Skip to content

Commit d8dcd78

Browse files
galarghgalargh
committed
Merge remote-tracking branch 'origin/main' into feat/dynamic-pool
2 parents 7ff988b + cadd6e3 commit d8dcd78

File tree

278 files changed

+25578
-14742
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

278 files changed

+25578
-14742
lines changed

‎.ci/terraform-init-all.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@
44
# required to run tflint via pre-commit
55

66
# only run the script if a uniique pid file exits if not creat it or --force flag is passed
7-
pid="/tmp/philips-labs-terraform-aws-github-runner.pid"
7+
pid="/tmp/github-aws-runners-terraform-aws-github-runner.pid"
88
if [ "$1" == "--force" ]; then
9-
rm -f /tmp/philips-labs-terraform-aws-github-runner.pid
9+
rm -f /tmp/github-aws-runners-terraform-aws-github-runner.pid
1010
fi
1111

1212
if [ ! -f $pid ]; then

‎.github/dependabot.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,17 @@ updates:
2727
octokit:
2828
patterns:
2929
- "@octokit/*"
30+
aws-powertools:
31+
patterns:
32+
- "@aws-lambda-powertools/*"
33+
34+
ignore:
35+
- dependency-name: "@middy/core"
36+
update-types: ["version-update:semver-major"]
37+
- dependency-name: "@octokit/*"
38+
update-types: ["version-update:semver-major"]
39+
- dependency-name: "eslint"
40+
update-types: ["version-update:semver-major"]
3041
commit-message:
3142
prefix: "fix(lambda)"
3243
prefix-development: "chore(lambda)"

‎.github/workflows/actions.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: Lint GitHub Actions
2+
3+
on:
4+
push:
5+
paths:
6+
- '.github/workflows/*.ya?ml'
7+
branches:
8+
- main
9+
pull_request:
10+
paths:
11+
- '.github/workflows/*.ya?ml'
12+
13+
concurrency:
14+
group: "actionlint-${{ github.ref }}"
15+
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
16+
17+
permissions: {}
18+
19+
jobs:
20+
lint:
21+
runs-on: ubuntu-latest
22+
permissions:
23+
contents: read
24+
steps:
25+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
26+
with:
27+
persist-credentials: false
28+
29+
- name: lint wit zizmor
30+
run: |
31+
pipx install zizmor
32+
zizmor --gh-token ${{ secrets.GITHUB_TOKEN }} --format sarif . > results.sarif || true
33+
34+
- name: Upload SARIF file
35+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
36+
with:
37+
name: results.sarif
38+
path: results.sarif
39+
40+
upload:
41+
needs: lint
42+
runs-on: ubuntu-latest
43+
permissions:
44+
contents: read
45+
security-events: write
46+
steps:
47+
- name: Download SARIF file
48+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
49+
with:
50+
name: results.sarif
51+
path: results.sarif
52+
53+
- name: Upload SARIF file
54+
uses: github/codeql-action/upload-sarif@f6091c0113d1dcf9b98e269ee48e8a7e51b7bdd4 # v3.28.5
55+
with:
56+
sarif_file: results.sarif
57+
category: actions-zizmor

‎.github/workflows/auto-approve-dependabot.yml‎

Lines changed: 0 additions & 17 deletions
This file was deleted.

‎.github/workflows/codeql.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: "CodeQL Advanced"
2+
3+
on:
4+
push:
5+
branches: [ "main", "develop", "v1" ]
6+
pull_request:
7+
branches: [ "main", "develop", "v1" ]
8+
paths-ignore:
9+
- '**/*.md'
10+
schedule:
11+
- cron: '25 19 * * 2'
12+
13+
jobs:
14+
analyze:
15+
name: Analyze (${{ matrix.language }})
16+
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
17+
permissions:
18+
# required for all workflows
19+
security-events: write
20+
21+
strategy:
22+
fail-fast: false
23+
matrix:
24+
language: ['javascript-typescript', 'actions']
25+
26+
steps:
27+
- name: Checkout repository
28+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
29+
with:
30+
persist-credentials: false
31+
32+
# Initializes the CodeQL tools for scanning.
33+
- name: Initialize CodeQL
34+
uses: github/codeql-action/init@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
35+
with:
36+
languages: ${{ matrix.language }}
37+
build-mode: none
38+
39+
- name: Perform CodeQL Analysis
40+
uses: github/codeql-action/analyze@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
41+
with:
42+
category: "/language:${{matrix.language}}"

