From 44278596c1aa1eddfba88fc98872a0de4d620901 Mon Sep 17 00:00:00 2001 From: Ashwin Sangem Date: Thu, 9 Sep 2021 08:35:04 +0530 Subject: [PATCH] Testing Partner Toggle, Synced with Main (#1083) * Secure workflows (#1) (#1072) * Restrict permissions for the GITHUB_TOKEN in .github/workflows/label-feature.yml * Restrict permissions for the GITHUB_TOKEN in .github/workflows/label-support.yml * Restrict permissions for the GITHUB_TOKEN in .github/workflows/stale.yml * Restrict permissions for the GITHUB_TOKEN in .github/workflows/sync_ghes.yaml * Restrict permissions for the GITHUB_TOKEN in .github/workflows/validate-data.yaml Co-authored-by: Step Security Co-authored-by: step-security[bot] <89328102+step-security[bot]@users.noreply.github.com> Co-authored-by: Step Security * Directory for deployments (#1071) * moving deployment templates * including deployment directory in scripts * validate categories script init * introducing scout * introducing workflow * Update validate-categories.yaml * Update validate-categories.yaml * Update validate-categories.yaml * Update validate.rb * Update validate.rb * Update validate.rb * Update validate.rb * Update validate-categories.yaml * Update validate-categories.yaml * Update validate-categories.yaml * Update validate.rb * Update validate-categories.yaml * Update validate-categories.yaml * Create test_comment.yaml * rename * using [enter] * testing newline * test * setting up variable * using echo -e * using join * testing space space new line * setting multi line in echo * removing checkout * setting rows-generator * fixing error * using join * commit * Update test_comment.yaml * escaping pipe * printing debug line * using %0A * Update validate-categories.yaml * Update validate.rb * Update validate.rb * removing debug * removing variable * Update validate.rb * Update validate-categories.yaml * Validate categories comment on pr (#32) * reverting deployment directory * checking for output * Categories validation two workflows (#34) comment on pr in a separate workflow * Categories validation two workflows (#35) using right dir name * Categories validation two workflows (#36) . * Categories validation two workflows (#37) fixing typo * adding if conditions * adding try catch * using console instead of echo * equating to upstream * moving deployment templates * add codeql workflow to ghes * restoring from main (#1078) * Revert "add codeql workflow to ghes branch" * add codeql workflow to ghes * only run ghes sync checks on YML files * only check nwo of supported actions * Testing Partner Toggle. Co-authored-by: Varun Sharma Co-authored-by: step-security[bot] <89328102+step-security[bot]@users.noreply.github.com> Co-authored-by: Step Security Co-authored-by: Aparna Ravindra <82894348+aparna-ravindra@users.noreply.github.com> Co-authored-by: Nick Fyson --- .github/workflows/label-feature.yml | 2 ++ .github/workflows/label-support.yml | 2 ++ .github/workflows/stale.yml | 3 ++ .github/workflows/sync_ghes.yaml | 2 ++ .github/workflows/validate-data.yaml | 2 ++ ci/properties/rails-lint.properties.json | 6 ++++ ci/rails-lint.yml | 32 +++++++++++++++++++ {ci => deployments}/alibabacloud.yml | 0 {ci => deployments}/aws.yml | 0 {ci => deployments}/azure.yml | 0 {ci => deployments}/google.yml | 0 {ci => deployments}/ibm.yml | 0 {ci => deployments}/openshift.yml | 0 .../properties/alibabacloud.properties.json | 0 .../properties/aws.properties.json | 0 .../properties/azure.properties.json | 2 +- .../properties/google.properties.json | 0 .../properties/ibm.properties.json | 0 .../properties/openshift.properties.json | 0 .../properties/tencent.properties.json | 0 .../properties/terraform.properties.json | 0 {ci => deployments}/tencent.yml | 0 {ci => deployments}/terraform.yml | 0 script/sync-ghes/index.ts | 7 ++-- script/sync-ghes/settings.json | 7 ++-- script/validate-data/settings.json | 3 +- 26 files changed, 61 insertions(+), 7 deletions(-) create mode 100644 ci/properties/rails-lint.properties.json create mode 100644 ci/rails-lint.yml rename {ci => deployments}/alibabacloud.yml (100%) rename {ci => deployments}/aws.yml (100%) rename {ci => deployments}/azure.yml (100%) rename {ci => deployments}/google.yml (100%) rename {ci => deployments}/ibm.yml (100%) rename {ci => deployments}/openshift.yml (100%) rename {ci => deployments}/properties/alibabacloud.properties.json (100%) rename {ci => deployments}/properties/aws.properties.json (100%) rename {ci => deployments}/properties/azure.properties.json (59%) rename {ci => deployments}/properties/google.properties.json (100%) rename {ci => deployments}/properties/ibm.properties.json (100%) rename {ci => deployments}/properties/openshift.properties.json (100%) rename {ci => deployments}/properties/tencent.properties.json (100%) rename {ci => deployments}/properties/terraform.properties.json (100%) rename {ci => deployments}/tencent.yml (100%) rename {ci => deployments}/terraform.yml (100%) diff --git a/.github/workflows/label-feature.yml b/.github/workflows/label-feature.yml index 96ac8c1..d13cf87 100644 --- a/.github/workflows/label-feature.yml +++ b/.github/workflows/label-feature.yml @@ -5,6 +5,8 @@ on: jobs: build: + permissions: + issues: write runs-on: ubuntu-latest steps: - name: Close Issue diff --git a/.github/workflows/label-support.yml b/.github/workflows/label-support.yml index c6f2aa4..ea0f240 100644 --- a/.github/workflows/label-support.yml +++ b/.github/workflows/label-support.yml @@ -5,6 +5,8 @@ on: jobs: build: + permissions: + issues: write runs-on: ubuntu-latest steps: - name: Close Issue diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index c116b93..217078a 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -7,6 +7,9 @@ on: jobs: stale: + permissions: + issues: write + pull-requests: write runs-on: ubuntu-latest steps: diff --git a/.github/workflows/sync_ghes.yaml b/.github/workflows/sync_ghes.yaml index a3c298a..946218f 100644 --- a/.github/workflows/sync_ghes.yaml +++ b/.github/workflows/sync_ghes.yaml @@ -7,6 +7,8 @@ on: jobs: sync: + permissions: + contents: write runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 diff --git a/.github/workflows/validate-data.yaml b/.github/workflows/validate-data.yaml index 745bc25..7d5c1ee 100644 --- a/.github/workflows/validate-data.yaml +++ b/.github/workflows/validate-data.yaml @@ -6,6 +6,8 @@ on: jobs: validate-data: + permissions: + contents: read runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 diff --git a/ci/properties/rails-lint.properties.json b/ci/properties/rails-lint.properties.json new file mode 100644 index 0000000..7a109a1 --- /dev/null +++ b/ci/properties/rails-lint.properties.json @@ -0,0 +1,6 @@ +{ + "name": "Rails - Build and Run Linters", + "description": "Build Rails application and run linters", + "iconName": "ruby", + "categories": ["Ruby", "Rails"] +} diff --git a/ci/rails-lint.yml b/ci/rails-lint.yml new file mode 100644 index 0000000..b2f8832 --- /dev/null +++ b/ci/rails-lint.yml @@ -0,0 +1,32 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. +# This workflow will download a prebuilt Ruby version, install dependencies, and run linters +name: Build Rails and run linters + +on: + push: + branches: [ $default-branch ] + pull_request: + branches: [ $default-branch ] +jobs: + run-lint: + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v2 + + - name: Setup Ruby and install gems + uses: ruby/setup-ruby@v1 + with: + bundler-cache: true + # Add or Replace any other security checks here + - name: Run security checks + run: | + bin/bundler-audit --update + bin/brakeman -q -w2 + # Add or Replace any other Linters here + - name: Run linters + run: | + bin/rubocop --parallel \ No newline at end of file diff --git a/ci/alibabacloud.yml b/deployments/alibabacloud.yml similarity index 100% rename from ci/alibabacloud.yml rename to deployments/alibabacloud.yml diff --git a/ci/aws.yml b/deployments/aws.yml similarity index 100% rename from ci/aws.yml rename to deployments/aws.yml diff --git a/ci/azure.yml b/deployments/azure.yml similarity index 100% rename from ci/azure.yml rename to deployments/azure.yml diff --git a/ci/google.yml b/deployments/google.yml similarity index 100% rename from ci/google.yml rename to deployments/google.yml diff --git a/ci/ibm.yml b/deployments/ibm.yml similarity index 100% rename from ci/ibm.yml rename to deployments/ibm.yml diff --git a/ci/openshift.yml b/deployments/openshift.yml similarity index 100% rename from ci/openshift.yml rename to deployments/openshift.yml diff --git a/ci/properties/alibabacloud.properties.json b/deployments/properties/alibabacloud.properties.json similarity index 100% rename from ci/properties/alibabacloud.properties.json rename to deployments/properties/alibabacloud.properties.json diff --git