Skip to content

Commit 759bbba

Browse files
uk-bollyuk-bolly
authored
Merge pull request #49 from ansible-lockdown/devel
Galaxy Compliance
2 parents 8bbccd6 + eee101c commit 759bbba

20 files changed

+238
-260
lines changed

‎.github/workflows/linux_benchmark_testing.yml

+95-95
Original file line numberDiff line numberDiff line change
@@ -6,106 +6,106 @@ name: linux_benchmark_pipeline
66
# Triggers the workflow on push or pull request
77
# events but only for the devel branch
88
on:
9-
pull_request_target:
10-
types: [opened, reopened, synchronize]
11-
branches:
12-
- devel
13-
- main
14-
paths:
15-
- '**.yml'
16-
- '**.sh'
17-
- '**.j2'
18-
- '**.ps1'
19-
- '**.cfg'
9+
pull_request_target:
10+
types: [opened, reopened, synchronize]
11+
branches:
12+
- devel
13+
- main
14+
paths:
15+
- '**.yml'
16+
- '**.sh'
17+
- '**.j2'
18+
- '**.ps1'
19+
- '**.cfg'
2020

2121
# A workflow run is made up of one or more jobs
2222
# that can run sequentially or in parallel
2323
jobs:
2424
# This will create messages for first time contributers and direct them to the Discord server
25-
welcome:
26-
runs-on: ubuntu-latest
27-
28-
steps:
29-
- uses: actions/first-interaction@main
30-
with:
31-
repo-token: ${{ secrets.GITHUB_TOKEN }}
32-
pr-message: |-
33-
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
34-
Please join in the conversation happening on the [Discord Server](https://discord.io/ansible-lockdown) as well.
35-
# This workflow contains a single job called "build"
36-
build:
37-
# The type of runner that the job will run on
38-
runs-on: ubuntu-latest
39-
40-
env:
41-
ENABLE_DEBUG: false
42-
43-
# Steps represent a sequence of tasks that will be executed as part of the job
44-
steps:
45-
# Checks-out your repository under $GITHUB_WORKSPACE,
46-
# so your job can access it
47-
- uses: actions/checkout@v3
48-
with:
49-
ref: ${{ github.event.pull_request.head.sha }}
50-
51-
- name: Add_ssh_key
52-
working-directory: .github/workflows
53-
env:
54-
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
55-
PRIVATE_KEY: "${{ secrets.SSH_PRV_KEY }}"
56-
run: |
57-
mkdir .ssh
58-
chmod 700 .ssh
59-
echo $PRIVATE_KEY > .ssh/github_actions.pem
60-
chmod 600 .ssh/github_actions.pem
61-
62-
### Build out the server
63-
- name: Terraform_Init
64-
working-directory: .github/workflows
65-
run: terraform init
66-
67-
- name: Terraform_Validate
68-
working-directory: .github/workflows
69-
run: terraform validate
25+
welcome:
26+
runs-on: ubuntu-latest
27+
28+
steps:
29+
- uses: actions/first-interaction@main
30+
with:
31+
repo-token: ${{ secrets.GITHUB_TOKEN }}
32+
pr-message: |-
33+
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
34+
Please join in the conversation happening on the [Discord Server](https://discord.io/ansible-lockdown) as well.
35+
# This workflow contains a single job called "build"
36+
build:
37+
# The type of runner that the job will run on
38+
runs-on: ubuntu-latest
7039

