Skip to content

Commit 5d0097f

Browse files
ruzickapruzickap
authored
feat: add gha defaults (#1)
* feat: add gha defaults * fix: fix README.md and add proper name to pr-slack
1 parent 35aa4f3 commit 5d0097f

20 files changed

+639
-1
lines changed

‎.checkov.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
skip-check:
2+
# The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty
3+
- CKV_GHA_7

‎.github/CODEOWNERS‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Users referenced in this file will automatically be requested as reviewers for
2+
# PRs that modify the given paths
3+
# See https://help.github.com/articles/about-code-owners/, https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
4+
5+
# All code
6+
* @ruzickap

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
name: Bug report
3+
about: Create a report to help us improve
4+
title: "Bug: This is a sample issue title"
5+
labels: bug
6+
assignees: ruzickap
7+
---
8+
9+
**Describe the bug**
10+
A clear and concise description of what the bug is.
11+
12+
**To Reproduce**
13+
Steps to reproduce the behaviour.
14+
15+
**Expected behaviour**
16+
A clear and concise description of what you expected to happen.
17+
18+
**Screenshots**
19+
If applicable, add screenshots to help explain your problem.
20+
21+
**Additional context**
22+
Add any other context about the problem here.

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
blank_issues_enabled: false
2+
contact_links:
3+
- name: GitHub Actions Community Forum
4+
url: https://github.com/orgs/community/discussions/
5+
about: Please ask questions about GitHub Actions here.
6+
- name: GitHub Pages help
7+
url: https://help.github.com/en/github/working-with-github-pages
8+
about: GitHub Pages documentation here.

‎.github/ISSUE_TEMPLATE/proposal.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
name: Proposal
3+
about: Suggest an idea for this project
4+
title: "Proposal: This is a sample title"
5+
labels: proposal
6+
assignees: ruzickap
7+
---
8+
9+
**Is your feature request related to a problem? Please describe**
10+
A clear and concise description of what the problem is. Ex. I'm always
11+
frustrated when [...]
12+
13+
**Describe the solution you'd like**
14+
A clear and concise description of what you want to happen.
15+
16+
**Describe alternatives you've considered**
17+
A clear and concise description of any alternative solutions or features you've considered.
18+
19+
**Additional context**
20+
Add any other context or screenshots about the feature request here.

‎.github/renovate.json5‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
$schema: "https://docs.renovatebot.com/renovate-schema.json",
3+
// # keep-sorted start block=yes
4+
"git-submodules": {
5+
enabled: true,
6+
},
7+
// Keep the extends started with ":" at the end of the list to allow overriding
8+
extends: [
9+
"config:recommended",
10+
"docker:pinDigests",
11+
"helpers:pinGitHubActionDigestsToSemver",
12+
"security:openssf-scorecard",
13+
":disableDependencyDashboard",
14+
":disableRateLimiting",
15+
":docker",
16+
":enableVulnerabilityAlertsWithLabel(security)",
17+
":pinSkipCi",
18+
],
19+
labels: [
20+
"renovate",
21+
"renovate/{{replace '.*/' '' depName}}",
22+
"renovate/{{updateType}}",
23+
],
24+
lockFileMaintenance: {
25+
enabled: true,
26+
schedule: ["before 6am on Sunday"],
27+
},
28+
packageRules: [
29+
{
30+
matchUpdateTypes: ["major"],
31+
automerge: false,
32+
},
33+
{
34+
description: "Ignore frequent renovate updates",
35+
enabled: false,
36+
matchPackageNames: ["renovatebot/github-action"],
37+
matchUpdateTypes: ["patch"],
38+
},
39+
{
40+
description: "Update renovatebot/github-action minor updates on Sundays",
41+
matchPackageNames: ["renovatebot/github-action"],
42+
matchUpdateTypes: ["minor"],
43+
schedule: ["* * * * 0"],
44+
},
45+
],
46+
prBodyTemplate: "{{{table}}}{{{notes}}}{{{changelogs}}}",
47+
rebaseWhen: "behind-base-branch",
48+
regexManagers: [
49+
{
50+
extractVersionTemplate: "{{#if extractVersion}}{{{extractVersion}}}{{else}}^v?(?<version>.+)${{/if}}",
51+
fileMatch: ["\\.ya?ml$", "\\.md$", "^Dockerfile$", "^entrypoint\\.sh$"],
52+
matchStrings: [
53+
'# renovate: datasource=(?<datasource>.+?) depName=(?<depName>.+?)( versioning=(?<versioning>.+?))?( extractVersion=(?<extractVersion>.+?))?( registryUrl=(?<registryUrl>.+?))?\\s.*[=:]\\s*"?(?<currentValue>.+?)"?\\s',
54+
],
55+
versioningTemplate: "{{#if versioning}}{{{versioning}}}{{else}}semver{{/if}}",
56+
},
57+
],
58+
separateMinorPatch: true,
59+
// # keep-sorted end
60+
}

