Skip to content

Commit 3aa2ab5

Browse files
authored
Merge branch 'main' into renovate/hashicorp-setup-terraform-3.x
2 parents 1d8bd06 + 38319fa commit 3aa2ab5

File tree

8 files changed

+86
-26
lines changed

8 files changed

+86
-26
lines changed

.github/workflows/workflow-synchronization.yaml

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,20 +10,53 @@ on:
1010
env:
1111
REPOSITORIES: |
1212
schubergphilis/terraform-aws-mcaf-account-baseline
13+
schubergphilis/terraform-aws-mcaf-audit-logs
1314
schubergphilis/terraform-aws-mcaf-aurora
1415
schubergphilis/terraform-aws-mcaf-avm
16+
schubergphilis/terraform-aws-mcaf-budget
17+
schubergphilis/terraform-aws-mcaf-certificate
18+
schubergphilis/terraform-aws-mcaf-clientvpn
19+
schubergphilis/terraform-aws-mcaf-cost-and-usage-reports
20+
schubergphilis/terraform-aws-mcaf-datadog
1521
schubergphilis/terraform-aws-mcaf-dynamodb
22+
schubergphilis/terraform-aws-mcaf-ecr
23+
schubergphilis/terraform-aws-mcaf-energy-labeler
24+
schubergphilis/terraform-aws-mcaf-fargate
25+
schubergphilis/terraform-aws-mcaf-gitlab-oidc
1626
schubergphilis/terraform-aws-mcaf-glue-connector
27+
schubergphilis/terraform-aws-mcaf-glue-job
28+
schubergphilis/terraform-aws-mcaf-ipam
29+
schubergphilis/terraform-aws-mcaf-kms
1730
schubergphilis/terraform-aws-mcaf-lambda
1831
schubergphilis/terraform-aws-mcaf-landing-zone
32+
schubergphilis/terraform-aws-mcaf-managed-grafana
1933
schubergphilis/terraform-aws-mcaf-network-firewall
34+
schubergphilis/terraform-aws-mcaf-redshift
35+
schubergphilis/terraform-aws-mcaf-resource-scheduler
36+
schubergphilis/terraform-aws-mcaf-role
2037
schubergphilis/terraform-aws-mcaf-s3
38+
schubergphilis/terraform-aws-mcaf-saas-audit-logs
2139
schubergphilis/terraform-aws-mcaf-securityhub-findings-manager
40+
schubergphilis/terraform-aws-mcaf-service-quotas-manager
41+
schubergphilis/terraform-aws-mcaf-ses
42+
schubergphilis/terraform-aws-mcaf-ses-forwarder
2243
schubergphilis/terraform-aws-mcaf-transit-gateway
2344
schubergphilis/terraform-aws-mcaf-user
45+
schubergphilis/terraform-aws-mcaf-vpc
46+
schubergphilis/terraform-aws-mcaf-vpc-with-ipam
2447
schubergphilis/terraform-aws-mcaf-workspace
48+
schubergphilis/terraform-azure-mcaf-key-vault
49+
schubergphilis/terraform-azure-mcaf-naming
50+
schubergphilis/terraform-azure-mcaf-network
51+
schubergphilis/terraform-azure-mcaf-svm-csp
52+
schubergphilis/terraform-azure-mcaf-svm-ea
53+
schubergphilis/terraform-azure-mcaf-private-endpoints
54+
schubergphilis/terraform-datadog-mcaf-monitor
2555
schubergphilis/terraform-github-mcaf-repository
56+
schubergphilis/terraform-gitlab-mcaf-group
2657
schubergphilis/terraform-gitlab-mcaf-project
58+
schubergphilis/terraform-opsgenie-mcaf-schedule
59+
schubergphilis/terraform-tfe-mcaf-workspace
2760
2861
WORKFLOW_FILES: |
2962
sync-root/.github/labels.yaml=.github/labels.yaml

sync-root/.github/labels.yaml

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,28 @@
11
---
22
- name: breaking
3-
color: 'b60205'
3+
color: "b60205"
44
description: This change is not backwards compatible
55
- name: bug
6-
color: 'd93f0b'
6+
color: "d93f0b"
77
description: Something isn't working
88
- name: documentation
9-
color: '0075ca'
9+
color: "0075ca"
1010
description: Improvements or additions to documentation
1111
- name: enhancement
12-
color: '0e8a16'
12+
color: "0e8a16"
1313
description: New feature or request
1414
- name: feature
15-
color: '0e8a16'
15+
color: "0e8a16"
1616
description: New feature or request
1717
- name: fix
18-
color: 'd93f0b'
18+
color: "d93f0b"
1919
description: Something isn't working
20+
- name: misc
21+
color: "#6B93D3"
22+
description: Miscellaneous task not covered by something else
2023
- name: no-changelog
21-
color: 'cccccc'
24+
color: "cccccc"
2225
description: No entry should be added to the release notes and changelog
2326
- name: security
24-
color: '5319e7'
27+
color: "5319e7"
2528
description: Solving a security issue

sync-root/.github/workflows/label-synchronization.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
name: label-synchronization
22
on:
3+
workflow_dispatch:
34
push:
45
branches:
56
- main
@@ -20,7 +21,7 @@ jobs:
2021
uses: actions/checkout@v4
2122

