back to `ref`
@@ -30,7 +30,7 @@ jobs:
3030
if: github.event.pull_request.state == 'open'
3131
shell: bash
3232
env:
33-
GITHUB_TOKEN: "${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}"
33+
GITHUB_TOKEN: "${{ secrets.REPO_ACCESS_TOKEN }}"
3434
run: make BUILD_HARNESS_PATH=/build-harness PACKAGES_PREFER_HOST=true -f /build-harness/templates/Makefile.build-harness pr/auto-format/host
3535

3636
# Commit changes (if any) to the PR branch
@@ -54,10 +54,10 @@ jobs:
5454
[[ $SENDER == "cloudpossebot" ]] || git push
5555
# Set status to fail, because the push should trigger another status check,
5656
# and we use success to indicate the checks are finished.
57-
printf "::set-output name=%s::%s\n" "changed" "true"
57+
echo "changed=true" >> "$GITHUB_OUTPUT"
5858
exit 1
5959
else
60-
printf "::set-output name=%s::%s\n" "changed" "false"
60+
echo "changed=false" >> "$GITHUB_OUTPUT"
6161
echo "No changes detected"
6262
fi
6363
@@ -75,7 +75,7 @@ jobs:
7575
contains(' 37929162 29139614 11232728 ', format(' {0} ', github.event.pull_request.user.id))
7676
&& steps.commit.outputs.changed == 'false' && github.event.pull_request.state == 'open'
7777
with:
78-
token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
78+
token: ${{ secrets.REPO_ACCESS_TOKEN }}
7979
repository: cloudposse/actions
8080
event-type: test-command
8181
client-payload: |-

‎.github/workflows/auto-readme.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
3030
run: |
3131
default_branch=$(gh repo view --json defaultBranchRef --jq .defaultBranchRef.name)
32-
printf "::set-output name=defaultBranch::%s\n" "${default_branch}"
32+
echo "defaultBranch=${default_branch}" >> "$GITHUB_OUTPUT"
3333
printf "defaultBranchRef.name=%s\n" "${default_branch}"
3434
3535
- name: Update readme
@@ -52,7 +52,7 @@ jobs:
5252
# If a PR of the auto-update/readme branch is open, this action will just update it, not create a new PR.
5353
uses: cloudposse/actions/github/[email protected]
5454
with:
55-
token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
55+
token: ${{ secrets.REPO_ACCESS_TOKEN }}
5656
commit-message: Update README.md and docs
5757
title: Update README.md and docs
5858
body: |-

‎.github/workflows/auto-release.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,12 @@ jobs:
1515
- uses: actions-ecosystem/action-get-merged-pull-request@v1
1616
id: get-merged-pull-request
1717
with:
18-
github_token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
18+
github_token: ${{ secrets.REPO_ACCESS_TOKEN }}
1919
# Drafts your next Release notes as Pull Requests are merged into "main"
2020
- uses: release-drafter/release-drafter@v5
2121
with:
2222
publish: ${{ !contains(steps.get-merged-pull-request.outputs.labels, 'no-release') }}
2323
prerelease: false
2424
config-name: auto-release.yml
2525
env:
26-
GITHUB_TOKEN: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
26+
GITHUB_TOKEN: ${{ secrets.REPO_ACCESS_TOKEN }}

‎.github/workflows/chatops.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
- name: "Handle common commands"
1212
uses: cloudposse/actions/github/[email protected]
1313
with:
14-
token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
14+
token: ${{ secrets.REPO_ACCESS_TOKEN }}
1515
reaction-token: ${{ secrets.GITHUB_TOKEN }}
1616
repository: cloudposse/actions
1717
commands: rebuild-readme, terraform-fmt
@@ -26,7 +26,7 @@ jobs:
2626
- name: "Run tests"
2727
uses: cloudposse/actions/github/[email protected]
2828
with:
29-
token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
29+
token: ${{ secrets.REPO_ACCESS_TOKEN }}
3030
reaction-token: ${{ secrets.GITHUB_TOKEN }}
3131
repository: cloudposse/actions
3232
commands: test

‎.github/workflows/validate-codeowners.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ jobs:
2121
checks: "syntax,owners,duppatterns"
2222
owner_checker_allow_unowned_patterns: "false"
2323
# GitHub access token is required only if the `owners` check is enabled
24-
github_access_token: "${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}"
24+
github_access_token: "${{ secrets.REPO_ACCESS_TOKEN }}"
2525
- uses: mszostok/[email protected]
2626
if: github.event.pull_request.head.repo.full_name != github.repository
2727
name: "Syntax check of CODEOWNERS"

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -329,7 +329,7 @@ Available targets:
329329
| <a name="input_launch_template_version"></a> [launch\_template\_version](#input\_launch\_template\_version) | The version of the specified launch template to use. Defaults to latest version. | `list(string)` | `[]` | no |
330330
| <a name="input_max_size"></a> [max\_size](#input\_max\_size) | Maximum number of worker nodes | `number` | n/a | yes |
331331
| <a name="input_metadata_http_endpoint_enabled"></a> [metadata\_http\_endpoint\_enabled](#input\_metadata\_http\_endpoint\_enabled) | Set false to disable the Instance Metadata Service. | `bool` | `true` | no |
332-
| <a name="input_metadata_http_put_response_hop_limit"></a> [metadata\_http\_put\_response\_hop\_limit](#input\_metadata\_http\_put\_response\_hop\_limit) | The desired HTTP PUT response hop limit (between 1 and 64) for Instance Metadata Service requests.<br>The default is `2` to support containerized workloads. | `number` | `2` | no |
332+
| <a name="input_metadata_http_put_response_hop_limit"></a> [metadata\_http\_put\_response\_hop\_limit](#input\_metadata\_http\_put\_response\_hop\_limit) | The desired HTTP PUT response hop limit (between 1 and 64) for Instance Metadata Service requests.<br>The default is `2` to allows containerized workloads assuming the instance profile, but it's not really recomended. You should use OIDC service accounts instead. | `number` | `2` | no |
333333
| <a name="input_metadata_http_tokens_required"></a> [metadata\_http\_tokens\_required](#input\_metadata\_http\_tokens\_required) | Set true to require IMDS session tokens, disabling Instance Metadata Service Version 1. | `bool` | `true` | no |
334334
| <a name="input_min_size"></a> [min\_size](#input\_min\_size) | Minimum number of worker nodes | `number` | n/a | yes |
335335
| <a name="input_module_depends_on"></a> [module\_depends\_on](#input\_module\_depends\_on) | Can be any value desired. Module will wait for this value to be computed before creating node group. | `any` | `null` | no |
@@ -465,7 +465,7 @@ In general, PRs are welcome. We follow the typical "fork-and-pull" Git workflow.
465465

466466
## Copyright
467467

468-
Copyright © 2017-2022 [Cloud Posse, LLC](https://cpco.io/copyright)
468+
Copyright © 2017-2023 [Cloud Posse, LLC](https://cpco.io/copyright)
469469

470470

471471

0 commit comments

Comments
 (0)