‎.github/workflows/lambda.yml‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,32 @@
11
name: Build lambdas
2+
23
on:
34
pull_request:
45
branches:
56
- main
67
paths:
78
- 'lambdas/**'
9+
- '.github/workflows/lambda.yml'
10+
11+
permissions:
12+
contents: read
813

914
jobs:
1015
build:
1116
runs-on: ubuntu-latest
1217
strategy:
1318
matrix:
14-
node: [20]
19+
node: [22]
1520
container:
1621
image: node:${{ matrix.node }}
1722
defaults:
1823
run:
1924
working-directory: ./lambdas
2025

2126
steps:
22-
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v3.2.0
27+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
28+
with:
29+
persist-credentials: false
2330
- name: Install dependencies
2431
run: yarn install --frozen-lockfile
2532
- name: Run prettier
@@ -32,7 +39,7 @@ jobs:
3239
- name: Build distribution
3340
run: yarn build
3441
- name: Upload coverage report
35-
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v31.2
42+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
3643
if: ${{ failure() }}
3744
with:
3845
name: coverage-reports

‎.github/workflows/packer-build.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,15 +8,19 @@ on:
88
- "images/**"
99
- ".github/workflows/packer-build.yml"
1010
- "module/runners/templates/**"
11+
permissions:
12+
contents: read
13+
1114
env:
1215
AWS_REGION: eu-west-1
1316
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
17+
1418
jobs:
1519
verify_packer:
1620
name: Verify packer
1721
runs-on: ubuntu-latest
1822
container:
19-
image: index.docker.io/hashicorp/packer@sha256:297bbbbbbf3ce9e0431ac1e8f02934b20e1197613f877b55dfdb1ebfd94eb748 # ratchet:index.docker.io/hashicorp/packer:1.8.6
23+
image: index.docker.io/hashicorp/packer@sha256:12c441b8a3994e7df9f0e2692d9298f14c387e70bcc06139420977dbf80a137b # 1.11.2
2024
strategy:
2125
matrix:
2226
image: ["linux-al2023", "windows-core-2019", "windows-core-2022", "ubuntu-focal", "ubuntu-jammy", "ubuntu-jammy-arm64"]
@@ -25,7 +29,9 @@ jobs:
2529
working-directory: images/${{ matrix.image }}
2630
steps:
2731
- name: "Checkout"
28-
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # ratchet:actions/checkout@v4
32+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
33+
with:
34+
persist-credentials: false
2935
- name: packer init
3036
run: packer init .
3137
- name: check packer formatting

