Skip to content

Commit 4ecd71d

Browse files
wmoussa-gcwmoussa-gc
authored
Merge pull request #20 from cds-snc/repo-sync/site-reliability-engineering/default
chore: synced file(s) with cds-snc/site-reliability-engineering
2 parents 2ced5a7 + 6a33a46 commit 4ecd71d

File tree

4 files changed

+118
-3
lines changed

4 files changed

+118
-3
lines changed

‎.github/workflows/backstage-catalog-helper.yml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: Backstage Catalog Info Helper
2+
on:
3+
workflow_dispatch:
4+
schedule:
5+
- cron: "0 0 * * *"
6+
7+
jobs:
8+
update-catalog-info:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- name: Checkout Actions
12+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
13+
with:
14+
fetch-depth: 0
15+
- name: Run Backstage Catalog Info Helper
16+
uses: cds-snc/backstage-catalog-info-helper-action@v0.3.1
17+
with:
18+
github_app_id: ${{ secrets.SRE_BOT_RW_APP_ID }}
19+
github_app_private_key: ${{ secrets.SRE_BOT_RW_PRIVATE_KEY }}
20+
github_organization: cds-snc
21+
- name: impersonate Read/Write GH App
22+
uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
23+
id: generate_token
24+
with:
25+
app_id: ${{ secrets.SRE_BOT_RW_APP_ID }}
26+
private_key: ${{ secrets.SRE_BOT_RW_PRIVATE_KEY }}
27+
- name: Create pull request
28+
uses: peter-evans/create-pull-request@v3
29+
with:
30+
token: ${{ steps.generate_token.outputs.token}}
31+
commit-message: 'Add catalog-info.yaml'
32+
branch: 'backstage/catalog-info'
33+
title: 'Add catalog-info.yaml'
34+
body: 'Adding a basic catalog-info.yaml to start populating the backstage catalog with your components.'
35+
labels: 'backstage'
36+
add-paths: |
37+
catalog-info.yaml

‎.github/workflows/export_github_data.yml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: GitHub repository metadata exporter
2+
on:
3+
workflow_dispatch:
4+
schedule:
5+
- cron: "20 7 * * *"
6+
7+
jobs:
8+
export-data:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- name: Audit DNS requests
12+
uses: cds-snc/dns-proxy-action@main
13+
env:
14+
DNS_PROXY_FORWARDTOSENTINEL: "true"
15+
DNS_PROXY_LOGANALYTICSWORKSPACEID: ${{ secrets.LOG_ANALYTICS_WORKSPACE_ID }}
16+
DNS_PROXY_LOGANALYTICSSHAREDKEY: ${{ secrets.LOG_ANALYTICS_WORKSPACE_KEY }}
17+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
18+
- name: Export Data
19+
uses: cds-snc/github-repository-metadata-exporter@main
20+
with:
21+
github-app-id: ${{ secrets.SRE_BOT_RO_APP_ID }}
22+
github-app-installation-id: ${{ secrets.SRE_BOT_RO_INSTALLATION_ID }}
23+
github-app-private-key: ${{ secrets.SRE_BOT_RO_PRIVATE_KEY }}
24+
log-analytics-workspace-id: ${{ secrets.LOG_ANALYTICS_WORKSPACE_ID }}
25+
log-analytics-workspace-key: ${{ secrets.LOG_ANALYTICS_WORKSPACE_KEY }}

‎.github/workflows/ossf-scorecard.yml

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
name: Scorecards supply-chain security
2+
on:
3+
workflow_dispatch:
4+
schedule:
5+
# Weekly on Saturdays.
6+
- cron: "30 1 * * 6"
7+
push:
8+
branches:
9+
- main
10+
11+
permissions: read-all
12+
13+
jobs:
14+
analysis:
15+
name: Scorecards analysis
16+
runs-on: ubuntu-latest
17+
permissions:
18+
actions: read
19+
contents: read
20+
21+
steps:
22+
- name: "Checkout code"
23+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
24+
with:
25+
persist-credentials: false
26+
27+
- name: "Run analysis"
28+
uses: ossf/scorecard-action@75cb7af1033cfb77c9fc7d8abc30420008f558f4
29+
with:
30+
results_file: ossf-results.json
31+
results_format: json
32+
publish_results: false
33+
34+
- name: "Add metadata"
35+
run: |
36+
full_repo="${{ github.repository }}"
37+
OWNER=${full_repo%/*}
38+
REPO=${full_repo#*/}
39+
jq -c '. + {"metadata_owner": "'$OWNER'", "metadata_repo": "'$REPO'", "metadata_query": "ossf"}' ossf-results.json > ossf-results-modified.json
40+
41+
- name: "Post results to Sentinel"
42+
uses: cds-snc/sentinel-forward-data-action@main
43+
with:
44+
file_name: ossf-results-modified.json
45+
log_type: GitHubMetadata_OSSF_Scorecard
46+
log_analytics_workspace_id: ${{ secrets.LOG_ANALYTICS_WORKSPACE_ID }}
47+
log_analytics_workspace_key: ${{ secrets.LOG_ANALYTICS_WORKSPACE_KEY }}

‎.github/workflows/s3-backup.yml

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,12 @@ jobs:
1010
steps:
1111

1212
- name: Checkout
13-
uses: actions/checkout@v2
13+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
1414
with:
1515
fetch-depth: 0 # retrieve all history
1616

1717
- name: Configure AWS credentials
18-
uses: aws-actions/configure-aws-credentials@v1
18+
uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
1919
with:
2020
aws-access-key-id: ${{ secrets.AWS_S3_BACKUP_ACCESS_KEY_ID }}
2121
aws-secret-access-key: ${{ secrets.AWS_S3_BACKUP_SECRET_ACCESS_KEY }}
@@ -30,4 +30,10 @@ jobs:
3030
3131
- name: Upload to S3 bucket
3232
run: |
33-
aws s3 sync . s3://${{ secrets.AWS_S3_BACKUP_BUCKET }} --exclude='*' --include='${{ github.repository }}/*'
33+
aws s3 sync . s3://${{ secrets.AWS_S3_BACKUP_BUCKET }} --exclude='*' --include='${{ github.repository }}/*'
34+
35+
- name: Notify Slack channel if this job failed
36+
if: ${{ failure() }}
37+
run: |
38+
json='{"text":"S3 backup failed in <https://github.com/${{ github.repository }}>!"}'
39+
curl -X POST -H 'Content-type: application/json' --data "$json" ${{ secrets.SLACK_NOTIFY_WEBHOOK }}

0 commit comments

Comments
 (0)