Skip to content

Commit 27b99b4

Browse files
MarkCalvertMarkCalvert
authored
Add shipshape audit workflow (#66)
1 parent ea62062 commit 27b99b4

File tree

3 files changed

+192
-27
lines changed

3 files changed

+192
-27
lines changed

‎.github/workflows/shipshape.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
name: shipshape
2+
3+
on:
4+
workflow_call:
5+
6+
# Add permissions block
7+
permissions:
8+
checks: write
9+
contents: read
10+
pull-requests: write
11+
12+
jobs:
13+
audit:
14+
name: shipshape_audit
15+
runs-on: ubuntu-latest
16+
container:
17+
image: ghcr.io/dpc-sdp/bay/ci-builder:6.x
18+
steps:
19+
- name: Checkout code
20+
uses: actions/checkout@v4
21+
- name: Audit codebase
22+
shell: bash
23+
run: |
24+
# Run shipshape
25+
shipshape run . -f .github/workflows/shipshape/shipshape.yml --output-format table --output-file shipshape-results.xml --output-file-format junit > shipshape-results.txt
26+
- name: Upload audit report
27+
uses: actions/upload-artifact@v4
28+
if: always()
29+
with:
30+
path: shipshape-results.txt
31+
- name: Publish junit report
32+
uses: mikepenz/action-junit-report@v5
33+
if: always()
34+
with:
35+
report_paths: shipshape-results.xml
36+
check_name: Junit Shipshape Audit Report
37+
fail_on_failure: false
38+
require_tests: false
39+
require_passed_tests: false
40+
annotate_only: false

‎.github/workflows/shipshape/shipshape.yml‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
collect:
2+
#---------------------------------------------------------------------------
3+
# CORE EXTENSION CONFIGURATION
4+
#---------------------------------------------------------------------------
5+
# File containing core extension configuration
6+
core-extension-file:
7+
file:read:
8+
path: config/sync/core.extension.yml
9+
10+
# Get the list of modules
11+
modules:
12+
yaml:key:
13+
input: core-extension-file
14+
path: module
15+
keys-only: true
16+
17+
# Get the site profile
18+
profile:
19+
yaml:key:
20+
input: core-extension-file
21+
path: profile
22+
ignore-not-found: true
23+
24+
#---------------------------------------------------------------------------
25+
# LAGOON CONFIGURATION
26+
#---------------------------------------------------------------------------
27+
# Lagoon configuration file
28+
lagoon-file:
29+
file:read:
30+
path: .lagoon.yml
31+
32+
# TLS-ACME settings for different environments
33+
production-tls-acme:
34+
yaml:key:
35+
input: lagoon-file
36+
path: production_routes.active.routes[0].nginx-php[0].*.tls-acme
37+
ignore-not-found: true
38+
39+
master-tls-acme:
40+
yaml:key:
41+
input: lagoon-file
42+
path: environments.master.routes[0].nginx-php[0].*.tls-acme
43+
ignore-not-found: true
44+
45+
uat-tls-acme:
46+
yaml:key:
47+
input: lagoon-file
48+
path: environments.uat.routes[0].nginx-php[0].*.tls-acme
49+
ignore-not-found: true
50+
51+
develop-tls-acme:
52+
yaml:key:
53+
input: lagoon-file
54+
path: environments.develop.routes[0].nginx-php[0].*.tls-acme
55+
ignore-not-found: true
56+
57+
analyse:
58+
#---------------------------------------------------------------------------
59+
# MODULE CHECKS
60+
#---------------------------------------------------------------------------
61+
lagoon-logs-check:
62+
allowed:list:
63+
description: "Lagoon logs module is not enabled"
64+
input: modules
65+
required:
66+
- lagoon_logs
67+
severity: high
68+
69+
#---------------------------------------------------------------------------
70+
# PROFILE CHECKS
71+
#---------------------------------------------------------------------------
72+
tide-profile-check:
73+
regex:not-match:
74+
description: "Verify Tide profile is correctly set"
75+
input: profile
76+
pattern: "^tide$"
77+
severity: high
78+
79+
#---------------------------------------------------------------------------
80+
# TLS-ACME CHECKS
81+
#---------------------------------------------------------------------------
82+
production-tls-acme-check:
83+
regex:not-match:
84+
description: "Verify TLS-ACME is enabled for the production environment"
85+
input: production-tls-acme
86+
pattern: "^false$"
87+
severity: high
88+
89+
master-tls-acme-check:
90+
regex:not-match:
91+
description: "Verify TLS-ACME is enabled for the master environment"
92+
input: master-tls-acme
93+
pattern: "^false$"
94+
severity: high
95+
96+
uat-tls-acme-check:
97+
regex:not-match:
98+
description: "Verify TLS-ACME is enabled for the UAT environment"
99+
input: uat-tls-acme
100+
pattern: "^false$"
101+
severity: high
102+
103+
develop-tls-acme-check:
104+
regex:not-match:
105+
description: "Verify TLS-ACME is enabled for the develop environment"
106+
input: develop-tls-acme
107+
pattern: "^false$"
108+
severity: high