‎.github/workflows/release.yml‎

Lines changed: 38 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -13,37 +13,64 @@ jobs:
1313
permissions:
1414
contents: write
1515
actions: write
16+
id-token: write
17+
attestations: write
1618
steps:
17-
- uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
19+
- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
1820
with:
19-
node-version: 20
20-
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # ratchet:actions/checkout@v4
21+
node-version: 22
22+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
23+
with:
24+
persist-credentials: false
2125
- name: Build dist
2226
working-directory: lambdas
2327
run: yarn install --frozen-lockfile && yarn run test && yarn dist
2428
- name: Get installation token
25-
uses: philips-software/app-token-action@9f5d57062c9f2beaffafaa9a34f66f824ead63a9 # ratchet:philips-software/[email protected]
29+
uses: actions/create-github-app-token@136412a57a7081aa63c935a2cc2918f76c34f514 # v1.11.2
2630
id: token
2731
with:
28-
app_id: ${{ secrets.FOREST_RELEASER_APP_ID }}
29-
app_base64_private_key: ${{ secrets.FOREST_RELEASER_APP_PRIVATE_KEY_BASE64 }}
30-
auth_type: installation
32+
app-id: ${{ vars.RELEASER_APP_ID }}
33+
private-key: ${{ secrets.RELEASER_APP_PRIVATE_KEY }}
3134
- name: Extract branch name
3235
id: branch
3336
shell: bash
3437
run: echo "name=${GITHUB_REF#refs/heads/}" >> $GITHUB_OUTPUT
3538
- name: Release
3639
id: release
37-
uses: google-github-actions/release-please-action@a37ac6e4f6449ce8b3f7607e4d97d0146028dc0b # ratchet:google-github-actions/release-please-action@v3
40+
uses: googleapis/release-please-action@7987652d64b4581673a76e33ad5e98e3dd56832f # v4.1.3
3841
with:
39-
default-branch: ${{ steps.branch.outputs.name }}
42+
target-branch: ${{ steps.branch.outputs.name }}
4043
release-type: terraform-module
4144
token: ${{ steps.token.outputs.token }}
42-
- name: Upload Release Asset
45+
- name: Attest
46+
if: ${{ steps.release.outputs.releases_created == 'true' }}
47+
id: attest
48+
uses: actions/attest-build-provenance@520d128f165991a6c774bcb264f323e3d70747f4 # v2.2.0
49+
with:
50+
subject-path: '${{ github.workspace }}/lambdas/functions/**/*.zip'
51+
- name: Update release notes with attestation
52+
if: ${{ steps.release.outputs.releases_created == 'true' }}
53+
env:
54+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
55+
VERSION: ${{ github.event.inputs.version }}
56+
TAG_NAME: ${{ steps.release.outputs.tag_name }}
57+
ATTESTATION_URL: ${{ steps.attest.outputs.attestation-url }}
58+
run: |
59+
version="${VERSION}"
60+
tag_name="${TAG_NAME}"
61+
attestation_url="${ATTESTATION_URL}"
62+
gh release view $version --json body -q '.body' > new-release-notes.md
63+
echo "## Attestation" >> new-release-notes.md
64+
echo "Attestation url: $attestation_url" >> new-release-notes.md
65+
echo "Verify the artifacts by running \`gh attest verify <name_of_artifact> --repo ${{ github.repository }}\`" >> new-release-notes.md
66+
gh release edit $tag_name -F new-release-notes.md -t $tag_name
67+
- name: Upload release assets
4368
if: ${{ steps.release.outputs.releases_created == 'true' }}
4469
env:
4570
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
71+
TAG_NAME: ${{ steps.release.outputs.tag_name }}
4672
run: |
73+
tag_name="${TAG_NAME}"
4774
for f in $(find . -name '*.zip'); do
48-
gh release upload ${{ steps.release.outputs.tag_name }} $f
75+
gh release upload $tag_name $f
4976
done

‎.github/workflows/semantic-check.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,10 @@ jobs:
1313
name: Semantic Commit Message Check
1414
runs-on: ubuntu-latest
1515
steps:
16-
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # ratchet:actions/checkout@v4
17-
- uses: amannn/action-semantic-pull-request@cfb60706e18bc85e8aec535e3c577abe8f70378e # ratchet:amannn/action-semantic-pull-request@v5
16+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
17+
with:
18+
persist-credentials: false
19+
- uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017 # v5.5.3
1820
name: Check PR for Semantic Commit Message
1921
env:
2022
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/stale.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,15 +10,15 @@ jobs:
1010
stale:
1111
runs-on: ubuntu-latest
1212
steps:
13-
- uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # ratchet:actions/stale@v7
13+
- uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
1414
with:
1515
stale-issue-message: >
1616
This issue has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed if no further activity occurs. Thank you for your contributions.
1717
1818
stale-pr-message: >
1919
This pull request has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed if no further activity occurs. Thank you for your contributions.
2020
21-
days-before-stale: 30
22-
days-before-close: 10
21+
days-before-stale: 90
22+
days-before-close: 14
2323
close-issue-label: "abandoned"
2424
exempt-issue-labels: "stale:exempt"

0 commit comments

Comments
 (0)