Lineage pull request for: skeleton #534
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
--- | |
name: build | |
on: | |
merge_group: | |
types: | |
- checks_requested | |
pull_request: | |
push: | |
repository_dispatch: | |
types: | |
- apb | |
# Set a default shell for any run steps. The `-Eueo pipefail` sets errtrace, | |
# nounset, errexit, and pipefail. The `-x` will print all commands as they are | |
# run. Please see the GitHub Actions documentation for more information: | |
# https://docs.github.com/en/actions/using-jobs/setting-default-values-for-jobs | |
defaults: | |
run: | |
shell: bash -Eueo pipefail -x {0} | |
env: | |
PIP_CACHE_DIR: ~/.cache/pip | |
PRE_COMMIT_CACHE_DIR: ~/.cache/pre-commit | |
RUN_TMATE: ${{ secrets.RUN_TMATE }} | |
TERRAFORM_DOCS_REPO_BRANCH_NAME: improvement/support_atx_closed_markdown_headers | |
TERRAFORM_DOCS_REPO_DEPTH: 1 | |
TERRAFORM_DOCS_REPO_URL: https://github.com/mcdonnnj/terraform-docs.git | |
jobs: | |
diagnostics: | |
name: Run diagnostics | |
# This job does not need any permissions | |
permissions: {} | |
runs-on: ubuntu-latest | |
steps: | |
# Note that a duplicate of this step must be added at the top of | |
# each job. | |
- uses: GitHubSecurityLab/actions-permissions/monitor@v1 | |
with: | |
# Uses the organization variable unless overridden | |
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }} | |
# Note that a duplicate of this step must be added at the top of | |
# each job. | |
- id: harden-runner | |
name: Harden the runner | |
uses: step-security/harden-runner@v2 | |
with: | |
egress-policy: audit | |
- id: github-status | |
name: Check GitHub status | |
uses: crazy-max/ghaction-github-status@v4 | |
- id: dump-context | |
name: Dump context | |
uses: crazy-max/ghaction-dump-context@v2 | |
lint: | |
needs: | |
- diagnostics | |
permissions: | |
# actions/checkout needs this to fetch code | |
contents: read | |
runs-on: ubuntu-latest | |
steps: | |
- uses: GitHubSecurityLab/actions-permissions/monitor@v1 | |
with: | |
# Uses the organization variable unless overridden | |
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }} | |
- id: harden-runner | |
name: Harden the runner | |
uses: step-security/harden-runner@v2 | |
with: | |
egress-policy: audit | |
- id: setup-env | |
uses: cisagov/setup-env-github-action@develop | |
- uses: actions/checkout@v4 | |
- id: setup-python | |
uses: actions/setup-python@v5 | |
with: | |
python-version: ${{ steps.setup-env.outputs.python-version }} | |
# We need the Go version and Go cache location for the actions/cache step, | |
# so the Go installation must happen before that. | |
- id: setup-go | |
uses: actions/setup-go@v5 | |
with: | |
# There is no expectation for actual Go code so we disable caching as | |
# it relies on the existence of a go.sum file. | |
cache: false | |
go-version: ${{ steps.setup-env.outputs.go-version }} | |
- id: go-cache | |
name: Lookup Go cache directory | |
run: | | |
echo "dir=$(go env GOCACHE)" >> $GITHUB_OUTPUT | |
- uses: actions/cache@v4 | |
env: | |
BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\ | |
py${{ steps.setup-python.outputs.python-version }}-\ | |
go${{ steps.setup-go.outputs.go-version }}-\ | |
packer${{ steps.setup-env.outputs.packer-version }}-\ | |
tf${{ steps.setup-env.outputs.terraform-version }}-" | |
with: | |
key: "${{ env.BASE_CACHE_KEY }}\ | |
${{ hashFiles('**/requirements-test.txt') }}-\ | |
${{ hashFiles('**/requirements.txt') }}-\ | |
