Skip to content

Commit dfdcbb3

Browse files
authored
Bc compliance (#81)
* workflows updated * readme updated, BC compliance checks fixed
1 parent b0a03e7 commit dfdcbb3

File tree

13 files changed

+161
-18
lines changed

13 files changed

+161
-18
lines changed

.github/auto-release.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,3 +43,11 @@ change-template: |
4343
4444
template: |
4545
$CHANGES
46+
47+
replacers:
48+
# Remove irrelevant information from Renovate bot
49+
- search: '/---\s+^#.*Renovate configuration(?:.|\n)*?This PR has been generated .*/gm'
50+
replace: ''
51+
# Remove Renovate bot banner image
52+
- search: '/\[!\[[^\]]*Renovate\][^\]]*\](\([^)]*\))?\s*\n+/gm'
53+
replace: ''

.github/mergify.yml

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,16 @@
1+
# https://docs.mergify.io/conditions.html
2+
# https://docs.mergify.io/actions.html
13
pull_request_rules:
24
- name: "approve automated PRs that have passed checks"
35
conditions:
4-
- "check-success~=test/bats"
5-
- "check-success~=test/readme"
6-
- "check-success~=test/terratest"
6+
- "author~=^(cloudpossebot|renovate\\[bot\\])$"
77
- "base=master"
8-
- "author=cloudpossebot"
9-
- "head~=auto-update/.*"
8+
- "-closed"
9+
- "head~=^(auto-update|renovate)/.*"
10+
- "check-success=test/bats"
11+
- "check-success=test/readme"
12+
- "check-success=test/terratest"
13+
- "check-success=validate-codeowners"
1014
actions:
1115
review:
1216
type: "APPROVE"
@@ -15,16 +19,17 @@ pull_request_rules:
1519

1620
- name: "merge automated PRs when approved and tests pass"
1721
conditions:
18-
- "check-success~=test/bats"
19-
- "check-success~=test/readme"
20-
- "check-success~=test/terratest"
22+
- "author~=^(cloudpossebot|renovate\\[bot\\])$"
2123
- "base=master"
22-
- "head~=auto-update/.*"
24+
- "-closed"
25+
- "head~=^(auto-update|renovate)/.*"
26+
- "check-success=test/bats"
27+
- "check-success=test/readme"
28+
- "check-success=test/terratest"
29+
- "check-success=validate-codeowners"
2330
- "#approved-reviews-by>=1"
2431
- "#changes-requested-reviews-by=0"
2532
- "#commented-reviews-by=0"
26-
- "base=master"
27-
- "author=cloudpossebot"
2833
actions:
2934
merge:
3035
method: "squash"
@@ -38,6 +43,7 @@ pull_request_rules:
3843
- name: "ask to resolve conflict"
3944
conditions:
4045
- "conflict"
46+
- "-closed"
4147
actions:
4248
comment:
4349
message: "This pull request is now in conflict. Could you fix it @{{author}}? 🙏"

.github/renovate.json

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"extends": [
3+
"config:base",
4+
":preserveSemverRanges"
5+
],
6+
"labels": ["auto-update"],
7+
"enabledManagers": ["terraform"],
8+
"terraform": {
9+
"ignorePaths": ["**/context.tf", "examples/**"]
10+
}
11+
}
12+

.github/workflows/auto-context.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,17 +27,19 @@ jobs:
2727
make init
2828
make github/init/context.tf
2929
make readme/build
30-
echo "::set-output name=create_pull_request=true"
30+
echo "::set-output name=create_pull_request::true"
3131
fi
3232
else
3333
echo "This module has not yet been updated to support the context.tf pattern! Please update in order to support automatic updates."
3434
fi
3535
3636
- name: Create Pull Request
37-
if: {{ steps.update.outputs.create_pull_request == 'true' }}
37+
if: steps.update.outputs.create_pull_request == 'true'
3838
uses: cloudposse/actions/github/[email protected]
3939
with:
4040
token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
41+
committer: 'cloudpossebot <[email protected]>'
42+
author: 'cloudpossebot <[email protected]>'
4143
commit-message: Update context.tf from origin source
4244
title: Update context.tf
4345
body: |-

