ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2026-05-09 23:33:53 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Workflow updates

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2026-04-08 12:51:49 +01:00
parent eedb2188c3
commit 5783bf4ce4
No known key found for this signature in database
GPG key ID: 997FF7FE93AEB5B9
3 changed files with 259 additions and 263 deletions
Download patch file Download diff file Expand all files Collapse all files

275
.github/workflows/devel_pipeline_validation.yml vendored
View file

@ -1,162 +1,163 @@
--- ---
name: Devel pipeline name: Devel pipeline
on: # yamllint disable-line rule:truthy on: # yamllint disable-line rule:truthy
pull_request_target: pull_request_target:
types: [opened, reopened, synchronize] types: [opened, reopened, synchronize]
branches: branches:
- devel - devel
- benchmark* - benchmark*
paths: paths:
- '**.yml' - '**.yml'
- '**.sh' - '**.sh'
- '**.j2' - '**.j2'
- '**.ps1' - '**.ps1'
- '**.cfg' - '**.cfg'
# Allow manual running of workflow # Allow manual running of workflow
workflow_dispatch: workflow_dispatch:
# A workflow run is made up of one or more jobs # A workflow run is made up of one or more jobs
# that can run sequentially or in parallel # that can run sequentially or in parallel
jobs: jobs:
# This will create messages for first time contributers and direct them to the Discord server # This will create messages for first time contributers and direct them to the Discord server
welcome: welcome:
runs-on: ubuntu-latest runs-on: ubuntu-latest
permissions: permissions:
issues: write issues: write
pull-requests: write pull-requests: write
steps: steps:
- uses: actions/first-interaction@main - uses: actions/first-interaction@main
with: with:
repo_token: ${{ secrets.GITHUB_TOKEN }} repo_token: ${{ secrets.GITHUB_TOKEN }}
issue_message: |- issue_message: |-
Congrats on opening your first issue and thank you for taking the time to help improve Ansible-Lockdown! Congrats on opening your first issue and thank you for taking the time to help improve Ansible-Lockdown!
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well. Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
pr_message: |- pr_message: |-
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown! Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well. Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
# This workflow contains a single job that tests the playbook # This workflow contains a single job that tests the playbook
playbook-test: playbook-test:
# The type of runner that the job will run on # The type of runner that the job will run on
runs-on: self-hosted runs-on: self-hosted
# Allow permissions for AWS auth # Allow permissions for AWS auth
permissions: permissions:
id-token: write id-token: write
contents: read contents: read
pull-requests: read pull-requests: read
env: env:
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }} ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
# Imported as a variable by terraform # Imported as a variable by terraform
TF_VAR_repository: ${{ github.event.repository.name }} TF_VAR_repository: ${{ github.event.repository.name }}
AWS_REGION: "us-east-1" AWS_REGION: "us-east-1"
ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }} ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
defaults: defaults:
run: run:
shell: bash shell: bash
working-directory: .github/workflows/github_linux_IaC working-directory: .github/workflows/github_linux_IaC
# working-directory: .github/workflows # working-directory: .github/workflows
steps: steps:
- name: Git clone the lockdown repository to test - name: Git clone the lockdown repository to test
uses: actions/checkout@v4 uses: actions/checkout@v6.0.2
with: with:
ref: ${{ github.event.pull_request.head.sha }} ref: ${{ github.event.pull_request.head.sha }}
- name: If a variable for IAC_BRANCH is set use that branch - name: If a variable for IAC_BRANCH is set use that branch
working-directory: .github/workflows working-directory: .github/workflows
run: | run: |
if [ ${{ vars.IAC_BRANCH }} != '' ]; then if [ ${{ vars.IAC_BRANCH }} != '' ]; then
echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}" echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
else else
echo IAC_BRANCH=main >> $GITHUB_ENV echo IAC_BRANCH=main >> $GITHUB_ENV
fi fi
