forked from ansible-lockdown/RHEL9-CIS
Lint for galaxy
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell
parent
49d71ffc80
commit
6fdb18aece
11 changed files with 201 additions and 201 deletions
170
.github/workflows/linux_benchmark_testing.yml
vendored
170
.github/workflows/linux_benchmark_testing.yml
vendored
|
|
@ -6,106 +6,106 @@ name: linux_benchmark_pipeline
|
||||||
# Triggers the workflow on push or pull request
|
# Triggers the workflow on push or pull request
|
||||||
# events but only for the devel branch
|
# events but only for the devel branch
|
||||||
on:
|
on:
|
||||||
pull_request_target:
|
pull_request_target:
|
||||||
types: [opened, reopened, synchronize]
|
types: [opened, reopened, synchronize]
|
||||||
branches:
|
branches:
|
||||||
- devel
|
- devel
|
||||||
- main
|
- main
|
||||||
paths:
|
paths:
|
||||||
- '**.yml'
|
- '**.yml'
|
||||||
- '**.sh'
|
- '**.sh'
|
||||||
- '**.j2'
|
- '**.j2'
|
||||||
- '**.ps1'
|
- '**.ps1'
|
||||||
- '**.cfg'
|
- '**.cfg'
|
||||||
|
|
||||||
# A workflow run is made up of one or more jobs
|
# A workflow run is made up of one or more jobs
|
||||||
# that can run sequentially or in parallel
|
# that can run sequentially or in parallel
|
||||||
jobs:
|
jobs:
|
||||||
# This will create messages for first time contributers and direct them to the Discord server
|
# This will create messages for first time contributers and direct them to the Discord server
|
||||||
welcome:
|
welcome:
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
|
|
||||||
steps:
|
steps:
|
||||||
- uses: actions/first-interaction@main
|
- uses: actions/first-interaction@main
|
||||||
with:
|
with:
|
||||||
repo-token: ${{ secrets.GITHUB_TOKEN }}
|
repo-token: ${{ secrets.GITHUB_TOKEN }}
|
||||||
pr-message: |-
|
pr-message: |-
|
||||||
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
|
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
|
||||||
Please join in the conversation happening on the [Discord Server](https://discord.io/ansible-lockdown) as well.
|
Please join in the conversation happening on the [Discord Server](https://discord.io/ansible-lockdown) as well.
|
||||||
# This workflow contains a single job called "build"
|
# This workflow contains a single job called "build"
|
||||||
build:
|
build:
|
||||||
# The type of runner that the job will run on
|
# The type of runner that the job will run on
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
|
|
||||||
env:
|
|
||||||
ENABLE_DEBUG: false
|
|
||||||
|
|
||||||
# Steps represent a sequence of tasks that will be executed as part of the job
|
|
||||||
steps:
|
|
||||||
# Checks-out your repository under $GITHUB_WORKSPACE,
|
|
||||||
# so your job can access it
|
|
||||||
- uses: actions/checkout@v3
|
|
||||||
with:
|
|
||||||
ref: ${{ github.event.pull_request.head.sha }}
|
|
||||||
|
|
||||||
- name: Add_ssh_key
|
|
||||||
working-directory: .github/workflows
|
|
||||||
env:
|
env:
|
||||||
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
|
ENABLE_DEBUG: false
|
||||||
PRIVATE_KEY: "${{ secrets.SSH_PRV_KEY }}"
|
|
||||||
run: |
|
# Steps represent a sequence of tasks that will be executed as part of the job
|
||||||
mkdir .ssh
|
steps:
|
||||||
chmod 700 .ssh
|
# Checks-out your repository under $GITHUB_WORKSPACE,
|
||||||
echo $PRIVATE_KEY > .ssh/github_actions.pem
|
# so your job can access it
|
||||||
chmod 600 .ssh/github_actions.pem
|
- uses: actions/checkout@v3
|
||||||
|
with:
|
||||||
|
ref: ${{ github.event.pull_request.head.sha }}
|
||||||
|
|
||||||
|
- name: Add_ssh_key
|
||||||
|