.github/workflows/auto-format.yml

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
name: Auto Format
2+
on:
3+
pull_request_target:
4+
types: [opened, synchronize]
5+
6+
jobs:
7+
auto-format:
8+
runs-on: ubuntu-latest
9+
container: cloudposse/build-harness:slim-latest
10+
steps:
11+
# Checkout the pull request branch
12+
# "An action in a workflow run can’t trigger a new workflow run. For example, if an action pushes code using
13+
# the repository’s GITHUB_TOKEN, a new workflow will not run even when the repository contains
14+
# a workflow configured to run when push events occur."
15+
# However, using a personal access token will cause events to be triggered.
16+
# We need that to ensure a status gets posted after the auto-format commit.
17+
# We also want to trigger tests if the auto-format made no changes.
18+
- uses: actions/checkout@v2
19+
if: github.event.pull_request.state == 'open'
20+
name: Privileged Checkout
21+
with:
22+
token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
23+
repository: ${{ github.event.pull_request.head.repo.full_name }}
24+
# Check out the PR commit, not the merge commit
25+
# Use `ref` instead of `sha` to enable pushing back to `ref`
26+
ref: ${{ github.event.pull_request.head.ref }}
27+
28+
# Do all the formatting stuff
29+
- name: Auto Format
30+
if: github.event.pull_request.state == 'open'
31+
shell: bash
32+
run: make BUILD_HARNESS_PATH=/build-harness PACKAGES_PREFER_HOST=true -f /build-harness/templates/Makefile.build-harness pr/auto-format/host
33+
34+
# Commit changes (if any) to the PR branch
35+
- name: Commit changes to the PR branch
36+
if: github.event.pull_request.state == 'open'
37+
shell: bash
38+
id: commit
39+
env:
40+
SENDER: ${{ github.event.sender.login }}
41+
run: |
42+
set -x
43+
output=$(git diff --name-only)
44+
45+
if [ -n "$output" ]; then
46+
echo "Changes detected. Pushing to the PR branch"
47+
git config --global user.name 'cloudpossebot'
48+
git config --global user.email '[email protected]'
49+
git add -A
50+
git commit -m "Auto Format"
51+
# Prevent looping by not pushing changes in response to changes from cloudpossebot
52+
[[ $SENDER == "cloudpossebot" ]] || git push
53+
# Set status to fail, because the push should trigger another status check,
54+
# and we use success to indicate the checks are finished.
55+
printf "::set-output name=%s::%s\n" "changed" "true"
56+
exit 1
57+
else
58+
printf "::set-output name=%s::%s\n" "changed" "false"
59+
echo "No changes detected"
60+
fi
61+
62+
- name: Auto Test
63+
uses: cloudposse/actions/github/[email protected]
64+
# match users by ID because logins (user names) are inconsistent,
65+
# for example in the REST API Renovate Bot is `renovate[bot]` but
66+
# in GraphQL it is just `renovate`, plus there is a non-bot
67+
# user `renovate` with ID 1832810.
68+
# Mergify bot: 37929162
69+
# Renovate bot: 29139614
70+
# Cloudpossebot: 11232728
71+
# Need to use space separators to prevent "21" from matching "112144"
72+
if: >
73+
contains(' 37929162 29139614 11232728 ', format(' {0} ', github.event.pull_request.user.id))
74+
&& steps.commit.outputs.changed == 'false' && github.event.pull_request.state == 'open'
75+
with:
76+
token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
77+
repository: cloudposse/actions
78+
event-type: test-command
79+
client-payload: |-
80+
{ "slash_command":{"args": {"unnamed": {"all": "all", "arg1": "all"}}},
81+
"pull_request": ${{ toJSON(github.event.pull_request) }},
82+
"github":{"payload":{"repository": ${{ toJSON(github.event.repository) }},
83+
"comment": {"id": ""}
84+
}
85+
}
86+
}