# Pull in terraform code for linux servers # Pull in terraform code for linux servers
- name: Clone GitHub IaC plan - name: Clone GitHub IaC plan
uses: actions/checkout@v4 uses: actions/checkout@v6.0.2
with: with:
repository: ansible-lockdown/github_linux_IaC repository: ansible-lockdown/github_linux_IaC
path: .github/workflows/github_linux_IaC path: .github/workflows/github_linux_IaC
ref: ${{ env.IAC_BRANCH }} ref: ${{ env.IAC_BRANCH }}
# Uses dedicated restricted role and policy to enable this only for this task # Uses dedicated restricted role and policy to enable this only for this task
# No credentials are part of github for AWS auth # No credentials are part of github for AWS auth
- name: configure aws credentials - name: configure aws credentials
uses: aws-actions/configure-aws-credentials@main uses: aws-actions/configure-aws-credentials@main
with: with:
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }} role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
role-session-name: ${{ secrets.AWS_ROLE_SESSION }} role-session-name: ${{ secrets.AWS_ROLE_SESSION }}
aws-region: ${{ env.AWS_REGION }} aws-region: ${{ env.AWS_REGION }}
- name: DEBUG - Show IaC files - name: DEBUG - Show IaC files
if: env.ENABLE_DEBUG == 'true' if: env.ENABLE_DEBUG == 'true'
run: | run: |
echo "OSVAR = $OSVAR" echo "OSVAR = $OSVAR"
echo "benchmark_type = $benchmark_type" echo "benchmark_type = $benchmark_type"
pwd pwd
env: env:
# Imported from GitHub variables this is used to load the relevant OS.tfvars file # Imported from GitHub variables this is used to load the relevant OS.tfvars file
OSVAR: ${{ vars.OSVAR }} OSVAR: ${{ vars.OSVAR }}
benchmark_type: ${{ vars.BENCHMARK_TYPE }} benchmark_type: ${{ vars.BENCHMARK_TYPE }}
- name: Tofu init - name: Tofu init
id: init id: init
run: tofu init run: tofu init
env: env:
# Imported from GitHub variables this is used to load the relevant OS.tfvars file # Imported from GitHub variables this is used to load the relevant OS.tfvars file
OSVAR: ${{ vars.OSVAR }} OSVAR: ${{ vars.OSVAR }}
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
- name: Tofu validate - name: Tofu validate
id: validate id: validate
run: tofu validate run: tofu validate
env: env:
# Imported from GitHub variables this is used to load the relevant OS.tfvars file # Imported from GitHub variables this is used to load the relevant OS.tfvars file
OSVAR: ${{ vars.OSVAR }} OSVAR: ${{ vars.OSVAR }}
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
- name: Tofu apply - name: Tofu apply
id: apply id: apply
env: env:
OSVAR: ${{ vars.OSVAR }} OSVAR: ${{ vars.OSVAR }}
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }} TF_VAR_ansible_version: ${{ vars.ANSIBLE_RUNNER_VERSION }}
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }} TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false
## Debug Section ## Debug Section
- name: DEBUG - Show Ansible hostfile - name: DEBUG - Show Ansible hostfile
if: env.ENABLE_DEBUG == 'true' if: env.ENABLE_DEBUG == 'true'
run: cat hosts.yml run: cat hosts.yml
# Aws deployments taking a while to come up insert sleep or playbook fails # Aws deployments taking a while to come up insert sleep or playbook fails
- name: Sleep to allow system to come up - name: Sleep to allow system to come up
run: sleep ${{ vars.BUILD_SLEEPTIME }} run: sleep ${{ vars.BUILD_SLEEPTIME }}
# Run the Ansible playbook # Run the Ansible playbook
- name: Run_Ansible_Playbook - name: Run_Ansible_Playbook
env: env:
ANSIBLE_HOST_KEY_CHECKING: "false" ANSIBLE_HOST_KEY_CHECKING: "false"
ANSIBLE_DEPRECATION_WARNINGS: "false" ANSIBLE_DEPRECATION_WARNINGS: "false"
run: | run: |
/opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml --private-key ~/.ssh/le_runner ../../../site.yml /opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml --private-key ~/.ssh/le_runner ../../../site.yml
# Remove test system - User secrets to keep if necessary # Remove test system - User secrets to keep if necessary
- name: Tofu Destroy - name: Tofu Destroy
if: always() && env.ENABLE_DEBUG == 'false' if: always() && env.ENABLE_DEBUG == 'false'
env: env:
OSVAR: ${{ vars.OSVAR }} OSVAR: ${{ vars.OSVAR }}
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }} TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }} TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve -input=false run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve -input=false