‎.github/workflows/tide_build.yml‎

Lines changed: 44 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: tide_build
22

3-
on:
3+
on:
44
workflow_call:
55
inputs:
66
module_build:
@@ -13,40 +13,51 @@ on:
1313
type: string
1414
required: false
1515
default: biggy
16+
run_shipshape_audit:
17+
description: Set to true to run shipshape audit.
18+
type: boolean
19+
required: false
20+
default: false
1621

1722
env:
1823
REGISTRY: ghcr.io
1924

25+
# Add permissions block with required permissions used for shipshape audit
26+
permissions:
27+
checks: write
28+
contents: read
29+
pull-requests: write
30+
2031
jobs:
2132
check-nginx-config:
2233
name: check-nginx-config
2334
runs-on: ubuntu-latest
2435
steps:
25-
- name: Checkout repository
26-
uses: actions/checkout@v2
27-
- name: Set up Docker
28-
uses: docker/setup-buildx-action@v2
29-
- name: Create Docker network
30-
run: docker network create test-network
31-
- name: Run PHP container
32-
run: docker run -d --name php --network test-network php:7.4-fpm
33-
- name: Run Nginx container with long-running command
34-
run: docker run -d --name nginx-container --network test-network ghcr.io/dpc-sdp/bay/nginx:6.x tail -f /dev/null
35-
- name: Test Nginx configuration Results
36-
run: |
37-
docker exec nginx-container sh -c "nginx -t"
38-
continue-on-error: true
39-
- name: Check Nginx test results
40-
run: |
41-
RESULT=$(docker exec nginx-container sh -c "nginx -t" 2>&1)
42-
echo "$RESULT"
43-
if echo "$RESULT" | grep -q 'successful'; then
44-
echo "Nginx configuration test successful"
45-
else
46-
echo "Nginx configuration test failed"
47-
exit 1
48-
fi
49-
shell: bash
36+
- name: Checkout repository
37+
uses: actions/checkout@v2
38+
- name: Set up Docker
39+
uses: docker/setup-buildx-action@v2
40+
- name: Create Docker network
41+
run: docker network create test-network
42+
- name: Run PHP container
43+
run: docker run -d --name php --network test-network php:7.4-fpm
44+
- name: Run Nginx container with long-running command
45+
run: docker run -d --name nginx-container --network test-network ghcr.io/dpc-sdp/bay/nginx:6.x tail -f /dev/null
46+
- name: Test Nginx configuration Results
47+
run: |
48+
docker exec nginx-container sh -c "nginx -t"
49+
continue-on-error: true
50+
- name: Check Nginx test results
51+
run: |
52+
RESULT=$(docker exec nginx-container sh -c "nginx -t" 2>&1)
53+
echo "$RESULT"
54+
if echo "$RESULT" | grep -q 'successful'; then
55+
echo "Nginx configuration test successful"
56+
else
57+
echo "Nginx configuration test failed"
58+
exit 1
59+
fi
60+
shell: bash
5061

5162
build_tide:
5263
name: tide_build
@@ -91,4 +102,10 @@ jobs:
91102
if: always()
92103
with:
93104
name: behat-results
94-
path: /tmp/artifacts
105+
path: /tmp/artifacts
106+
107+
shipshape-audit:
108+
name: shipshape_audit
109+
if: ${{ inputs.run_shipshape_audit == true }}
110+
uses: ./.github/workflows/shipshape.yml
111+
secrets: inherit

0 commit comments

Comments
 (0)