.github/workflows/auto-release.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ on:
66
- master
77

88
jobs:
9-
semver:
9+
publish:
1010
runs-on: ubuntu-latest
1111
steps:
1212
# Drafts your next Release notes as Pull Requests are merged into "master"

.github/workflows/validate-codeowners.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,17 @@ jobs:
99
- name: "Checkout source code at current commit"
1010
uses: actions/checkout@v2
1111
- uses: mszostok/[email protected]
12+
if: github.event.pull_request.head.repo.full_name == github.repository
13+
name: "Full check of CODEOWNERS"
1214
with:
1315
# For now, remove "files" check to allow CODEOWNERS to specify non-existent
1416
# files so we can use the same CODEOWNERS file for Terraform and non-Terraform repos
1517
# checks: "files,syntax,owners,duppatterns"
1618
checks: "syntax,owners,duppatterns"
1719
# GitHub access token is required only if the `owners` check is enabled
1820
github_access_token: "${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}"
21+
- uses: mszostok/[email protected]
22+
if: github.event.pull_request.head.repo.full_name != github.repository
23+
name: "Syntax check of CODEOWNERS"
24+
with:
25+
checks: "syntax,duppatterns"

.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
# Compiled files
22
*.tfstate
33
*.tfstate.backup
4+
**/.terraform.lock.hcl
45

56
# Module directory
67
.terraform/

README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -256,7 +256,7 @@ Available targets:
256256
| block\_public\_policy | Whether Amazon S3 should block public bucket policies for this bucket | `bool` | `true` | no |
257257
| context | Single object for setting entire context at once.<br>See description of individual variables for details.<br>Leave string and numeric variables as `null` to use default value.<br>Individual variable settings (non-null) override settings in context object,<br>except for attributes, tags, and additional\_tag\_map, which are merged. | <pre>object({<br> enabled = bool<br> namespace = string<br> environment = string<br> stage = string<br> name = string<br> delimiter = string<br> attributes = list(string)<br> tags = map(string)<br> additional_tag_map = map(string)<br> regex_replace_chars = string<br> label_order = list(string)<br> id_length_limit = number<br> })</pre> | <pre>{<br> "additional_tag_map": {},<br> "attributes": [],<br> "delimiter": null,<br> "enabled": true,<br> "environment": null,<br> "id_length_limit": null,<br> "label_order": [],<br> "name": null,<br> "namespace": null,<br> "regex_replace_chars": null,<br> "stage": null,<br> "tags": {}<br>}</pre> | no |
258258
| delimiter | Delimiter to be used between `namespace`, `environment`, `stage`, `name` and `attributes`.<br>Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |
259-
| enable\_point\_in\_time\_recovery | Enable DynamoDB point-in-time recovery | `bool` | `false` | no |
259+
| enable\_point\_in\_time\_recovery | Enable DynamoDB point-in-time recovery | `bool` | `true` | no |
260260
| enable\_public\_access\_block | Enable Bucket Public Access Block | `bool` | `true` | no |
261261
| enable\_server\_side\_encryption | Enable DynamoDB server-side encryption | `bool` | `true` | no |
262262
| enabled | Set to false to prevent the module from creating any resources | `bool` | `null` | no |
@@ -265,6 +265,7 @@ Available targets:
265265
| id\_length\_limit | Limit `id` to this many characters.<br>Set to `0` for unlimited length.<br>Set to `null` for default, which is `0`.<br>Does not affect `id_full`. | `number` | `null` | no |
266266
| ignore\_public\_acls | Whether Amazon S3 should ignore public ACLs for this bucket | `bool` | `true` | no |
267267
| label\_order | The naming order of the id output and Name tag.<br>Defaults to ["namespace", "environment", "stage", "name", "attributes"].<br>You can omit any of the 5 elements, but at least one must be present. | `list(string)` | `null` | no |
268+
| logging | Bucket access logging configuration. | <pre>object({<br> bucket_name = string<br> prefix = string<br> })</pre> | `null` | no |
268269
| mfa\_delete | A boolean that indicates that versions of S3 objects can only be deleted with MFA. ( Terraform cannot apply changes of this value; https://github.com/terraform-providers/terraform-provider-aws/issues/629 ) | `bool` | `false` | no |
269270
| name | Solution name, e.g. 'app' or 'jenkins' | `string` | `null` | no |
270271
| namespace | Namespace, which could be your organization name or abbreviation, e.g. 'eg' or 'cp' | `string` | `null` | no |