‎.github/workflows/codeql-actions.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
name: "CodeQL GitHub Actions"
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches: ["main"]
7+
pull_request:
8+
paths:
9+
- .github/workflows/*.yml
10+
schedule:
11+
- cron: 17 10 * * 2
12+
13+
permissions: read-all
14+
15+
jobs:
16+
analyze-actions:
17+
name: Analyze GitHub Actions
18+
runs-on: "ubuntu-latest"
19+
permissions:
20+
# required for all workflows
21+
security-events: write
22+
# required to fetch internal or private CodeQL packs
23+
packages: read
24+
steps:
25+
- name: Checkout repository
26+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
27+
28+
# Initializes the CodeQL tools for scanning.
29+
- name: Initialize CodeQL
30+
uses: github/codeql-action/init@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
31+
with:
32+
languages: actions
33+
build-mode: none
34+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
35+
queries: security-extended
36+
37+
- name: Perform CodeQL Analysis
38+
uses: github/codeql-action/analyze@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
39+
with:
40+
category: "/language:actions"

‎.github/workflows/mega-linter.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
name: mega-linter
3+
4+
on:
5+
workflow_dispatch:
6+
push:
7+
branches-ignore:
8+
- main
9+
10+
permissions: read-all
11+
12+
jobs:
13+
mega-linter:
14+
runs-on: ubuntu-latest
15+
timeout-minutes: 30
16+
steps:
17+
- name: Checkout Code
18+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
19+
20+
- name: Extract commands from markdown files
21+
run: |
22+
set -euxo pipefail
23+
echo '#!/usr/bin/env bash' > README.sh
24+
find . -name '*.md' -print0 | while IFS= read -r -d '' FILE; do
25+
# Extract: ```bash ... ```
26+
sed -n "/^\`\`\`\(bash\|shell\)$/,/^\`\`\`$/p" "${FILE}" | sed '/^```*/d' >> README.sh
27+
# Extract: ```bash ... ```
28+
sed -n "/^ \`\`\`\(bash\|shell\)$/,/^ \`\`\`$/p" "${FILE}" | sed '/^ ```*/d; s/^ //' >> README.sh
29+
done
30+
chmod a+x README.sh
31+
32+
- name: 💡 MegaLinter
33+
uses: oxsecurity/megalinter@ec124f7998718d79379a3c5b39f5359952baf21d # v8.4.2
34+
env:
35+
GITHUB_COMMENT_REPORTER: false
36+
# Disabled due to error: [GitHub Status Reporter] Error posting Status for REPOSITORY with ...: 403
37+
GITHUB_STATUS_REPORTER: false
38+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/pr-slack-notification.yml‎

