From d77c393aa72d10c2be549a6aad718052e38c8974 Mon Sep 17 00:00:00 2001 From: Arthur Date: Sun, 21 Jan 2024 16:48:22 -0500 Subject: [PATCH] feat: git updates --- .checkov.yaml | 1 + .github/dependabot.yml | 32 +++++++++ .github/workflows/codeql.yml | 77 ++++++++++++++++++++++ .pre-commit-config.yaml | 26 ++++++-- .vscode/settings.json | 4 ++ kubernetes/kube-eagle/base/deployment.yaml | 2 +- terraform/gcp/HomeLab/homelab/main.tf | 22 +++++++ 7 files changed, 159 insertions(+), 5 deletions(-) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/codeql.yml diff --git a/.checkov.yaml b/.checkov.yaml index 913532c47..a414803ba 100644 --- a/.checkov.yaml +++ b/.checkov.yaml @@ -34,3 +34,4 @@ skip-path: - "notes/.*" skip-check: - CKV_K8S_15 # "Image Pull Policy should be Always" + - CKV2_GHA_1 # CodeQL Tweak, TODO Inline Skip diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..59ca633e9 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,32 @@ +# To get started with Dependabot version updates, you'll need to specify which +# package ecosystems to update and where the package manifests are located. +# Please see the documentation for all configuration options: +# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates + +version: 2 +updates: + - package-ecosystem: "gomod" # See documentation for possible values + directory: "/" # Location of package manifests + schedule: + interval: "weekly" + groups: + go-packages: + patterns: + - "*" + - package-ecosystem: "docker" # See documentation for possible values + directory: "/" # Location of package manifests + schedule: + interval: "weekly" + groups: + docker-packages: + patterns: + - "*" + + - package-ecosystem: "terraform" # See documentation for possible values + directory: "/" # Location of package manifests + schedule: + interval: "weekly" + groups: + terraform-packages: + patterns: + - "*" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 000000000..8a5ead077 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,77 @@ +# For most projects, this workflow file will not need changing; you simply need +# to commit it to your repository. +# +# You may wish to alter this file to override the set of languages analyzed, +# or to provide custom queries or build logic. +# +# ******** NOTE ******** +# We have attempted to detect the languages in your repository. Please check +# the `language` matrix defined below to confirm you have the correct set of +# supported CodeQL languages. +# +name: "CodeQL" + +on: + push: + branches: + - "*" + + pull_request: + branches: + - "*" + schedule: + - cron: "0 9 * * 1" + +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + + strategy: + fail-fast: false + matrix: + language: ["go"] + # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ] + # Use only 'java' to analyze code written in Java, Kotlin or both + # Use only 'javascript' to analyze code written in JavaScript, TypeScript or both + # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support + + steps: + - name: Checkout repository + uses: actions/checkout@v3 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v2 + with: + languages: ${{ matrix.language }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + + # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs + # queries: security-extended,security-and-quality + + # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java). + # If this step fails, then you should remove it and run the build manually (see below) + - name: Autobuild + uses: github/codeql-action/autobuild@v2 + + # ℹī¸ Command-line programs to run using the OS shell. + # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun + + # If the Autobuild fails above, remove it and uncomment the following three lines. + # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. + + # - run: | + # echo "Run, Build Application using script" + # ./location_of_script_within_repo/buildscript.sh + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v2 + with: + category: "/language:${{matrix.language}}" diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 95895383b..1c16f79fa 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -8,13 +8,15 @@ repos: hooks: - id: shellcheck # - repo: https://github.com/adrienverge/yamllint.git - # rev: v1.32.0 + # rev: v1.33.0 # hooks: # - id: yamllint - - repo: https://github.com/bridgecrewio/checkov.git - rev: 73e0ecc705cc87f639def2496403839abbafa6e6 #"3.1.43" + - repo: https://github.com/compilerla/conventional-pre-commit + rev: 07fd005463366385a8b0fa97c8d2a25b5bac19e0 # v3.1.0 hooks: - - id: checkov + - id: conventional-pre-commit + stages: [commit-msg] + args: [] - repo: https://github.com/igorshubovych/markdownlint-cli rev: 3f18b949d53ffddafc6d98373366533d61e00da8 #v0.37.0 hooks: @@ -23,3 +25,19 @@ repos: rev: ffb6a759a979008c0e6dff86e39f4745a2d9eac4 #"v3.1.0" hooks: - id: prettier + - repo: https://github.com/bridgecrewio/checkov.git + rev: 73e0ecc705cc87f639def2496403839abbafa6e6 #"3.1.43" + hooks: + - id: checkov + # v3.1.0 https://api.github.com/repos/compilerla/conventional-pre-commit/tags + # - repo: https://github.com/ansible/ansible-lint.git + # rev: v6.22.1 + # hooks: + # - id: ansible-lint + # files: \.(yaml|yml)$ + # name: Ansible Lint + # description: Run configurations on .ansible-lint file + # entry: python3 -m ansiblelint --force-color + # always_run: false + # additional_dependencies: + # - "jmespath" diff --git a/.vscode/settings.json b/.vscode/settings.json index 60f13dadd..cd4cc20b2 100644 --- a/.vscode/settings.json +++ b/.vscode/settings.json @@ -47,6 +47,7 @@ "argoproj", "arthurvardevanyan", "auths", + "Autobuild", "autogain", "autohidetopbar", "autojump", @@ -80,6 +81,7 @@ "btrfs", "bucketnames", "buildah", + "buildscript", "cainjector", "CCOCTL", "certbot", @@ -101,6 +103,7 @@ "cockraochdb", "cockroachdb", "cockroachlabs", + "codeql", "codeready", "Codium", "commandline", @@ -193,6 +196,7 @@ "gitea", "gitlab", "gitleaks", + "gomod", "gparted", "grafana", "growfs", diff --git a/kubernetes/kube-eagle/base/deployment.yaml b/kubernetes/kube-eagle/base/deployment.yaml index b37314409..77bc9e1e9 100644 --- a/kubernetes/kube-eagle/base/deployment.yaml +++ b/kubernetes/kube-eagle/base/deployment.yaml @@ -28,7 +28,7 @@ spec: automountServiceAccountToken: true containers: - name: kube-eagle - image: registry./homelab/kube-eagle:1.1.8 + image: registry./homelab/kube-eagle:1.1.8@sha256:772d9c2e457ec78784ed6f21934f5b69594a7c89b742c68d19a907f45c5fad39 securityContext: # runAsGroup: 11199 # runAsUser: 11199 diff --git a/terraform/gcp/HomeLab/homelab/main.tf b/terraform/gcp/HomeLab/homelab/main.tf index 6329c2e05..adf16aa1c 100644 --- a/terraform/gcp/HomeLab/homelab/main.tf +++ b/terraform/gcp/HomeLab/homelab/main.tf @@ -74,3 +74,25 @@ resource "google_service_account_iam_member" "tekton" { role = "roles/iam.workloadIdentityUser" member = "principal://iam.googleapis.com/projects/${local.homelab_project_num}/locations/global/workloadIdentityPools/${google_iam_workload_identity_pool.okd_homelab_wif.workload_identity_pool_id}/subject/system:serviceaccount:homelab:pipeline" } + +resource "google_storage_bucket" "github-tf-bucket" { + #checkov:skip=CKV_GCP_62:Access logs are not required. + name = "tf-state-github-${local.bucket_id}" + location = "us-central1" + project = "homelab-${local.project_id}" + force_destroy = false + public_access_prevention = "enforced" + uniform_bucket_level_access = true + versioning { + enabled = true + } + lifecycle_rule { + condition { + num_newer_versions = 10 + } + action { + type = "Delete" + } + } + +}