71-
- name: Terraform_Apply
72-
working-directory: .github/workflows
7340
env:
74-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
75-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
76-
run: terraform apply -var-file "github_vars.tfvars" -var-file "OS.tfvars" --auto-approve -input=false
77-
78-
## Debug Section
79-
- name: DEBUG - Show Ansible hostfile
80-
if: env.ENABLE_DEBUG == 'true'
81-
working-directory: .github/workflows
82-
run: cat hosts.yml
83-
84-
# Aws deployments taking a while to come up insert sleep or playbook fails
85-
86-
- name: Sleep for 60 seconds
87-
run: sleep 60s
88-
shell: bash
89-
90-
# Run the ansible playbook
91-
- name: Run_Ansible_Playbook
92-
uses: arillso/action.playbook@master
93-
with:
94-
playbook: site.yml
95-
inventory: .github/workflows/hosts.yml
96-
galaxy_file: collections/requirements.yml
97-
private_key: ${{ secrets.SSH_PRV_KEY }}
98-
# verbose: 3
99-
env:
100-
ANSIBLE_HOST_KEY_CHECKING: "false"
101-
ANSIBLE_DEPRECATION_WARNINGS: "false"
102-
103-
# Remove test system - User secrets to keep if necessary
41+
ENABLE_DEBUG: false
42+
43+
# Steps represent a sequence of tasks that will be executed as part of the job
44+
steps:
45+
# Checks-out your repository under $GITHUB_WORKSPACE,
46+
# so your job can access it
47+
- uses: actions/checkout@v3
48+
with:
49+
ref: ${{ github.event.pull_request.head.sha }}
50+
51+
- name: Add_ssh_key
52+
working-directory: .github/workflows
53+
env:
54+
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
55+
PRIVATE_KEY: "${{ secrets.SSH_PRV_KEY }}"
56+
run: |
57+
mkdir .ssh
58+
chmod 700 .ssh
59+
echo $PRIVATE_KEY > .ssh/github_actions.pem
60+
chmod 600 .ssh/github_actions.pem
10461
105-
- name: Terraform_Destroy
106-
working-directory: .github/workflows
107-
if: always() && env.ENABLE_DEBUG == 'false'
108-
env:
109-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
110-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
111-
run: terraform destroy -var-file "github_vars.tfvars" -var-file "OS.tfvars" --auto-approve -input=false
62+
### Build out the server
63+
- name: Terraform_Init
64+
working-directory: .github/workflows
65+
run: terraform init
66+
67+
- name: Terraform_Validate
68+
working-directory: .github/workflows
69+
run: terraform validate
70+
71+
- name: Terraform_Apply
72+
working-directory: .github/workflows
73+
env:
74+
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
75+
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
76+
run: terraform apply -var-file "github_vars.tfvars" -var-file "OS.tfvars" --auto-approve -input=false
77+
78+
## Debug Section
79+
- name: DEBUG - Show Ansible hostfile
80+
if: env.ENABLE_DEBUG == 'true'
81+
working-directory: .github/workflows
82+
run: cat hosts.yml
83+
84+
# Aws deployments taking a while to come up insert sleep or playbook fails
85+
86+
- name: Sleep for 60 seconds
87+
run: sleep 60s
88+
shell: bash
89+
90+
# Run the ansible playbook
91+
- name: Run_Ansible_Playbook
92+
uses: arillso/action.playbook@master
93+
with:
94+
playbook: site.yml
95+
inventory: .github/workflows/hosts.yml
96+
galaxy_file: collections/requirements.yml
97+
private_key: ${{ secrets.SSH_PRV_KEY }}
98+
# verbose: 3
99+
env:
100+
ANSIBLE_HOST_KEY_CHECKING: "false"
101+
ANSIBLE_DEPRECATION_WARNINGS: "false"
102+
103+
# Remove test system - User secrets to keep if necessary
104+
105+
- name: Terraform_Destroy
106+
working-directory: .github/workflows
107+
if: always() && env.ENABLE_DEBUG == 'false'
108+
env:
109+
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
110+
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
111+
run: terraform destroy -var-file "github_vars.tfvars" -var-file "OS.tfvars" --auto-approve -input=false

‎.github/workflows/main.tf

-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ provider "aws" {
55

66
// Create a security group with access to port 22 and port 80 open to serve HTTP traffic
77

8-
98
resource "random_id" "server" {
109
keepers = {
1110
# Generate a new id each time we switch to a new AMI id

‎.github/workflows/update_galaxy.yml

+10-10
Original file line numberDiff line numberDiff line change
@@ -7,15 +7,15 @@ name: update galaxy
77
# Controls when the action will run.
88
# Triggers the workflow on merge request events to the main branch
99
on:
10-
push:
11-
branches:
12-
- main
10+
push:
11+
branches:
12+
- main
1313
jobs:
1414
update_role:
15-
runs-on: ubuntu-latest
16-
steps:
17-
- uses: actions/checkout@v3
18-
- uses: robertdebock/galaxy-action@master
19-
with:
20-
galaxy_api_key: ${{ secrets.GALAXY_API_KEY }}
21-
git_branch: main
15+
runs-on: ubuntu-latest
16+
steps:
17+
- uses: actions/checkout@v3
18+
- uses: robertdebock/galaxy-action@master
19+
with:
20+
galaxy_api_key: ${{ secrets.GALAXY_API_KEY }}
21+
git_branch: main

‎.yamllint

+21-29
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,25 @@
11
---
2+
# Based on ansible-lint config
23
extends: default
34