working-directory: .github/workflows
|
||||||
|
env:
|
||||||
|
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
|
||||||
|
PRIVATE_KEY: "${{ secrets.SSH_PRV_KEY }}"
|
||||||
|
run: |
|
||||||
|
mkdir .ssh
|
||||||
|
chmod 700 .ssh
|
||||||
|
echo $PRIVATE_KEY > .ssh/github_actions.pem
|
||||||
|
chmod 600 .ssh/github_actions.pem
|
||||||
|
|
||||||
### Build out the server
|
### Build out the server
|
||||||
- name: Terraform_Init
|
- name: Terraform_Init
|
||||||
working-directory: .github/workflows
|
working-directory: .github/workflows
|
||||||
run: terraform init
|
run: terraform init
|
||||||
|
|
||||||
- name: Terraform_Validate
|
- name: Terraform_Validate
|
||||||
working-directory: .github/workflows
|
working-directory: .github/workflows
|
||||||
run: terraform validate
|
run: terraform validate
|
||||||
|
|
||||||
- name: Terraform_Apply
|
- name: Terraform_Apply
|
||||||
working-directory: .github/workflows
|
working-directory: .github/workflows
|
||||||
env:
|
env:
|
||||||
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
||||||
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
||||||
run: terraform apply -var-file "github_vars.tfvars" -var-file "OS.tfvars" --auto-approve -input=false
|
run: terraform apply -var-file "github_vars.tfvars" -var-file "OS.tfvars" --auto-approve -input=false
|
||||||
|
|
||||||
## Debug Section
|
## Debug Section
|
||||||
- name: DEBUG - Show Ansible hostfile
|
- name: DEBUG - Show Ansible hostfile
|
||||||
if: env.ENABLE_DEBUG == 'true'
|
if: env.ENABLE_DEBUG == 'true'
|
||||||
working-directory: .github/workflows
|
working-directory: .github/workflows
|
||||||
run: cat hosts.yml
|
run: cat hosts.yml
|
||||||
|
|
||||||
# Aws deployments taking a while to come up insert sleep or playbook fails
|
# Aws deployments taking a while to come up insert sleep or playbook fails
|
||||||
|
|
||||||
- name: Sleep for 60 seconds
|
- name: Sleep for 60 seconds
|
||||||
run: sleep 60s
|
run: sleep 60s
|
||||||
shell: bash
|
shell: bash
|
||||||
|
|
||||||
# Run the ansible playbook
|
# Run the ansible playbook
|
||||||
- name: Run_Ansible_Playbook
|
- name: Run_Ansible_Playbook
|
||||||
uses: arillso/action.playbook@master
|
uses: arillso/action.playbook@master
|
||||||
with:
|
with:
|
||||||
playbook: site.yml
|
playbook: site.yml
|
||||||
inventory: .github/workflows/hosts.yml
|
inventory: .github/workflows/hosts.yml
|
||||||
galaxy_file: collections/requirements.yml
|
galaxy_file: collections/requirements.yml
|
||||||
private_key: ${{ secrets.SSH_PRV_KEY }}
|
private_key: ${{ secrets.SSH_PRV_KEY }}
|
||||||
# verbose: 3
|
# verbose: 3
|
||||||
env:
|
env:
|
||||||
ANSIBLE_HOST_KEY_CHECKING: "false"
|
ANSIBLE_HOST_KEY_CHECKING: "false"
|
||||||
ANSIBLE_DEPRECATION_WARNINGS: "false"
|
ANSIBLE_DEPRECATION_WARNINGS: "false"
|
||||||
|
|
||||||
# Remove test system - User secrets to keep if necessary
|
# Remove test system - User secrets to keep if necessary
|
||||||
|
|
||||||
- name: Terraform_Destroy
|
- name: Terraform_Destroy
|
||||||
working-directory: .github/workflows
|
working-directory: .github/workflows
|
||||||
if: always() && env.ENABLE_DEBUG == 'false'
|
if: always() && env.ENABLE_DEBUG == 'false'
|
||||||
env:
|
env:
|
||||||
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
||||||
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
||||||
run: terraform destroy -var-file "github_vars.tfvars" -var-file "OS.tfvars" --auto-approve -input=false
|
run: terraform destroy -var-file "github_vars.tfvars" -var-file "OS.tfvars" --auto-approve -input=false
