Skip to content

Commit cda6b02

Browse files
kacpermudakacpermuda
authored
Merge pull request #11 from getindata/chore/updates-and-workflows
chore: Update workflows and pre-commit hooks
2 parents 78b87ac + 0d6c25e commit cda6b02

File tree

7 files changed

+83
-233
lines changed

7 files changed

+83
-233
lines changed

‎.github/dependabot.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
version: 2
2+
updates:
3+
4+
# GitHub actions
5+
- package-ecosystem: "github-actions"
6+
directory: "/" # For GitHub Actions "/" must be used for workflow files in ".github/workflows"
7+
schedule:
8+
interval: "weekly"
9+
commit-message:
10+
prefix: "chore: "
11+
labels:
12+
- "release/patch"
13+
14+
# Terraform
15+
- package-ecosystem: "terraform"
16+
directory: "/"
17+
schedule:
18+
interval: "weekly"
19+
commit-message:
20+
prefix: "chore: "
21+
labels:
22+
- "release/patch"
23+
24+
- package-ecosystem: "terraform"
25+
directory: "/examples/complete/"
26+
schedule:
27+
interval: "weekly"
28+
commit-message:
29+
prefix: "chore: "
30+
labels:
31+
- "release/patch"
32+
33+
- package-ecosystem: "terraform"
34+
directory: "/examples/simple/"
35+
schedule:
36+
interval: "weekly"
37+
commit-message:
38+
prefix: "chore: "
39+
labels:
40+
- "release/patch"

‎.github/workflows/documentation.yml‎

Lines changed: 0 additions & 17 deletions
This file was deleted.

‎.github/workflows/pr-title.yml‎

Lines changed: 6 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
1-
name: 'Validate PR title'
1+
name: Validate PR title
2+
3+
permissions:
4+
pull-requests: read
5+
statuses: write
26

37
on:
48
pull_request_target:
@@ -9,42 +13,4 @@ on:
913

1014
jobs:
1115
main:
12-
name: Validate PR title
13-
runs-on: ubuntu-latest
14-
steps:
15-
# Please look up the latest version from
16-
# https://github.com/amannn/action-semantic-pull-request/releases
17-
- uses: amannn/action-semantic-pull-request@v4
18-
env:
19-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
20-
with:
21-
# Configure which types are allowed.
22-
# Default: https://github.com/commitizen/conventional-commit-types
23-
types: |
24-
feat
25-
fix
26-
improvement
27-
docs
28-
refactor
29-
test
30-
ci
31-
chore
32-
# Configure that a scope must always be provided.
33-
requireScope: false
34-
# Configure additional validation for the subject based on a regex.
35-
# This example ensures the subject starts with an uppercase character.
36-
subjectPattern: ^[A-Z].+$
37-
# If `subjectPattern` is configured, you can use this property to override
38-
# the default error message that is shown when the pattern doesn't match.
39-
# The variables `subject` and `title` can be used within the message.
40-
subjectPatternError: |
41-
The subject "{subject}" found in the pull request title "{title}"
42-
didn't match the configured pattern. Please ensure that the subject
43-
starts with an uppercase character.
44-
# For work-in-progress PRs you can typically use draft pull requests
45-
# from Github. However, private repositories on the free plan don't have
46-
# this option and therefore this action allows you to opt-in to using the
47-
# special "[WIP]" prefix to indicate this state. This will avoid the
48-
# validation of the PR title and the pull request checks remain pending.
49-
# Note that a second check will be reported if this is enabled.
50-
wip: true
16+
uses: getindata/github-workflows/.github/workflows/gh-validate-pr-title.yml@v1

‎.github/workflows/pre-commit.yml‎

Lines changed: 10 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -1,82 +1,18 @@
1-
name: Pre-Commit
1+
name: TF Pre-Commit
2+
3+
permissions:
4+
contents: read
25