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
name: pr-slack-notification
2+
3+
# Based on: https://github.com/slackapi/slack-github-action/issues/269
4+
5+
on:
6+
workflow_dispatch:
7+
pull_request:
8+
types:
9+
- opened
10+
- ready_for_review
11+
- review_requested
12+
- closed
13+
issue_comment:
14+
types:
15+
- created
16+
pull_request_review:
17+
types:
18+
- submitted
19+
20+
permissions: read-all
21+
22+
defaults:
23+
run:
24+
shell: bash -euxo pipefail {0}
25+
26+
jobs:
27+
github-context:
28+
runs-on: ubuntu-latest
29+
steps:
30+
- name: Debug
31+
env:
32+
GITHUB_CONTEXT: ${{ toJson(github) }}
33+
run: |
34+
echo "${GITHUB_CONTEXT}"
35+
36+
pr-slack-notification:
37+
runs-on: ubuntu-latest
38+
name: Sends a message to Slack when a PR is opened
39+
if: (github.event.action == 'opened' && github.event.pull_request.draft == false) || github.event.action == 'ready_for_review'
40+
steps:
41+
- name: Post PR summary message to slack
42+
id: message
43+
uses: slackapi/slack-github-action@485a9d42d3a73031f12ec201c457e2162c45d02d # v2.0.0
44+
with:
45+
method: chat.postMessage
46+
token: ${{ secrets.MY_SLACK_BOT_TOKEN }}
47+
payload: |
48+
channel: ${{ secrets.MY_SLACK_CHANNEL_ID }}
49+
text: "💡 *${{ github.event.pull_request.user.login }}*: <${{ github.event.repository.html_url }}|${{ github.repository }}> - <${{ github.event.pull_request.html_url }}|#${{ github.event.pull_request.number }} - ${{ github.event.pull_request.title }}> (+${{ github.event.pull_request.additions }}, -${{ github.event.pull_request.deletions }})"
50+
51+
- name: Create file with slack message timestamp
52+
run: |
53+
echo "${{ steps.message.outputs.ts }}" > slack-message-timestamp.txt
54+
55+
- name: Cache slack message timestamp
56+
uses: actions/cache/save@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
57+
with:
58+
path: slack-message-timestamp.txt
59+
key: slack-message-timestamp-${{ github.event.pull_request.html_url }}-${{ steps.message.outputs.ts }}
60+
61+
slack-emoji-react:
62+
runs-on: ubuntu-latest
63+
name: Adds emoji reaction to slack message when a PR is closed or reviewed
64+
if: ${{ startsWith(github.event.pull_request.html_url, 'https') || startsWith(github.event.issue.pull_request.html_url, 'https') }}
65+
steps:
66+
# gh commands needs to be executed in the repository
67+
- name: Checkout Code
68+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
69+
70+
# https://stackoverflow.com/questions/74640750/github-actions-not-finding-cache
71+
# I can not use the cache action in this job because the cache is not shared between runs
72+
- name: Save slack timestamp as an environment variable
73+
id: slack-timestamp
74+
env:
75+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
76+
run: |
77+
SLACK_TIMESTAMP=$(gh cache list --json key --jq '.[].key|capture("${{ github.event.pull_request.html_url || github.event.issue.pull_request.html_url }}-(?<x>.+)").x')
78+
echo "SLACK_TIMESTAMP=${SLACK_TIMESTAMP}" | tee -a "${GITHUB_ENV}"
79+
if [[ "${SLACK_TIMESTAMP}" != '' ]]; then
80+
echo "github_event_pull_request_html_url=true" >> "${GITHUB_OUTPUT}"
81+
fi
82+
83+
- name: Decide which emoji to add
84+
if: ${{ steps.slack-timestamp.outputs.github_event_pull_request_html_url == 'true' }}
85+
run: |
86+
case "${{ github.event.action }}" in
87+
created)
88+
if [[ "${{ github.event_name }}" == 'issue_comment' ]]; then
89+
echo "EMOJI=speech_balloon" >> "${GITHUB_ENV}" # 💬
90+
fi
91+
;;
92+
submitted)
93+
case "${{ github.event.review.state }}" in
94+
changes_requested)
95+
echo "EMOJI=repeat" >> "${GITHUB_ENV}" # 🔁
96+
;;
97+
approved)
98+
echo "EMOJI=ok" >> "${GITHUB_ENV}" # 🆗
99+
;;
100+
commented)
101+
echo "EMOJI=speech_balloon" >> "${GITHUB_ENV}" # 💬
102+
;;
103+
esac
104+
;;
105+
review_requested)
106+
echo "EMOJI=eyes" >> "${GITHUB_ENV}" # 👀
107+
;;
108+
*)
109+
echo "EMOJI=false" >> "${GITHUB_ENV}"
110+
;;
111+
esac
112+
113+
- name: React to PR summary message in slack with emoji
114+
if: ${{ steps.slack-timestamp.outputs.github_event_pull_request_html_url == 'true' && env.EMOJI != 'false' }}
115+
uses: slackapi/slack-github-action@485a9d42d3a73031f12ec201c457e2162c45d02d # v2.0.0
116+
with:
117+
method: reactions.add
118+
token: ${{ secrets.MY_SLACK_BOT_TOKEN }}
119+
payload: |
120+
channel: ${{ secrets.MY_SLACK_CHANNEL_ID }}
121+
timestamp: "${{ env.SLACK_TIMESTAMP }}"
122+
name: ${{ env.EMOJI }}
123+
124+
- name: Update the original message with success
125+
if: ${{ github.event.pull_request.merged && steps.slack-timestamp.outputs.github_event_pull_request_html_url == 'true' }}
126+
uses: slackapi/slack-github-action@485a9d42d3a73031f12ec201c457e2162c45d02d # v2.0.0
127+
with:
128+
method: chat.update
129+
token: ${{ secrets.MY_SLACK_BOT_TOKEN }}
130+
payload: |
131+
channel: ${{ secrets.MY_SLACK_CHANNEL_ID }}
132+
ts: "${{ env.SLACK_TIMESTAMP }}"
133+
text: "✅ *${{ github.event.pull_request.user.login }}*: <${{ github.event.repository.html_url }}|${{ github.repository }}> - <${{ github.event.pull_request.html_url }}|#${{ github.event.pull_request.number }} - ${{ github.event.pull_request.title }}> (+${{ github.event.pull_request.additions }}, -${{ github.event.pull_request.deletions }})"
134+
attachments:
135+
- color: "28a745"
136+
fields:
137+
- title: "Status"
138+
short: true
139+
value: "Merged ✅"

‎.github/workflows/release-please.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
name: release-please
3+
4+
on:
5+
workflow_dispatch:
6+
push:
7+
branches:
8+
- main
9+
10+
permissions: read-all
11+
12+
jobs:
13+
release-please:
14+
runs-on: ubuntu-latest
15+
permissions:
16+
contents: write
17+
pull-requests: write
18+
steps:
19+
- uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
20+
id: app-token
21+
with:
22+
app-id: ${{ secrets.MY_RENOVATE_GITHUB_APP_ID }}
23+
private-key: ${{ secrets.MY_RENOVATE_GITHUB_PRIVATE_KEY }}
24+
25+
- uses: googleapis/release-please-action@7987652d64b4581673a76e33ad5e98e3dd56832f # v4.1.3
26+
with:
27+
release-type: simple
28+
token: ${{ steps.app-token.outputs.token }}

0 commit comments

Comments
 (0)