6
.github/workflows/export_badges_private.yml vendored
View file

@ -2,12 +2,6 @@
name: Export Private Repo Badges name: Export Private Repo Badges
# Use different minute offsets with the same hourly pattern:
# Repo Group Suggested Cron Expression Explanation
# Group A 0 */6 * * * Starts at top of hour
# Group B 10 */6 * * * Starts at 10 after
# And So On
on: on:
push: push:
branches: branches:

241
.github/workflows/main_pipeline_validation.yml vendored
View file

@ -1,141 +1,142 @@
--- ---
name: Main pipeline name: Main pipeline
on: # yamllint disable-line rule:truthy on: # yamllint disable-line rule:truthy
pull_request_target: pull_request_target:
types: [opened, reopened, synchronize] types: [opened, reopened, synchronize]
branches: branches:
- main - main
- latest - latest
paths: paths:
- '**.yml' - '**.yml'
- '**.sh' - '**.sh'
- '**.j2' - '**.j2'
- '**.ps1' - '**.ps1'
- '**.cfg' - '**.cfg'
# Allow permissions for AWS auth # Allow permissions for AWS auth
permissions: permissions:
id-token: write id-token: write
contents: read contents: read
pull-requests: read pull-requests: read
# A workflow run is made up of one or more jobs # A workflow run is made up of one or more jobs
# that can run sequentially or in parallel # that can run sequentially or in parallel
jobs: jobs:
# This workflow contains a single job that tests the playbook # This workflow contains a single job that tests the playbook
playbook-test: playbook-test:
# The type of runner that the job will run on # The type of runner that the job will run on
runs-on: self-hosted runs-on: self-hosted
env: env:
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }} ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
# Imported as a variable by terraform # Imported as a variable by terraform
TF_VAR_repository: ${{ github.event.repository.name }} TF_VAR_repository: ${{ github.event.repository.name }}
AWS_REGION : "us-east-1" AWS_REGION: "us-east-1"
ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }} ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
defaults: defaults:
run: run:
shell: bash shell: bash
working-directory: .github/workflows/github_linux_IaC working-directory: .github/workflows/github_linux_IaC
# working-directory: .github/workflows # working-directory: .github/workflows
steps: steps:
- name: Git clone the lockdown repository to test - name: Git clone the lockdown repository to test
uses: actions/checkout@v4 uses: actions/checkout@v6.0.2
with: with:
ref: ${{ github.event.pull_request.head.sha }} ref: ${{ github.event.pull_request.head.sha }}
- name: If a variable for IAC_BRANCH is set use that branch - name: If a variable for IAC_BRANCH is set use that branch
working-directory: .github/workflows working-directory: .github/workflows
run: | run: |
if [ ${{ vars.IAC_BRANCH }} != '' ]; then if [ ${{ vars.IAC_BRANCH }} != '' ]; then
echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}" echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
else else
echo IAC_BRANCH=main >> $GITHUB_ENV echo IAC_BRANCH=main >> $GITHUB_ENV
fi fi
# Pull in terraform code for linux servers # Pull in terraform code for linux servers
- name: Clone GitHub IaC plan - name: Clone GitHub IaC plan
uses: actions/checkout@v4 uses: actions/checkout@v6.0.2
with: with:
repository: ansible-lockdown/github_linux_IaC repository: ansible-lockdown/github_linux_IaC
path: .github/workflows/github_linux_IaC path: .github/workflows/github_linux_IaC
ref: ${{ env.IAC_BRANCH }} ref: ${{ env.IAC_BRANCH }}
# Uses dedicated restricted role and policy to enable this only for this task # Uses dedicated restricted role and policy to enable this only for this task
# No credentials are part of github for AWS auth # No credentials are part of github for AWS auth
- name: configure aws credentials - name: configure aws credentials