36
on:
47
pull_request:
58
branches:
69
- main
710
- master
811

9-
env:
10-
TERRAFORM_DOCS_VERSION: v0.16.0
11-
1212
jobs:
13-
collectInputs:
14-
name: Collect workflow inputs
15-
runs-on: ubuntu-latest
16-
outputs:
17-
directories: ${{ steps.dirs.outputs.directories }}
18-
steps:
19-
- name: Checkout
20-
uses: actions/checkout@v2
21-
22-
- name: Get root directories
23-
id: dirs
24-
uses: clowdhaus/terraform-composite-actions/[email protected]
25-
26-
preCommitMinVersions:
27-
name: Min TF pre-commit
28-
needs: collectInputs
29-
runs-on: ubuntu-latest
30-
strategy:
31-
matrix:
32-
directory: ${{ fromJson(needs.collectInputs.outputs.directories) }}
33-
steps:
34-
- name: Checkout
35-
uses: actions/checkout@v2
36-
37-
- name: Terraform min/max versions
38-
id: minMax
39-
uses: clowdhaus/[email protected]
40-
with:
41-
directory: ${{ matrix.directory }}
42-
43-
- name: Pre-commit Terraform ${{ steps.minMax.outputs.minVersion }}
44-
# Run only validate pre-commit check on min version supported
45-
if: ${{ matrix.directory != '.' }}
46-
uses: clowdhaus/terraform-composite-actions/[email protected]
47-
with:
48-
terraform-version: ${{ steps.minMax.outputs.minVersion }}
49-
args: "terraform-validate --color=always --show-diff-on-failure --files ${{ matrix.directory }}/*"
50-
51-
- name: Pre-commit Terraform ${{ steps.minMax.outputs.minVersion }}
52-
# Run only validate pre-commit check on min version supported
53-
if: ${{ matrix.directory == '.' }}
54-
uses: clowdhaus/terraform-composite-actions/[email protected]
55-
with:
56-
terraform-version: ${{ steps.minMax.outputs.minVersion }}
57-
args: "terraform-validate --color=always --show-diff-on-failure --files $(ls *.tf)"
58-
59-
preCommitMaxVersion:
60-
name: Max TF pre-commit
61-
runs-on: ubuntu-latest
62-
needs: collectInputs
63-
steps:
64-
- name: Checkout
65-
uses: actions/checkout@v2
66-
with:
67-
ref: ${{ github.event.pull_request.head.ref }}
68-
repository: ${{github.event.pull_request.head.repo.full_name}}
69-
70-
- name: Terraform min/max versions
71-
id: minMax
72-
uses: clowdhaus/[email protected]
73-
74-
# Step required as tflint pre-commit hook requires module to be initialised
75-
- run: terraform init
76-
77-
- name: Pre-commit Terraform ${{ steps.minMax.outputs.maxVersion }}
78-
uses: clowdhaus/terraform-composite-actions/[email protected]
79-
with:
80-
terraform-version: ${{ steps.minMax.outputs.maxVersion }}
81-
terraform-docs-version: ${{ env.TERRAFORM_DOCS_VERSION }}
82-
# tflint-version: ${{ env.TFLINT_VERSION }} # use this version with "Invicton-Labs/deepmerge/null" module
13+
main:
14+
uses: getindata/github-workflows/.github/workflows/tf-pre-commit.yml@v1
15+
with:
16+
# tflint v0.46.0 is the latest version we can use with pre-commit v0.1.20
17+
# See .pre-commit-config.yaml for more details.
18+
tflint-version: v0.46.0

‎.github/workflows/release.yml‎

Lines changed: 6 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -1,67 +1,13 @@
11
name: Create new release with changelog
22

3+
permissions:
4+
contents: write
5+
pull-requests: write
6+
37
on:
4-
pull_request:
8+
pull_request_target:
59
types: [closed]
610

711
jobs:
812
release:
9-
runs-on: ubuntu-latest
10-
steps:
11-
- uses: actions/checkout@v2
12-
with:
13-
fetch-depth: 100
14-
15-
- name: Check release label
16-
id: release-label
17-
uses: actions-ecosystem/action-release-label@v1
18-
if: ${{ github.event.pull_request.merged == true }}
19-
20-
- name: Get latest tag
21-
id: get-latest-tag
22-
uses: actions-ecosystem/action-get-latest-tag@v1
23-
if: ${{ steps.release-label.outputs.level != null }}
24-
25-
- name: Bump semantic version
26-
id: bump-semver
27-
uses: actions-ecosystem/action-bump-semver@v1
28-
if: ${{ steps.release-label.outputs.level != null }}
29-
with:
30-
current_version: ${{ steps.get-latest-tag.outputs.tag }}
31-
level: ${{ steps.release-label.outputs.level }}
32-
33-
- name: Tag release
34-
id: tag-relese
35-
uses: actions-ecosystem/action-push-tag@v1
36-
if: ${{ steps.release-label.outputs.level != null }}
37-
with:
38-
tag: ${{ steps.bump-semver.outputs.new_version }}
39-
message: "${{ steps.bump-semver.outputs.new_version }}: PR #${{ github.event.pull_request.number }} ${{ github.event.pull_request.title }}"
40-
41-
- name: Generate new release with changelog
42-
id: release-with-changelog
43-
uses: fregante/release-with-changelog@v3
44-
if: ${{ steps.bump-semver.outputs.new_version != null }}
45-
with:
46-
token: "${{ secrets.GITHUB_TOKEN }}"
47-
exclude: '^meta|^docs|^document|^lint|^ci|^refactor|readme|workflow|bump|dependencies|yml|^v?\d+\.\d+\.\d+'
48-
tag: "${{ steps.bump-semver.outputs.new_version }}"
49-
title: "Version ${{ steps.bump-semver.outputs.new_version }}"
50-
commit-template: "- {title} ← {hash}"
51-
skip-on-empty: true
52-
template: |
53-
### Changelog
54-
55-
{commits}
56-
57-
{range}
58-
59-
- name: Comment PR
60-
id: add-comment
61-
uses: actions-ecosystem/action-create-comment@v1
62-
if: ${{ steps.bump-semver.outputs.new_version != null }}
63-
with:
64-
github_token: ${{ secrets.GITHUB_TOKEN }}
65-
number: ${{ steps.get-merged-pull-request.outputs.number }}
66-
body: |
67-
The new version [${{ steps.bump-semver.outputs.new_version }}](https://github.com/${{ github.repository }}/releases/tag/${{ steps.bump-semver.outputs.new_version }}) has been released :tada:
13+
uses: getindata/github-workflows/.github/workflows/gh-create-release.yml@v1

