From 3f0baad34222d42c706db3610e81dcf1201b3963 Mon Sep 17 00:00:00 2001 From: Sharon <42342605+sharonstout1981@users.noreply.github.com> Date: Tue, 8 Aug 2023 12:48:24 -0500 Subject: [PATCH 1/6] Rename dependabot.yml to dependabot.yml From eb97f57b9550ea38936d3b16465e8b5dca4af719 Mon Sep 17 00:00:00 2001 From: "datreeio[bot]" <40862150+datreeio[bot]@users.noreply.github.com> Date: Thu, 10 Aug 2023 11:44:34 +0000 Subject: [PATCH 2/6] Add datree-validation.yml --- .github/workflows/datree-validation.yml | 53 +++++++++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 .github/workflows/datree-validation.yml diff --git a/.github/workflows/datree-validation.yml b/.github/workflows/datree-validation.yml new file mode 100644 index 0000000..2192f4a --- /dev/null +++ b/.github/workflows/datree-validation.yml @@ -0,0 +1,53 @@ +# |=========================== Datree Policy Check ===================================| +# | This workflow will verify that all committed config files in the PR are valid. | +# | If one of the config files is happened to be a K8s config file (manifest), | +# | It will also automatically be tested for schema validation and misconfigurations. | +# | For more info visit: https://github.com/marketplace/datree | +# |===================================================================================| + +name: Datree Workflow + +on: + pull_request: + types: [opened, edited, synchronize, reopened] + +jobs: + configs-validation: + runs-on: ubuntu-latest + env: + DATREE_TOKEN: ${{ secrets.DATREE_TOKEN }} + steps: + - name: Checkout repository + uses: actions/checkout@v3 + with: + fetch-depth: 0 + + - name: Get changed files + id: changed-files + uses: tj-actions/changed-files@v19 + with: + files: | + *.yaml + *.yml + - name: List all changed files + run: echo ${{ steps.changed-files.outputs.all_changed_files }} + + - name: Install Datree's CLI + if: steps.changed-files.outputs.any_changed == 'true' + run: curl https://get.datree.io | /bin/bash -s + + # |=========================== Datree Policy Check ===================================| + # | Prevent Kubernetes misconfigurations from reaching production! | + # | Datree is a CLI tool to ensure K8s configs follow stability & security | + # | best practices as well as your organization’s policies. | + # | For more info visit: https://github.com/datreeio/datree | + # |===================================================================================| + + - name: Datree validate config files + if: steps.changed-files.outputs.any_changed == 'true' + uses: datreeio/action-datree@main # For more info about this Actions visit 👉 https://github.com/datreeio/action-datree + with: + path: ${{ steps.changed-files.outputs.all_changed_files }} + cliArguments: --only-k8s-files + isHelmChart: false + isKustomization: false From c6d136e4af69184452a2a9ab6ae1f599aed7734e Mon Sep 17 00:00:00 2001 From: Sharon <42342605+sharonstout1981@users.noreply.github.com> Date: Fri, 27 Oct 2023 13:25:37 -0500 Subject: [PATCH 3/6] Create devcontainer.json --- .devcontainer/devcontainer.json | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 .devcontainer/devcontainer.json diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json new file mode 100644 index 0000000..c078e30 --- /dev/null +++ b/.devcontainer/devcontainer.json @@ -0,0 +1,8 @@ +{ + "image": "mcr.microsoft.com/devcontainers/universal:2", + "features": { + } +} + - name: Nancy for GitHub Actions + uses: sonatype-nexus-community/nancy-github-action@v1.0.2 + From 966220b6a3073efbdfe839351cdde76a6c5a0d66 Mon Sep 17 00:00:00 2001 From: Sharon <42342605+sharonstout1981@users.noreply.github.com> Date: Fri, 12 Jan 2024 05:06:11 -0600 Subject: [PATCH 4/6] Update datree-validation.yml --- .github/workflows/datree-validation.