${{ hashFiles('**/.pre-commit-config.yaml') }}" | |
# Note that the .terraform directory IS NOT included in the | |
# cache because if we were caching, then we would need to use | |
# the `-upgrade=true` option. This option blindly pulls down the | |
# latest modules and providers instead of checking to see if an | |
# update is required. That behavior defeats the benefits of caching. | |
# so there is no point in doing it for the .terraform directory. | |
path: | | |
${{ env.PIP_CACHE_DIR }} | |
${{ env.PRE_COMMIT_CACHE_DIR }} | |
${{ steps.go-cache.outputs.dir }} | |
restore-keys: | | |
${{ env.BASE_CACHE_KEY }} | |
- uses: hashicorp/setup-packer@v3 | |
with: | |
version: ${{ steps.setup-env.outputs.packer-version }} | |
- uses: hashicorp/setup-terraform@v3 | |
with: | |
terraform_version: ${{ steps.setup-env.outputs.terraform-version }} | |
- name: Install go-critic | |
env: | |
PACKAGE_URL: github.com/go-critic/go-critic/cmd/gocritic | |
PACKAGE_VERSION: ${{ steps.setup-env.outputs.go-critic-version }} | |
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION} | |
- name: Install goimports | |
env: | |
PACKAGE_URL: golang.org/x/tools/cmd/goimports | |
PACKAGE_VERSION: ${{ steps.setup-env.outputs.goimports-version }} | |
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION} | |
- name: Install gosec | |
env: | |
PACKAGE_URL: github.com/securego/gosec/v2/cmd/gosec | |
PACKAGE_VERSION: ${{ steps.setup-env.outputs.gosec-version }} | |
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION} | |
- name: Install staticcheck | |
env: | |
PACKAGE_URL: honnef.co/go/tools/cmd/staticcheck | |
PACKAGE_VERSION: ${{ steps.setup-env.outputs.staticcheck-version }} | |
run: go install ${PACKAGE_URL}@${PACKAGE_VERSION} | |
# TODO: https://github.com/cisagov/skeleton-generic/issues/165 | |
# We are temporarily using @mcdonnnj's forked branch of terraform-docs | |
# until his PR: https://github.com/terraform-docs/terraform-docs/pull/745 | |
# is approved. This temporary fix will allow for ATX header support when | |
# terraform-docs is run during linting. | |
- name: Clone ATX headers branch from terraform-docs fork | |
run: | | |
git clone \ | |
--branch $TERRAFORM_DOCS_REPO_BRANCH_NAME \ | |
--depth $TERRAFORM_DOCS_REPO_DEPTH \ | |
--single-branch \ | |
$TERRAFORM_DOCS_REPO_URL /tmp/terraform-docs | |
- name: Build and install terraform-docs binary | |
run: | | |
go build \ | |
-C /tmp/terraform-docs \ | |
-o $(go env GOPATH)/bin/terraform-docs | |
- name: Install dependencies | |
run: | | |
python -m pip install --upgrade pip setuptools wheel | |
pip install --upgrade --requirement requirements-test.txt | |
- name: Set up pre-commit hook environments | |
run: pre-commit install-hooks | |
- name: Run pre-commit on all files | |
run: pre-commit run --all-files | |
- name: Setup tmate debug session | |
uses: mxschmitt/action-tmate@v3 | |
if: env.RUN_TMATE | |
test: | |
name: >- | |
test (${{ matrix.scenario }}) - | |
${{ matrix.platform }}-${{ matrix.architecture }} | |
needs: | |
- diagnostics | |
permissions: | |
# actions/checkout needs this to fetch code | |
contents: read | |
runs-on: ubuntu-${{ startsWith(matrix.architecture, 'arm') && '24.04-arm' || 'latest' }} | |
strategy: | |
fail-fast: false | |
matrix: | |
architecture: | |
- amd64 | |
- arm64 | |
platform: | |
- amazonlinux2023-systemd | |
- debian10-systemd | |
- debian11-systemd | |
- debian12-systemd | |