4-
ignore: |
5-
tests/
6-
molecule/
7-
.github/
8-
.gitlab-ci.yml
9-
*molecule.yml
10-
115
rules:
12-
indentation:
13-
# Requiring 4 space indentation
14-
spaces: 4
15-
# Requiring consistent indentation within a file, either indented or not
16-
indent-sequences: consistent
17-
braces:
18-
max-spaces-inside: 1
19-
level: error
20-
brackets:
21-
max-spaces-inside: 1
22-
level: error
23-
empty-lines:
24-
max: 1
25-
line-length: disable
26-
key-duplicates: enable
27-
new-line-at-end-of-file: enable
28-
new-lines:
29-
type: unix
30-
trailing-spaces: enable
31-
truthy:
32-
allowed-values: ['true', 'false']
33-
check-keys: false
6+
braces: {max-spaces-inside: 1, level: error}
7+
brackets: {max-spaces-inside: 1, level: error}
8+
colons: {max-spaces-after: -1, level: error}
9+
commas: {max-spaces-after: -1, level: error}
10+
comments: disable
11+
comments-indentation: disable
12+
document-start: disable
13+
empty-lines: {max: 3, level: error}
14+
hyphens: {level: error}
15+
indentation:
16+
# Requiring 4 space indentation
17+
spaces: 4
18+
# Requiring consistent indentation within a file, either indented or not
19+
indent-sequences: consistent
20+
key-duplicates: enable
21+
line-length: disable
22+
new-line-at-end-of-file: disable
23+
new-lines: {type: unix}
24+
trailing-spaces: disable
25+
truthy: disable

‎CONTRIBUTING.rst

-1
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,6 @@ following text in your contribution commit message:
6161

6262
::
6363

64-
6564
This message can be entered manually, or if you have configured git
6665
with the correct `user.name` and `user.email`, you can use the `-s`
6766
option to `git commit` to automatically include the signoff message.

‎Changelog.md

+5
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
# Changes to rhel9CIS
22

3+
## 1.0.6
4+
5+
updated ymlalint as galaxy doenst honouyr local settings
6+
removed empty lines in files
7+
38
## 1.0.5
49

510
updated yamllint

‎Makefile

-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
.PHONY: all help galaxy-install ansible-list yamllint pip-requirements
22

3-
43
GALAXY=ansible-galaxy
54
ANSIBLE_LINT='/usr/local/bin/ansible-lint'
65
ANSIBLE_FILE=site.yml
@@ -15,7 +14,6 @@ help:
1514
@echo " yamllint to lint playbook files"
1615
@echo " pip-requirements add pip required file"
1716

18-
1917
galaxy-install:
2018
$(GALAXY) install -r ./collections/requirements.yml
2119

@@ -29,4 +27,3 @@ pip-requirements:
2927
@echo 'Python dependencies:'
3028
@cat requirements.txt
3129
pip3 install -r requirements.txt
32-

‎ansible.cfg

-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@ stdout_callback = yaml
1212
# Use the stdout_callback when running ad-hoc commands.
1313
bin_ansible_callbacks = True
1414

15-
1615
[privilege_escalation]
1716

1817
[paramiko_connection]

‎molecule/default/converge.yml

+17-17
Original file line numberDiff line numberDiff line change
@@ -5,23 +5,23 @@
55
gather_facts: true
66

77
vars:
8-
role_name: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }}"
9-
ansible_user: root
10-
system_is_container: true
11-
rhel9cis_selinux_disable: true
12-
rhel9cis_rule_5_3_4: false
13-
rhel9cis_rule_1_1_10: false
14-
rhel9cis_firewall: "none"
15-
rhel9cis_rule_4_1_1_1: false
16-
rhel9cis_rule_4_1_1_2: false
17-
rhel9cis_rule_4_1_1_3: false
18-
rhel9cis_rule_4_1_1_4: false
19-
rhel9cis_rule_4_2_1_2: false
20-
rhel9cis_rule_4_2_1_4: false
21-
rhel9cis_rule_5_1_1: false
8+
role_name: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }}"
9+
ansible_user: root
10+
system_is_container: true
11+
rhel9cis_selinux_disable: true
12+
rhel9cis_rule_5_3_4: false
13+
rhel9cis_rule_1_1_10: false
14+
rhel9cis_firewall: "none"
15+
rhel9cis_rule_4_1_1_1: false
16+
rhel9cis_rule_4_1_1_2: false
17+
rhel9cis_rule_4_1_1_3: false
18+
rhel9cis_rule_4_1_1_4: false
19+
rhel9cis_rule_4_2_1_2: false
20+
rhel9cis_rule_4_2_1_4: false
21+
rhel9cis_rule_5_1_1: false
2222

2323
pre_tasks:
2424
tasks:
25-
- name: "Include tasks"
26-
ansible.builtin.include_role:
27-
name: "{{ role_name }}"
25+
- name: "Include tasks"
26+
ansible.builtin.include_role:
27+
name: "{{ role_name }}"

0 commit comments

Comments
 (0)