|
||||||
|
|
|
||||||
20
.github/workflows/update_galaxy.yml
vendored
20
.github/workflows/update_galaxy.yml
vendored
|
|
@ -7,15 +7,15 @@ name: update galaxy
|
||||||
# Controls when the action will run.
|
# Controls when the action will run.
|
||||||
# Triggers the workflow on merge request events to the main branch
|
# Triggers the workflow on merge request events to the main branch
|
||||||
on:
|
on:
|
||||||
push:
|
push:
|
||||||
branches:
|
branches:
|
||||||
- main
|
- main
|
||||||
jobs:
|
jobs:
|
||||||
update_role:
|
update_role:
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
steps:
|
steps:
|
||||||
- uses: actions/checkout@v3
|
- uses: actions/checkout@v3
|
||||||
- uses: robertdebock/galaxy-action@master
|
- uses: robertdebock/galaxy-action@master
|
||||||
with:
|
with:
|
||||||
galaxy_api_key: ${{ secrets.GALAXY_API_KEY }}
|
galaxy_api_key: ${{ secrets.GALAXY_API_KEY }}
|
||||||
git_branch: main
|
git_branch: main
|
||||||
|
|
|
||||||
|
|
@ -5,23 +5,23 @@
|
||||||
gather_facts: true
|
gather_facts: true
|
||||||
|
|
||||||
vars:
|
vars:
|
||||||
role_name: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }}"
|
role_name: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }}"
|
||||||
ansible_user: root
|
ansible_user: root
|
||||||
system_is_container: true
|
system_is_container: true
|
||||||
rhel9cis_selinux_disable: true
|
rhel9cis_selinux_disable: true
|
||||||
rhel9cis_rule_5_3_4: false
|
rhel9cis_rule_5_3_4: false
|
||||||
rhel9cis_rule_1_1_10: false
|
rhel9cis_rule_1_1_10: false
|
||||||
rhel9cis_firewall: "none"
|
rhel9cis_firewall: "none"
|
||||||
rhel9cis_rule_4_1_1_1: false
|
rhel9cis_rule_4_1_1_1: false
|
||||||
rhel9cis_rule_4_1_1_2: false
|
rhel9cis_rule_4_1_1_2: false
|
||||||
rhel9cis_rule_4_1_1_3: false
|
rhel9cis_rule_4_1_1_3: false
|
||||||
rhel9cis_rule_4_1_1_4: false
|
rhel9cis_rule_4_1_1_4: false
|
||||||
rhel9cis_rule_4_2_1_2: false
|
rhel9cis_rule_4_2_1_2: false
|
||||||
rhel9cis_rule_4_2_1_4: false
|
rhel9cis_rule_4_2_1_4: false
|
||||||
rhel9cis_rule_5_1_1: false
|
rhel9cis_rule_5_1_1: false
|
||||||
|
|
||||||
pre_tasks:
|
pre_tasks:
|
||||||
tasks:
|
tasks:
|
||||||
- name: "Include tasks"
|
- name: "Include tasks"
|
||||||
ansible.builtin.include_role:
|
ansible.builtin.include_role:
|
||||||
name: "{{ role_name }}"
|
name: "{{ role_name }}"
|
||||||
|
|
|
||||||
|
|
@ -3,31 +3,31 @@
|
||||||
# https://molecule.readthedocs.io/en/latest/
|
# https://molecule.readthedocs.io/en/latest/
|
||||||
|
|
||||||
driver:
|
driver:
|
||||||
name: docker
|
name: docker
|
||||||
|
|
||||||
platforms:
|
platforms:
|
||||||
- name: ubi9
|
- name: ubi9
|
||||||
image: registry.access.redhat.com/ubi9/ubi-init
|
image: registry.access.redhat.com/ubi9/ubi-init
|
||||||
pre_build_image: true
|
pre_build_image: true
|
||||||
volumes:
|
volumes:
|
||||||
- /sys/fs/cgroup:/sys/fs/cgroup:ro
|
- /sys/fs/cgroup:/sys/fs/cgroup:ro
|
||||||
privileged: true
|
privileged: true
|
||||||
command: "/usr/sbin/init"
|
command: "/usr/sbin/init"
|
||||||
capabilities:
|
capabilities:
|
||||||
- SYS_ADMIN
|
- SYS_ADMIN
|
||||||
|
|
||||||
provisioner:
|
provisioner:
|
||||||
name: ansible
|
name: ansible
|
||||||
config_options:
|
config_options:
|
||||||
defaults:
|
defaults:
|
||||||
interpreter_python: auto_silent
|
interpreter_python: auto_silent
|
||||||
callbacks_enabled: profile_tasks, timer
|
callbacks_enabled: profile_tasks, timer
|
||||||
|
|
||||||
lint: |
|
lint: |
|
||||||
set -e
|
set -e
|
||||||
yamllint .