# TODO: Docker does not yet officially support Debian | |
# Trixie, but we should add support when that becomes | |
# possible. See | |
# https://docs.docker.com/engine/install/debian/ and | |
# cisagov/ansible-role-docker#79 for more details. | |
# - debian13-systemd | |
- fedora39-systemd | |
- fedora40-systemd | |
- fedora41-systemd | |
- kali-systemd | |
- ubuntu-20-systemd | |
- ubuntu-22-systemd | |
- ubuntu-24-systemd | |
scenario: | |
- default | |
steps: | |
- uses: GitHubSecurityLab/actions-permissions/monitor@v1 | |
with: | |
# Uses the organization variable unless overridden | |
config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }} | |
- id: harden-runner | |
name: Harden the runner | |
uses: step-security/harden-runner@v2 | |
with: | |
egress-policy: audit | |
- id: setup-env | |
uses: cisagov/setup-env-github-action@develop | |
- uses: actions/checkout@v4 | |
- id: setup-python | |
uses: actions/setup-python@v5 | |
with: | |
python-version: ${{ steps.setup-env.outputs.python-version }} | |
- uses: actions/cache@v4 | |
env: | |
BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\ | |
py${{ steps.setup-python.outputs.python-version }}-" | |
with: | |
path: ${{ env.PIP_CACHE_DIR }} | |
key: "${{ env.BASE_CACHE_KEY }}\ | |
${{ hashFiles('**/requirements-test.txt') }}-\ | |
${{ hashFiles('**/requirements.txt') }}" | |
restore-keys: | | |
${{ env.BASE_CACHE_KEY }} | |
- name: Install dependencies | |
run: | | |
python -m pip install --upgrade pip | |
pip install --upgrade --requirement requirements-test.txt | |
- name: Set up QEMU | |
uses: docker/setup-qemu-action@v3 | |
- name: Set up Docker Buildx | |
uses: docker/setup-buildx-action@v3 | |
# Disabling the unix-chkpwd AppArmor profile is necessary when | |
# running Molecule tests against Fedora 40 and 41; otherwise, | |
# the privileged container cannot successfully run sudo and | |
# hence Ansible is unable to do anything. See | |
# fedora-cloud/docker-brew-fedora#117 for more details. | |
# | |
# Purging firefox is currently necessary because the | |
# installation available on the GitHub runner instance provides | |
# two conflicting AppArmor profiles: | |
# /etc/apparmor.d/usr.bin.firefox and /etc/apparmor.d/firefox. | |
# This conflict causes the aa-disable /usr/sbin/unix_chkpwd | |
# command to fail. | |
# | |
# Purging passt is currently necessary because the installation | |
# available on the GitHub runner instance contains a wonky | |
# AppArmor file (/etc/apparmor.d/abstractions/passt) that causes | |
# the aa-disable command to fail. | |
# | |
# TODO: Remove the apt-get purge and systemctl reload commands | |
# when possible. See cisagov/skeleton-ansible-role#215 for more | |
# details. | |
- name: Disable unix-chkpwd AppArmor profile | |
run: | | |
sudo apt-get purge firefox passt | |
sudo systemctl reload apparmor.service | |
sudo apt-get install apparmor-utils | |
sudo aa-disable /usr/sbin/unix_chkpwd | |
if: ${{ startsWith(matrix.platform, 'fedora') }} | |
- name: Run molecule tests | |
run: >- | |
molecule test | |
--platform-name ${{ matrix.platform }}-${{ matrix.architecture }} | |
--scenario-name ${{ matrix.scenario }} | |
# TODO: Remove the apt-get install command when possible. See | |
# cisagov/skeleton-ansible-role#215 for more details. | |
- name: Re-enable unix-chkpwd AppArmor profile | |
run: | | |
sudo aa-enforce /usr/sbin/unix_chkpwd | |
sudo apt-get install firefox passt | |
if: ${{ startsWith(matrix.platform, 'fedora') }} | |
- name: Setup tmate debug session | |
uses: mxschmitt/action-tmate@v3 | |
if: env.RUN_TMATE |