uses: aws-actions/configure-aws-credentials@main uses: aws-actions/configure-aws-credentials@main
with: with:
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }} role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
role-session-name: ${{ secrets.AWS_ROLE_SESSION }} role-session-name: ${{ secrets.AWS_ROLE_SESSION }}
aws-region: ${{ env.AWS_REGION }} aws-region: ${{ env.AWS_REGION }}
- name: DEBUG - Show IaC files - name: DEBUG - Show IaC files
if: env.ENABLE_DEBUG == 'true' if: env.ENABLE_DEBUG == 'true'
run: | run: |
echo "OSVAR = $OSVAR" echo "OSVAR = $OSVAR"
echo "benchmark_type = $benchmark_type" echo "benchmark_type = $benchmark_type"
pwd pwd
ls ls
env: env:
# Imported from GitHub variables this is used to load the relevant OS.tfvars file # Imported from GitHub variables this is used to load the relevant OS.tfvars file
OSVAR: ${{ vars.OSVAR }} OSVAR: ${{ vars.OSVAR }}
benchmark_type: ${{ vars.BENCHMARK_TYPE }} benchmark_type: ${{ vars.BENCHMARK_TYPE }}
- name: Tofu init - name: Tofu init
id: init id: init
run: tofu init run: tofu init
env: env:
# Imported from GitHub variables this is used to load the relevant OS.tfvars file # Imported from GitHub variables this is used to load the relevant OS.tfvars file
OSVAR: ${{ vars.OSVAR }} OSVAR: ${{ vars.OSVAR }}
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
- name: Tofu validate - name: Tofu validate
id: validate id: validate
run: tofu validate run: tofu validate
env: env:
# Imported from GitHub variables this is used to load the relevant OS.tfvars file # Imported from GitHub variables this is used to load the relevant OS.tfvars file
OSVAR: ${{ vars.OSVAR }} OSVAR: ${{ vars.OSVAR }}
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
- name: Tofu apply - name: Tofu apply
id: apply id: apply
env: env:
OSVAR: ${{ vars.OSVAR }} OSVAR: ${{ vars.OSVAR }}
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }} TF_VAR_ansible_version: ${{ vars.ANSIBLE_RUNNER_VERSION }}
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }} TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false
## Debug Section ## Debug Section
- name: DEBUG - Show Ansible hostfile - name: DEBUG - Show Ansible hostfile
if: env.ENABLE_DEBUG == 'true' if: env.ENABLE_DEBUG == 'true'
run: cat hosts.yml run: cat hosts.yml
# Aws deployments taking a while to come up insert sleep or playbook fails # Aws deployments taking a while to come up insert sleep or playbook fails
- name: Sleep to allow system to come up - name: Sleep to allow system to come up
run: sleep ${{ vars.BUILD_SLEEPTIME }} run: sleep ${{ vars.BUILD_SLEEPTIME }}
# Run the Ansible playbook # Run the Ansible playbook
- name: Run_Ansible_Playbook - name: Run_Ansible_Playbook
env: env:
ANSIBLE_HOST_KEY_CHECKING: "false" ANSIBLE_HOST_KEY_CHECKING: "false"
ANSIBLE_DEPRECATION_WARNINGS: "false" ANSIBLE_DEPRECATION_WARNINGS: "false"
run: | run: |
/opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml --private-key ~/.ssh/le_runner ../../../site.yml /opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml --private-key ~/.ssh/le_runner ../../../site.yml
# Remove test system - User secrets to keep if necessary # Remove test system - User secrets to keep if necessary
- name: Tofu Destroy - name: Tofu Destroy
if: always() && env.ENABLE_DEBUG == 'false' if: always() && env.ENABLE_DEBUG == 'false'
env: env:
OSVAR: ${{ vars.OSVAR }} OSVAR: ${{ vars.OSVAR }}
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }} TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }} TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve -input=false run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve -input=false