‎.pre-commit-config.yaml‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,35 @@
11
repos:
22
- repo: https://github.com/gruntwork-io/pre-commit
3-
rev: "v0.1.17" # Get the latest from: https://github.com/gruntwork-io/pre-commit/releases
3+
# Stick to v0.1.20 until this bug is fixed: https://github.com/gruntwork-io/pre-commit/issues/102
4+
# When updating, also check if tflint version in pre-commit workflow can be updated.
5+
rev: "v0.1.20" # Get the latest from: https://github.com/gruntwork-io/pre-commit/releases
46
hooks:
7+
- id: terraform-validate # It should be the first step as it runs terraform init required by tflint
8+
- id: terraform-fmt
59
- id: tflint
610
args:
711
- --module
812
- --config=.tflint.hcl
9-
- id: terraform-validate
10-
- id: terraform-fmt
1113

1214
- repo: https://github.com/terraform-docs/terraform-docs
13-
rev: "v0.16.0" # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases
15+
rev: "v0.16.0" # Get the latest from: https://github.com/terraform-docs/terraform-docs/releases
1416
hooks:
1517
- id: terraform-docs-go
1618
args: ["."]
1719

1820
- repo: https://github.com/bridgecrewio/checkov.git
19-
rev: "2.2.246" # Get the latest from: https://github.com/bridgecrewio/checkov/releases
21+
rev: "2.5.13" # Get the latest from: https://github.com/bridgecrewio/checkov/releases
2022
hooks:
2123
- id: checkov
22-
args: [--skip-check, "CKV2_GHA_1"] #Flase positive for top-level permissions
24+
args: [--skip-check, "CKV_TF_1"] # Terraform module sources do not use a git url with a commit hash revision
2325

2426
- repo: https://github.com/pre-commit/pre-commit-hooks
25-
rev: "v4.3.0" # Get the latest from: https://github.com/pre-commit/pre-commit-hooks/releases
27+
rev: "v4.5.0" # Get the latest from: https://github.com/pre-commit/pre-commit-hooks/releases
2628
hooks:
2729
- id: check-merge-conflict
30+
args: ["--assume-in-merge"]
31+
- id: mixed-line-ending
32+
args: ["--fix=no"]
2833
- id: end-of-file-fixer
34+
- id: check-case-conflict
35+
- id: check-yaml

‎.tflint.hcl‎

Lines changed: 7 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,38 +1,10 @@
1-
config {
2-
ignore_module = {
3-
"Invicton-Labs/deepmerge/null" = true
4-
}
1+
plugin "terraform" {
2+
enabled = true
3+
version = "0.5.0"
4+
source = "github.com/terraform-linters/tflint-ruleset-terraform"
5+
preset = "all"
56
}
67

7-
rule "terraform_deprecated_interpolation" {
8-
enabled = true
9-
}
10-
11-
rule "terraform_documented_outputs" {
12-
enabled = true
13-
}
14-
15-
rule "terraform_documented_variables" {
16-
enabled = true
17-
}
18-
19-
rule "terraform_typed_variables" {
20-
enabled = true
21-
}
22-
23-
rule "terraform_required_version" {
24-
enabled = true
25-
}
26-
27-
rule "terraform_required_providers" {
28-
enabled = true
29-
}
30-
31-
rule "terraform_unused_required_providers" {
32-
enabled = true
33-
}
34-
35-
rule "terraform_naming_convention" {
36-
enabled = true
37-
format = "snake_case"
8+
rule "terraform_standard_module_structure" {
9+
enabled = false # Fails on context.tf
3810
}

0 commit comments

Comments
 (0)