a/ci/properties/aws.properties.json b/deployments/properties/aws.properties.json similarity index 100% rename from ci/properties/aws.properties.json rename to deployments/properties/aws.properties.json diff --git a/ci/properties/azure.properties.json b/deployments/properties/azure.properties.json similarity index 59% rename from ci/properties/azure.properties.json rename to deployments/properties/azure.properties.json index 362d5d1..99e72b8 100644 --- a/ci/properties/azure.properties.json +++ b/deployments/properties/azure.properties.json @@ -1,6 +1,6 @@ { "name": "Deploy Node.js to Azure Web App", - "description": "Build a Node.js project and deploy it to an Azure Web App.", + "description": "[Test Partner]Build a Node.js project and deploy it to an Azure Web App.", "creator": "Microsoft Azure", "iconName": "azure", "categories": ["Deployment"] diff --git a/ci/properties/google.properties.json b/deployments/properties/google.properties.json similarity index 100% rename from ci/properties/google.properties.json rename to deployments/properties/google.properties.json diff --git a/ci/properties/ibm.properties.json b/deployments/properties/ibm.properties.json similarity index 100% rename from ci/properties/ibm.properties.json rename to deployments/properties/ibm.properties.json diff --git a/ci/properties/openshift.properties.json b/deployments/properties/openshift.properties.json similarity index 100% rename from ci/properties/openshift.properties.json rename to deployments/properties/openshift.properties.json diff --git a/ci/properties/tencent.properties.json b/deployments/properties/tencent.properties.json similarity index 100% rename from ci/properties/tencent.properties.json rename to deployments/properties/tencent.properties.json diff --git a/ci/properties/terraform.properties.json b/deployments/properties/terraform.properties.json similarity index 100% rename from ci/properties/terraform.properties.json rename to deployments/properties/terraform.properties.json diff --git a/ci/tencent.yml b/deployments/tencent.yml similarity index 100% rename from ci/tencent.yml rename to deployments/tencent.yml diff --git a/ci/terraform.yml b/deployments/terraform.yml similarity index 100% rename from ci/terraform.yml rename to deployments/terraform.yml diff --git a/script/sync-ghes/index.ts b/script/sync-ghes/index.ts index e37eca3..9edc70e 100755 --- a/script/sync-ghes/index.ts +++ b/script/sync-ghes/index.ts @@ -45,7 +45,7 @@ async function checkWorkflows( }); for (const e of dir) { - if (e.isFile()) { + if (e.isFile() && extname(e.name) === ".yml") { const workflowFilePath = join(folder, e.name); const workflowId = basename(e.name, extname(e.name)); const workflowProperties: WorkflowProperties = require(join( @@ -58,7 +58,7 @@ async function checkWorkflows( const isPartnerWorkflow = workflowProperties.creator ? partnersSet.has(workflowProperties.creator.toLowerCase()) : false; const enabled = - !isPartnerWorkflow && + !isPartnerWorkflow && (await checkWorkflow(workflowFilePath, enabledActions)); const workflowDesc: WorkflowDesc = { @@ -104,7 +104,8 @@ async function checkWorkflow( if (!!step.uses) { // Check if allowed action const [actionName, _] = step.uses.split("@"); - if (!enabledActionsSet.has(actionName.toLowerCase())) { + const actionNwo = actionName.split("/").slice(0, 2).join("/"); + if (!enabledActionsSet.has(actionNwo.toLowerCase())) { console.info( `Workflow ${workflowPath} uses '${actionName}' which is not supported for GHES.` ); diff --git a/script/sync-ghes/settings.json b/script/sync-ghes/settings.json index 60b70ed..e4f50fa 100644 --- a/script/sync-ghes/settings.json +++ b/script/sync-ghes/settings.json @@ -1,7 +1,9 @@ { "folders": [ "../../ci", - "../../automation" + "../../automation", + "../../deployments", + "../../code-scanning" ], "enabledActions": [ "actions/checkout", @@ -15,7 +17,8 @@ "actions/stale", "actions/starter-workflows", "actions/upload-artifact", - "actions/upload-release-asset" + "actions/upload-release-asset", + "github/codeql-action" ], "partners": [ "Alibaba Cloud", diff --git a/script/validate-data/settings.json b/script/validate-data/settings.json index 1913e2f..f7c08cf 100644 --- a/script/validate-data/settings.json +++ b/script/validate-data/settings.json @@ -1,6 +1,7 @@ { "folders": [ "../../ci", - "../../automation" + "../../automation", + "../../deployments" ] } \ No newline at end of file