docs/terraform.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
| block\_public\_policy | Whether Amazon S3 should block public bucket policies for this bucket | `bool` | `true` | no |
3030
| context | Single object for setting entire context at once.<br>See description of individual variables for details.<br>Leave string and numeric variables as `null` to use default value.<br>Individual variable settings (non-null) override settings in context object,<br>except for attributes, tags, and additional\_tag\_map, which are merged. | <pre>object({<br> enabled = bool<br> namespace = string<br> environment = string<br> stage = string<br> name = string<br> delimiter = string<br> attributes = list(string)<br> tags = map(string)<br> additional_tag_map = map(string)<br> regex_replace_chars = string<br> label_order = list(string)<br> id_length_limit = number<br> })</pre> | <pre>{<br> "additional_tag_map": {},<br> "attributes": [],<br> "delimiter": null,<br> "enabled": true,<br> "environment": null,<br> "id_length_limit": null,<br> "label_order": [],<br> "name": null,<br> "namespace": null,<br> "regex_replace_chars": null,<br> "stage": null,<br> "tags": {}<br>}</pre> | no |
3131
| delimiter | Delimiter to be used between `namespace`, `environment`, `stage`, `name` and `attributes`.<br>Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |
32-
| enable\_point\_in\_time\_recovery | Enable DynamoDB point-in-time recovery | `bool` | `false` | no |
32+
| enable\_point\_in\_time\_recovery | Enable DynamoDB point-in-time recovery | `bool` | `true` | no |
3333
| enable\_public\_access\_block | Enable Bucket Public Access Block | `bool` | `true` | no |
3434
| enable\_server\_side\_encryption | Enable DynamoDB server-side encryption | `bool` | `true` | no |
3535
| enabled | Set to false to prevent the module from creating any resources | `bool` | `null` | no |
@@ -38,6 +38,7 @@
3838
| id\_length\_limit | Limit `id` to this many characters.<br>Set to `0` for unlimited length.<br>Set to `null` for default, which is `0`.<br>Does not affect `id_full`. | `number` | `null` | no |
3939
| ignore\_public\_acls | Whether Amazon S3 should ignore public ACLs for this bucket | `bool` | `true` | no |
4040
| label\_order | The naming order of the id output and Name tag.<br>Defaults to ["namespace", "environment", "stage", "name", "attributes"].<br>You can omit any of the 5 elements, but at least one must be present. | `list(string)` | `null` | no |
41+
| logging | Bucket access logging configuration. | <pre>object({<br> bucket_name = string<br> prefix = string<br> })</pre> | `null` | no |
4142
| mfa\_delete | A boolean that indicates that versions of S3 objects can only be deleted with MFA. ( Terraform cannot apply changes of this value; https://github.com/terraform-providers/terraform-provider-aws/issues/629 ) | `bool` | `false` | no |
4243
| name | Solution name, e.g. 'app' or 'jenkins' | `string` | `null` | no |
4344
| namespace | Namespace, which could be your organization name or abbreviation, e.g. 'eg' or 'cp' | `string` | `null` | no |

0 commit comments

Comments
 (0)