-
Notifications
You must be signed in to change notification settings - Fork 5
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
⚠️ CONFLICT! Lineage pull request for: skeleton #838
Conversation
Add a `workflow_dispatch` trigger so we can manually run the workflow if needed.
This Action will provide information about the usage of GITHUB_TOKEN in the workflow. It should be added to _every_ job in _any_ workflow to provide information for analysis.
This changes the default permissions for the GITHUB_TOKEN used in our GitHub Actions configuration to the minimum required to successfully run.
This is done automatically with the `pre-commit autoupdate` command.
Ensure that all hook ids are sorted alphabetically in each hook entry in our pre-commit configuration.
…bels_workflow Allow the `sync-labels` workflow to be run manually
…ons-monitor Add the `GitHubSecurityLab/actions-permissions/monitor` Action
Explicitly define permissions of `GITHUB_TOKEN` in our GitHub Actions workflows
Update `pre-commit` hook versions
…hooks Add additional hooks from `pre-commit/pre-commit-hooks`
…oks_are_sorted Sort hook ids in each `pre-commit` hook entry
Add a directive for hashicorp/setup-packer that was missed when it was added to the `build` workflow. Add a directive for cisagov/setup-env-github-action that is not strictly necessary since we currently just pull from the `develop` branch, but is good to have in case we were to change that in the future.
Add missing dependabot ignore directives
Add the GitHubSecurityLab/actions-permissions/monitor Action just as it is in the `build` and `sync-labels` workflows.
This is being done because the pip-audit pre-commit hook identifies a vulnerability in ansible-core version 2.16.13. Note that this requires that we bump up ansible to version 10 since all versions of ansible 9 have a dependency on ~=2.16.X. Co-authored-by: Nick M <[email protected]> Co-authored-by: Jeremy Frasier <[email protected]>
This is being done only temporarily, and only because there is no recent version of ansible-core that does not exhibit the vulnerability. Without this change we get a failure from the pip-audit pre-commit hook that we cannot do anything about. Co-authored-by: Jeremy Frasier <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If we want to keep this repo in sync with the recent changes in cisagov/skeleton-tf-module then I think:
terraform
should be bumped to version 1.1 inversions.tf
. This would require an update to theREADME.md
file as well.- All Terraform variables should include
nullable = false
(ornullable = true
, if appropriate)
See, e.g., cisagov/cool-userservices-dns#35.
@mcdonnnj Do you have any concerns or issues with me making the changes that @jsf9k mentioned above? |
Also @dav3r. Those changes are fine, but I think they should be made separate to this PR. |
@jsf9k I just chatted with @mcdonnnj about this and I agree with him. Since that |
See #843. |
This adds even more evidence for why it is a good idea to go ahead and upgrade ansible and ansible-core, in addition to the vulnerability that pip-audit turned up. Co-authored-by: Nick M <[email protected]>
…n-for-ansible-core Bump up the lower bound on `ansible-core`
…-pre-commit-hook-version Update the version of the `ansible-lint` `pre-commit` hook
# Conflicts: # .pre-commit-config.yaml
Lineage Pull Request: CONFLICT
Lineage has created this pull request to incorporate new changes found in an
upstream repository:
Upstream repository:
https://github.com/cisagov/skeleton-generic.git
Remote branch:
HEAD
Check the changes in this pull request to ensure they won't cause issues with
your project.
The
lineage/skeleton
branch has one or more unresolved merge conflictsthat you must resolve before merging this pull request!
How to resolve the conflicts
Take ownership of this pull request by removing any other assignees.
Clone the repository locally, and reapply the merge:
Review the changes displayed by the
status
command. Fix any conflicts andpossibly incorrect auto-merges.
After resolving each of the conflicts,
add
your changes to thebranch,
commit
, andpush
your changes:Note that you may append to the default merge commit message
that git creates for you, but please do not delete the existing
content. It provides useful information about the merge that is
being performed.
Wait for all the automated tests to pass.
Confirm each item in the "Pre-approval checklist" below.
Remove any of the checklist items that do not apply.
Ensure every remaining checkbox has been checked.
Mark this draft pull request "Ready for review".
✅ Pre-approval checklist
Remove any of the following that do not apply. If you're unsure about
any of these, don't hesitate to ask. We're here to help!
in code comments.
to reflect the changes in this PR.
Note
You are seeing this because one of this repository's maintainers has
configured Lineage to open pull requests.
For more information:
🛠 Lineage configurations for this project are stored in
.github/lineage.yml
📚 Read more about Lineage