2223
- name: Synchronize labels
23-
uses: crazy-max/ghaction-github-labeler@v4
24+
uses: crazy-max/ghaction-github-labeler@v5
2425
with:
2526
dry-run: false
2627
github-token: ${{ secrets.GITHUB_TOKEN }}

sync-root/.github/workflows/pr-validation.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
autolabeler:
1717
runs-on: ubuntu-latest
1818
steps:
19-
- uses: release-drafter/release-drafter@v5
19+
- uses: release-drafter/release-drafter@v6
2020
with:
2121
config-name: release-drafter-config.yaml
2222
env:

sync-root/.github/workflows/release-drafter.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
draft:
2121
runs-on: ubuntu-latest
2222
steps:
23-
- uses: release-drafter/release-drafter@v5
23+
- uses: release-drafter/release-drafter@v6
2424
with:
2525
publish: false
2626
prerelease: false

sync-root/.github/workflows/terraform-validation.yaml

Lines changed: 23 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ permissions:
99

1010
env:
1111
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
12+
TF_IN_AUTOMATION: 1
1213

1314
jobs:
1415
fmt-lint-validate:
@@ -21,33 +22,43 @@ jobs:
2122
uses: hashicorp/setup-terraform@v3
2223

2324
- name: Setup Terraform Linters
24-
uses: terraform-linters/setup-tflint@v3
25+
uses: terraform-linters/setup-tflint@v4
2526
with:
2627
github_token: ${{ github.token }}
2728

2829
- name: Terraform Format
2930
id: fmt
3031
run: terraform fmt -check -recursive
3132

32-
- name: Terraform Init
33-
id: init
33+
- name: Terraform Lint
34+
id: lint
3435
run: |
36+
echo "Checking ."
37+
tflint --format compact
38+
3539
for d in examples/*/; do
36-
terraform -chdir=$d init
40+
echo "Checking ${d} ..."
41+
tflint --chdir=$d --format compact
3742
done
3843
3944
- name: Terraform Validate
4045
id: validate
46+
if: ${{ !vars.SKIP_TERRAFORM_VALIDATE }}
4147
run: |
4248
for d in examples/*/; do
49+
echo "Checking ${d} ..."
50+
terraform -chdir=$d init
4351
terraform -chdir=$d validate -no-color
4452
done
4553
env:
4654
AWS_DEFAULT_REGION: eu-west-1
4755

48-
- name: Terraform Lint
49-
id: lint
50-
run: tflint --no-color --recursive --format compact
56+
- name: Terraform Test
57+
id: test
58+
if: ${{ !vars.SKIP_TERRAFORM_TESTS }}
59+
run: |
60+
terraform init
61+
terraform test
5162
5263
- uses: actions/github-script@v6
5364
if: github.event_name == 'pull_request' || always()
@@ -103,7 +114,7 @@ jobs:
103114
ref: ${{ github.event.pull_request.head.ref }}
104115

105116
- name: Render terraform docs inside the README.md and push changes back to PR branch
106-
uses: terraform-docs/gh-actions@v1.0.0
117+
uses: terraform-docs/gh-actions@v1.1.0
107118
with:
108119
args: --sort-by required
109120
git-commit-message: "docs(readme): update module usage"
@@ -139,19 +150,21 @@ jobs:
139150
uses: actions/checkout@v4
140151

141152
- name: Run Checkov
142-
uses: bridgecrewio/checkov-action@v12.2467.0
153+
uses: bridgecrewio/checkov-action@v12
143154
with:
144155
container_user: 1000
145156
directory: "/"
146157
download_external_modules: false
147158
framework: terraform
148159
output_format: sarif
149160
quiet: true
150-
skip_check: "CKV_GIT_5,CKV_TF_1"
161+
skip_check: "CKV_GIT_5,CKV_GLB_1,CKV_TF_1"
151162
soft_fail: false
163+
skip_path: "examples/"
152164

153165
### SKIP REASON ###
154166
# Check | Description | Reason
155167

156168
# CKV_GIT_5 | Ensure GitHub pull requests have at least 2 approvals | We strive for at least 1 approval
169+
# CKV_GLB_1 | Ensure at least two approving reviews are required to merge a GitLab MR | We strive for at least 1 approval
157170
# CKV_TF_1 | Ensure Terraform module sources use a commit hash | We think this check is too restrictive and that versioning should be preferred over commit hash

sync-root/.github/workflows/update-changelog.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
release-notes: ${{ github.event.release.body }}
2525

2626
- name: Commit updated Changelog
27-
uses: stefanzweifel/git-auto-commit-action@v4
27+
uses: stefanzweifel/git-auto-commit-action@v5
2828
with:
2929
branch: ${{ github.event.repository.default_branch }}
3030
commit_message: "docs(changelog): update changelog"

sync-root/.pre-commit-config.yaml

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
default_stages: [commit]
33
repos:
44
- repo: https://github.com/pre-commit/pre-commit-hooks
5-
rev: v4.4.0
5+
rev: v4.6.0
66
hooks:
77
- id: check-json
88
- id: check-merge-conflict
@@ -14,17 +14,27 @@ repos:
1414
args:
1515
- --autofix
1616
- id: detect-aws-credentials
17+
args:
18+
- --allow-missing-credentials
1719
- id: detect-private-key
1820
- repo: https://github.com/antonbabenko/pre-commit-terraform
19-
rev: v1.83.2
21+
rev: v1.88.4
2022
hooks:
2123
- id: terraform_fmt
2224
- id: terraform_tflint
2325
- id: terraform_docs
2426
- id: terraform_validate
2527
- repo: https://github.com/bridgecrewio/checkov.git
26-
rev: 2.3.34
28+
rev: 3.2.60
2729
hooks:
2830
- id: checkov
2931
verbose: false
30-
args: [--download-external-modules, "true", --quiet, --compact]
32+
args:
33+
- --download-external-modules
34+
- "true"
35+
- --quiet
36+
- --compact
37+
- --skip-check
38+
- CKV_GIT_5,CKV_GLB_1,CKV_TF_1
39+
- --skip-path
40+
- examples/*

0 commit comments

Comments
 (0)