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/datree-validation.yml b/.github/workflows/datree-validation.yml index 2192f4a..24375b5 100644 --- a/.github/workflows/datree-validation.yml +++ b/.github/workflows/datree-validation.yml @@ -24,7 +24,7 @@ jobs: - name: Get changed files id: changed-files - uses: tj-actions/changed-files@v19 + uses: tj-actions/changed-files@v41 with: files: | *.yaml From b6c533c76e3063cbbc0e558af1274e0bf5ae2de3 Mon Sep 17 00:00:00 2001 From: Sharon <42342605+sharonstout1981@users.noreply.github.com> Date: Sat, 24 Feb 2024 20:46:56 -0600 Subject: [PATCH 5/6] Create codeql.yml (#9) --- .github/workflows/codeql.yml | 84 ++++++++++++++++++++++++++++++++++++ 1 file changed, 84 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..2f24c0e --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,84 @@ +# For most projects, this workflow file will not need changing; you simply need +# to commit it to your repository. +# +# You may wish to alter this file to override the set of languages analyzed, +# or to provide custom queries or build logic. +# +# ******** NOTE ******** +# We have attempted to detect the languages in your repository. Please check +# the `language` matrix defined below to confirm you have the correct set of +# supported CodeQL languages. +# +name: "CodeQL" + +on: + push: + branches: [ "master", "all" ] + pull_request: + branches: [ "master", "all" ] + schedule: + - cron: '16 13 * * 5' + +jobs: + analyze: + name: Analyze + # Runner size impacts CodeQL analysis time. To learn more, please see: + # - https://gh.io/recommended-hardware-resources-for-running-codeql + # - https://gh.io/supported-runners-and-hardware-resources + # - https://gh.io/using-larger-runners + # Consider using larger runners for possible analysis time improvements. + runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} + timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }} + permissions: + # required for all workflows + security-events: write + + # only required for workflows in private repositories + actions: read + contents: read + + strategy: + fail-fast: false + matrix: + language: [ ] + # CodeQL supports [ 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' ] + # Use only 'java-kotlin' to analyze code written in Java, Kotlin or both + # Use only 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both + # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + + # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs + # queries: security-extended,security-and-quality + + + # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift). + # If this step fails, then you should remove it and run the build manually (see below) + - name: Autobuild + uses: github/codeql-action/autobuild@v3 + + # ℹ️ Command-line programs to run using the OS shell. + # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun + + # If the Autobuild fails above, remove it and uncomment the following three lines. + # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. + + # - run: | + # echo "Run, Build Application using script" + # ./location_of_script_within_repo/buildscript.sh + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:${{matrix.language}}" From 353a89249390d7c89efc2832772c3c64eac8fa3e Mon Sep 17 00:00:00 2001 From: Sharon <42342605+sharonstout1981@users.noreply.github.com> Date: Sat, 3 Aug 2024 11:00:30 -0500 Subject: [PATCH 6/6] Delete .github/workflows/stale.yml Signed-off-by: Sharon <42342605+sharonstout1981@users.noreply.github.com> --- .github/workflows/stale.yml | 22 ---------------------- 1 file changed, 22 deletions(-) delete mode 100644 .github/workflows/stale.yml diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml deleted file mode 100644 index 57be6d3..0000000 --- a/.github/workflows/stale.yml +++ /dev/null @@ -1,22 +0,0 @@ -name: Mark stale issues and pull requests - -on: - schedule: - - cron: '23 12 * * *' - -jobs: - stale: - - runs-on: ubuntu-latest - permissions: - issues: write - pull-requests: write - - steps: - - uses: actions/stale@v3 - with: - repo-token: ${{ secrets.GITHUB_TOKEN }} - stale-issue-message: 'Stale issue message' - stale-pr-message: 'Stale pull request message' - stale-issue-label: 'no-issue-activity' - stale-pr-label: 'no-pr-activity'