|
yamllint .
|
||||||
ansible-lint
|
ansible-lint
|
||||||
flake8
|
flake8
|
||||||
|
|
||||||
verifier:
|
verifier:
|
||||||
name: ansible
|
name: ansible
|
||||||
|
|
|
||||||
|
|
@ -4,10 +4,10 @@
|
||||||
gather_facts: false
|
gather_facts: false
|
||||||
|
|
||||||
vars:
|
vars:
|
||||||
role_name: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }}"
|
role_name: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }}"
|
||||||
|
|
||||||
tasks:
|
tasks:
|
||||||
- name: "Include verify tasks"
|
- name: "Include verify tasks"
|
||||||
ansible.builtin.include_role:
|
ansible.builtin.include_role:
|
||||||
name: "{{ role_name }}"
|
name: "{{ role_name }}"
|
||||||
tasks_from: verify
|
tasks_from: verify
|
||||||
|
|
|
||||||
|
|
@ -6,12 +6,12 @@
|
||||||
gather_facts: true
|
gather_facts: true
|
||||||
|
|
||||||
vars:
|
vars:
|
||||||
ansible_user: "{{ lookup('env', 'USER') }}"
|
ansible_user: "{{ lookup('env', 'USER') }}"
|
||||||
role_name: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }}"
|
role_name: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }}"
|
||||||
rhel9cis_rule_5_3_4: false
|
rhel9cis_rule_5_3_4: false
|
||||||
|
|
||||||
pre_tasks:
|
pre_tasks:
|
||||||
tasks:
|
tasks:
|
||||||
- name: "Include tasks"
|
- name: "Include tasks"
|
||||||
ansible.builtin.include_role:
|
ansible.builtin.include_role:
|
||||||
name: "{{ role_name }}"
|
name: "{{ role_name }}"
|
||||||
|
|
|
||||||
|
|
@ -3,27 +3,27 @@
|
||||||
# https://molecule.readthedocs.io/en/latest/
|
# https://molecule.readthedocs.io/en/latest/
|
||||||
|
|
||||||
driver:
|
driver:
|
||||||
name: delegated
|
name: delegated
|
||||||
options:
|
options:
|
||||||
managed: false
|
managed: false
|
||||||
ansible_connection_options:
|
ansible_connection_options:
|
||||||
ansible_connection: local
|
ansible_connection: local
|
||||||
platforms:
|
platforms:
|
||||||
- name: localhost
|
- name: localhost
|
||||||
|
|
||||||
provisioner:
|
provisioner:
|
||||||
name: ansible
|
name: ansible
|
||||||
config_options:
|
config_options:
|
||||||
defaults:
|
defaults:
|
||||||
interpreter_python: auto_silent
|
interpreter_python: auto_silent
|
||||||
stdout_callback: yaml
|
stdout_callback: yaml
|
||||||
callbacks_enabled: profile_tasks, timer
|
callbacks_enabled: profile_tasks, timer
|
||||||
|
|
||||||
lint: |
|
lint: |
|
||||||
set -e
|
set -e
|
||||||
yamllint .
|
yamllint .
|
||||||
ansible-lint
|
ansible-lint
|
||||||
flake8
|
flake8
|
||||||
|
|
||||||
verifier:
|
verifier:
|
||||||
name: ansible
|
name: ansible
|
||||||
|
|
|
||||||
|
|
@ -5,10 +5,10 @@
|
||||||
become: true
|
become: true
|
||||||
|
|
||||||
vars:
|
vars:
|
||||||
role_name: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }}"
|
role_name: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }}"
|
||||||
|
|
||||||
tasks:
|
tasks:
|
||||||
- name: "Include verify tasks"
|
- name: "Include verify tasks"
|
||||||
ansible.builtin.include_role:
|
ansible.builtin.include_role:
|
||||||
name: "{{ role_name }}"
|
name: "{{ role_name }}"
|
||||||
tasks_from: verify
|
tasks_from: verify
|
||||||
|
|
|
||||||
|
|
@ -6,21 +6,21 @@
|
||||||
gather_facts: true
|
gather_facts: true
|
||||||
|
|
||||||
vars:
|
vars:
|
||||||
ansible_user: "{{ lookup('env', 'USER') }}"
|
ansible_user: "{{ lookup('env', 'USER') }}"
|
||||||
system_is_container: true
|
system_is_container: true
|
||||||
rhel8cis_selinux_disable: true
|
rhel8cis_selinux_disable: true
|
||||||
role_name: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }}"
|
role_name: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }}"
|
||||||
rhel8cis_rule_5_3_4: false
|
rhel8cis_rule_5_3_4: false
|
||||||
rhel8cis_rule_1_1_10: false
|
rhel8cis_rule_1_1_10: false
|
||||||
rhel8cis_rsyslog_ansiblemanaged: false
|
rhel8cis_rsyslog_ansiblemanaged: false
|
||||||
rhel8cis_rule_3_4_1_3: false
|
rhel8cis_rule_3_4_1_3: false
|
||||||
rhel8cis_rule_3_4_1_4: false
|
rhel8cis_rule_3_4_1_4: false
|
||||||
rhel8cis_rule_4_2_1_2: false
|
rhel8cis_rule_4_2_1_2: false
|
||||||
rhel8cis_rule_4_2_1_4: false
|
rhel8cis_rule_4_2_1_4: false
|
||||||
rhel8cis_rule_5_1_1: false
|
rhel8cis_rule_5_1_1: false
|
||||||
|
|
||||||
pre_tasks:
|
pre_tasks:
|
||||||
tasks:
|
tasks:
|
||||||
- name: "Include tasks"
|
- name: "Include tasks"
|
||||||
ansible.builtin.include_role:
|
ansible.builtin.include_role:
|
||||||
name: "{{ role_name }}"
|
name: "{{ role_name }}"
|
||||||
|
|
|
||||||
|
|
@ -3,26 +3,26 @@
|
||||||
# https://molecule.readthedocs.io/en/latest/
|
# https://molecule.readthedocs.io/en/latest/
|
||||||
|
|
||||||
driver:
|
driver:
|
||||||
name: delegated
|
name: delegated
|
||||||
options:
|
options:
|
||||||
managed: false
|
managed: false
|
||||||
ansible_connection_options:
|
ansible_connection_options:
|
||||||
ansible_connection: local
|
ansible_connection: local
|
||||||
platforms:
|
platforms:
|
||||||
- name: localhost
|
- name: localhost
|
||||||
|
|
||||||
provisioner:
|
provisioner:
|
||||||
name: ansible
|
name: ansible
|
||||||
config_options:
|
config_options:
|
||||||
defaults:
|
defaults:
|
||||||
interpreter_python: auto_silent
|
interpreter_python: auto_silent
|
||||||
callbacks_enabled: profile_tasks, timer
|
callbacks_enabled: profile_tasks, timer
|
||||||
|
|
||||||
lint: |
|
lint: |
|
||||||
set -e
|
set -e
|
||||||
yamllint .
|
yamllint .
|
||||||
ansible-lint
|
ansible-lint
|
||||||
flake8
|
flake8
|
||||||
|
|
||||||
verifier:
|
verifier:
|
||||||
name: ansible
|
name: ansible
|
||||||
|
|
|
||||||
|
|
@ -4,10 +4,10 @@
|
||||||
gather_facts: false
|
gather_facts: false
|
||||||
|
|
||||||
vars:
|
vars:
|
||||||
role_name: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }}"
|
role_name: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }}"
|
||||||
|
|
||||||
tasks:
|
tasks:
|
||||||
- name: "Include verify tasks"
|
- name: "Include verify tasks"
|
||||||
ansible.builtin.include_role:
|
ansible.builtin.include_role:
|
||||||
name: "{{ role_name }}"
|
name: "{{ role_name }}"
|
||||||
tasks_from: verify
|
tasks_from: verify
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue