From 33582a11f73d4e5c3dc588a040e59941c381d09a Mon Sep 17 00:00:00 2001
From: Michael Saki <michael.saki@associates.cisa.dhs.gov>
Date: Wed, 14 Feb 2024 12:59:30 -0600
Subject: [PATCH 01/52] Add checks for semantic python versions

---
 setup-env | 39 +++++++++++++++++++++------------------
 1 file changed, 21 insertions(+), 18 deletions(-)

diff --git a/setup-env b/setup-env
index 05b010b6..44368b3d 100755
--- a/setup-env
+++ b/setup-env
@@ -39,6 +39,14 @@ python_versions() {
   pyenv versions --bare --skip-aliases --skip-envs
 }
 
+check_semantic_version() {
+  local version=$1
+  local regex="^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?\$"
+
+  # Use Perl for regex matching and output true or false
+  echo "$version" | perl -ne "exit(!/$regex/)"
+}
+
 # Flag to force deletion and creation of virtual environment
 FORCE=0
 
@@ -103,16 +111,18 @@ while true; do
     -p | --python-version)
       PYTHON_VERSION="$2"
       shift 2
-      # Check the Python versions being passed in.
-      if [ -n "${PYTHON_VERSION+x}" ]; then
-        if python_versions | grep -E "^${PYTHON_VERSION}$" > /dev/null; then
-          echo Using Python version "$PYTHON_VERSION"
-        else
-          echo Error: Python version "$PYTHON_VERSION" is not installed.
-          echo Installed Python versions are:
-          python_versions
-          exit 1
-        fi
+      # Validate the semantic version format
+      if ! check_semantic_version "$PYTHON_VERSION"; then
+        echo "Error: The specified Python version $PYTHON_VERSION does not follow the semantic versioning standard."
+        echo "Example of a valid version: 3.8.1, 3.8.1-alpha.1, or 3.8.1+20130313144700"
+        exit 1
+      elif ! python_versions | grep -E "^${PYTHON_VERSION}$" > /dev/null; then
+        echo "Error: Python version $PYTHON_VERSION is not installed."
+        echo "Installed Python versions are:"
+        python_versions
+        exit 1
+      else
+        echo "Using Python version $PYTHON_VERSION"
       fi
       ;;
     -v | --venv-name)
@@ -181,14 +191,7 @@ if [ $LIST_VERSIONS -ne 0 ]; then
   python_versions
   read -r -p "Enter the desired Python version: " PYTHON_VERSION
   # Check the Python versions being passed in.
-  if [ -n "${PYTHON_VERSION+x}" ]; then
-    if python_versions | grep -E "^${PYTHON_VERSION}$" > /dev/null; then
-      echo Using Python version "$PYTHON_VERSION"
-    else
-      echo Error: Python version "$PYTHON_VERSION" is not installed.
-      exit 1
-    fi
-  fi
+  check_semantic_version "$PYTHON_VERSION"
 fi
 
 # Remove any lingering local configuration.

From 94381940a9d28f87da2b85c5e1647a5a80d4a18d Mon Sep 17 00:00:00 2001
From: Michael Saki <michael.saki@associates.cisa.dhs.gov>
Date: Wed, 14 Feb 2024 14:29:13 -0600
Subject: [PATCH 02/52] Refactor code for the semantic check

This commit will make a few changes. The
orginal version of the semantic checking
function was a bit more difficult to read.
It is now somewhat easier to follow how
the regex is structured. Also the function
has been renamed to check_python_version
since it has 2 functions, making sure that
the version is semantically correct and the
second is to make sure that it is installed
on the user's machine. This makes it easier
to follow the logic for the flags, -p or
--python-version and -l or --list-versions
---
 setup-env | 54 ++++++++++++++++++++++++++++++++++++------------------
 1 file changed, 36 insertions(+), 18 deletions(-)

diff --git a/setup-env b/setup-env
index 44368b3d..11ec1703 100755
--- a/setup-env
+++ b/setup-env
@@ -39,12 +39,41 @@ python_versions() {
   pyenv versions --bare --skip-aliases --skip-envs
 }
 
-check_semantic_version() {
+check_python_version() {
   local version=$1
-  local regex="^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?\$"
 
-  # Use Perl for regex matching and output true or false
-  echo "$version" | perl -ne "exit(!/$regex/)"
+  # Break down the regex into readable parts major.minor.patch
+  local major="0|[1-9]\\d*"
+  local minor="0|[1-9]\\d*"
+  local patch="0|[1-9]\\d*"
+
+  # Splitting the prerelease part for readability
+  # Start of prerelease
+  local prerelease="(?:-"
+  # Numeric or alphanumeric identifiers
+  local prerelease+="(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)"
+  # Additional dot-separated identifiers
+  local prerelease+="(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*"
+  # End of prerelease, making it optional
+  local prerelease+=")?"
+  # Optional build metadata
+  local build="(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?"
+
+  # Final regex composed of parts
+  local regex="^($major)\\.($minor)\\.($patch)$prerelease$build\$"
+
+  if ! echo "$version" | perl -ne "exit(!/$regex/)"; then
+    echo "Error: The specified Python version $version does not follow the semantic versioning standard."
+    echo "Example of a valid version: 3.8.1, 3.8.1-alpha.1, or 3.8.1+20130313144700"
+    exit 1
+  elif ! python_versions | grep -E "^${version}$" > /dev/null; then
+    echo "Error: Python version $version is not installed."
+    echo "Installed Python versions are:"
+    python_versions
+    exit 1
+  else
+    echo "Using Python version $version"
+  fi
 }
 
 # Flag to force deletion and creation of virtual environment
@@ -111,19 +140,8 @@ while true; do
     -p | --python-version)
       PYTHON_VERSION="$2"
       shift 2
-      # Validate the semantic version format
-      if ! check_semantic_version "$PYTHON_VERSION"; then
-        echo "Error: The specified Python version $PYTHON_VERSION does not follow the semantic versioning standard."
-        echo "Example of a valid version: 3.8.1, 3.8.1-alpha.1, or 3.8.1+20130313144700"
-        exit 1
-      elif ! python_versions | grep -E "^${PYTHON_VERSION}$" > /dev/null; then
-        echo "Error: Python version $PYTHON_VERSION is not installed."
-        echo "Installed Python versions are:"
-        python_versions
-        exit 1
-      else
-        echo "Using Python version $PYTHON_VERSION"
-      fi
+      # Check the Python version being passed in.
+      check_python_version "$PYTHON_VERSION"
       ;;
     -v | --venv-name)
       VENV_NAME="$2"
@@ -191,7 +209,7 @@ if [ $LIST_VERSIONS -ne 0 ]; then
   python_versions
   read -r -p "Enter the desired Python version: " PYTHON_VERSION
   # Check the Python versions being passed in.
-  check_semantic_version "$PYTHON_VERSION"
+  check_python_version "$PYTHON_VERSION"
 fi
 
 # Remove any lingering local configuration.

From cea8edc5bcdcec8a06b6b810514b0222fc03f42e Mon Sep 17 00:00:00 2001
From: Michael Saki <michael.saki@associates.cisa.dhs.gov>
Date: Wed, 14 Feb 2024 12:59:30 -0600
Subject: [PATCH 03/52] Add checks for semantic python versions

---
 setup-env | 39 +++++++++++++++++++++------------------
 1 file changed, 21 insertions(+), 18 deletions(-)

diff --git a/setup-env b/setup-env
index 3a22d439..5e537bcc 100755
--- a/setup-env
+++ b/setup-env
@@ -39,6 +39,14 @@ python_versions() {
   pyenv versions --bare --skip-aliases --skip-envs
 }
 
+check_semantic_version() {
+  local version=$1
+  local regex="^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?\$"
+
+  # Use Perl for regex matching and output true or false
+  echo "$version" | perl -ne "exit(!/$regex/)"
+}
+
 # Flag to force deletion and creation of virtual environment
 FORCE=0
 
@@ -144,16 +152,18 @@ while true; do
     -p | --python-version)
       PYTHON_VERSION="$2"
       shift 2
-      # Check the Python versions being passed in.
-      if [ -n "${PYTHON_VERSION+x}" ]; then
-        if python_versions | grep -E "^${PYTHON_VERSION}$" > /dev/null; then
-          echo Using Python version "$PYTHON_VERSION"
-        else
-          echo Error: Python version "$PYTHON_VERSION" is not installed.
-          echo Installed Python versions are:
-          python_versions
-          exit 1
-        fi
+      # Validate the semantic version format
+      if ! check_semantic_version "$PYTHON_VERSION"; then
+        echo "Error: The specified Python version $PYTHON_VERSION does not follow the semantic versioning standard."
+        echo "Example of a valid version: 3.8.1, 3.8.1-alpha.1, or 3.8.1+20130313144700"
+        exit 1
+      elif ! python_versions | grep -E "^${PYTHON_VERSION}$" > /dev/null; then
+        echo "Error: Python version $PYTHON_VERSION is not installed."
+        echo "Installed Python versions are:"
+        python_versions
+        exit 1
+      else
+        echo "Using Python version $PYTHON_VERSION"
       fi
       ;;
     -v | --venv-name)
@@ -189,14 +199,7 @@ if [ $LIST_VERSIONS -ne 0 ]; then
   # -r: treat backslashes as literal, -p: display prompt before input.
   read -r -p "Enter the desired Python version: " PYTHON_VERSION
   # Check the Python versions being passed in.
-  if [ -n "${PYTHON_VERSION+x}" ]; then
-    if python_versions | grep -E "^${PYTHON_VERSION}$" > /dev/null; then
-      echo Using Python version "$PYTHON_VERSION"
-    else
-      echo Error: Python version "$PYTHON_VERSION" is not installed.
-      exit 1
-    fi
-  fi
+  check_semantic_version "$PYTHON_VERSION"
 fi
 
 # Remove any lingering local configuration.

From d5c7c4a566f88f7575f06ff2e0829f257a00cb08 Mon Sep 17 00:00:00 2001
From: Michael Saki <michael.saki@associates.cisa.dhs.gov>
Date: Wed, 14 Feb 2024 14:29:13 -0600
Subject: [PATCH 04/52] Refactor code for the semantic check

This commit will make a few changes. The
orginal version of the semantic checking
function was a bit more difficult to read.
It is now somewhat easier to follow how
the regex is structured. Also the function
has been renamed to check_python_version
since it has 2 functions, making sure that
the version is semantically correct and the
second is to make sure that it is installed
on the user's machine. This makes it easier
to follow the logic for the flags, -p or
--python-version and -l or --list-versions
---
 setup-env | 54 ++++++++++++++++++++++++++++++++++++------------------
 1 file changed, 36 insertions(+), 18 deletions(-)

diff --git a/setup-env b/setup-env
index 5e537bcc..92540d1c 100755
--- a/setup-env
+++ b/setup-env
@@ -39,12 +39,41 @@ python_versions() {
   pyenv versions --bare --skip-aliases --skip-envs
 }
 
-check_semantic_version() {
+check_python_version() {
   local version=$1
-  local regex="^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?\$"
 
-  # Use Perl for regex matching and output true or false
-  echo "$version" | perl -ne "exit(!/$regex/)"
+  # Break down the regex into readable parts major.minor.patch
+  local major="0|[1-9]\\d*"
+  local minor="0|[1-9]\\d*"
+  local patch="0|[1-9]\\d*"
+
+  # Splitting the prerelease part for readability
+  # Start of prerelease
+  local prerelease="(?:-"
+  # Numeric or alphanumeric identifiers
+  local prerelease+="(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)"
+  # Additional dot-separated identifiers
+  local prerelease+="(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*"
+  # End of prerelease, making it optional
+  local prerelease+=")?"
+  # Optional build metadata
+  local build="(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?"
+
+  # Final regex composed of parts
+  local regex="^($major)\\.($minor)\\.($patch)$prerelease$build\$"
+
+  if ! echo "$version" | perl -ne "exit(!/$regex/)"; then
+    echo "Error: The specified Python version $version does not follow the semantic versioning standard."
+    echo "Example of a valid version: 3.8.1, 3.8.1-alpha.1, or 3.8.1+20130313144700"
+    exit 1
+  elif ! python_versions | grep -E "^${version}$" > /dev/null; then
+    echo "Error: Python version $version is not installed."
+    echo "Installed Python versions are:"
+    python_versions
+    exit 1
+  else
+    echo "Using Python version $version"
+  fi
 }
 
 # Flag to force deletion and creation of virtual environment
@@ -152,19 +181,8 @@ while true; do
     -p | --python-version)
       PYTHON_VERSION="$2"
       shift 2
-      # Validate the semantic version format
-      if ! check_semantic_version "$PYTHON_VERSION"; then
-        echo "Error: The specified Python version $PYTHON_VERSION does not follow the semantic versioning standard."
-        echo "Example of a valid version: 3.8.1, 3.8.1-alpha.1, or 3.8.1+20130313144700"
-        exit 1
-      elif ! python_versions | grep -E "^${PYTHON_VERSION}$" > /dev/null; then
-        echo "Error: Python version $PYTHON_VERSION is not installed."
-        echo "Installed Python versions are:"
-        python_versions
-        exit 1
-      else
-        echo "Using Python version $PYTHON_VERSION"
-      fi
+      # Check the Python version being passed in.
+      check_python_version "$PYTHON_VERSION"
       ;;
     -v | --venv-name)
       VENV_NAME="$2"
@@ -199,7 +217,7 @@ if [ $LIST_VERSIONS -ne 0 ]; then
   # -r: treat backslashes as literal, -p: display prompt before input.
   read -r -p "Enter the desired Python version: " PYTHON_VERSION
   # Check the Python versions being passed in.
-  check_semantic_version "$PYTHON_VERSION"
+  check_python_version "$PYTHON_VERSION"
 fi
 
 # Remove any lingering local configuration.

From 327ab733aeaaad6a4916eb86b20d86618c9351e3 Mon Sep 17 00:00:00 2001
From: Michael Saki <michael.saki@associates.cisa.dhs.gov>
Date: Mon, 18 Mar 2024 12:36:02 -0500
Subject: [PATCH 05/52] Remove example of correct semantic version

---
 setup-env | 1 -
 1 file changed, 1 deletion(-)

diff --git a/setup-env b/setup-env
index 92540d1c..bacd2d59 100755
--- a/setup-env
+++ b/setup-env
@@ -64,7 +64,6 @@ check_python_version() {
 
   if ! echo "$version" | perl -ne "exit(!/$regex/)"; then
     echo "Error: The specified Python version $version does not follow the semantic versioning standard."
-    echo "Example of a valid version: 3.8.1, 3.8.1-alpha.1, or 3.8.1+20130313144700"
     exit 1
   elif ! python_versions | grep -E "^${version}$" > /dev/null; then
     echo "Error: Python version $version is not installed."

From 4dedf50886fd47c67895deb07367fca5c36ca33f Mon Sep 17 00:00:00 2001
From: Michael Saki <michael.saki@associates.cisa.dhs.gov>
Date: Wed, 20 Mar 2024 12:58:03 -0500
Subject: [PATCH 06/52] Refactor the error message for the user

---
 setup-env | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/setup-env b/setup-env
index bacd2d59..d7824cbb 100755
--- a/setup-env
+++ b/setup-env
@@ -63,7 +63,9 @@ check_python_version() {
   local regex="^($major)\\.($minor)\\.($patch)$prerelease$build\$"
 
   if ! echo "$version" | perl -ne "exit(!/$regex/)"; then
-    echo "Error: The specified Python version $version does not follow the semantic versioning standard."
+    echo "Invalid version of Python: Python follows semantic versioning, " \
+      "so any version string that is not a valid semantic version is an " \
+      "invalid version of Python."
     exit 1
   elif ! python_versions | grep -E "^${version}$" > /dev/null; then
     echo "Error: Python version $version is not installed."

From e84deea5181f27471f01343113c91dc2b13e159e Mon Sep 17 00:00:00 2001
From: Michael Saki <michael.saki@associates.cisa.dhs.gov>
Date: Wed, 20 Mar 2024 14:52:16 -0500
Subject: [PATCH 07/52] Improve the semantic error message

---
 setup-env | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/setup-env b/setup-env
index d7824cbb..bba5f9e4 100755
--- a/setup-env
+++ b/setup-env
@@ -63,8 +63,8 @@ check_python_version() {
   local regex="^($major)\\.($minor)\\.($patch)$prerelease$build\$"
 
   if ! echo "$version" | perl -ne "exit(!/$regex/)"; then
-    echo "Invalid version of Python: Python follows semantic versioning, " \
-      "so any version string that is not a valid semantic version is an " \
+    echo "Invalid version of Python: Python follows semantic versioning," \
+      "so any version string that is not a valid semantic version is an" \
       "invalid version of Python."
     exit 1
   elif ! python_versions | grep -E "^${version}$" > /dev/null; then

From 5fdc7befc1d1d4811c4550ca1e4c65a711971c21 Mon Sep 17 00:00:00 2001
From: Michael Saki <sakimichael@Yahoo.com>
Date: Wed, 20 Mar 2024 15:39:07 -0500
Subject: [PATCH 08/52] Fix grammar

Co-authored-by: dav3r <david.redmin@trio.dhs.gov>
---
 setup-env | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup-env b/setup-env
index bba5f9e4..b93810ce 100755
--- a/setup-env
+++ b/setup-env
@@ -217,7 +217,7 @@ if [ $LIST_VERSIONS -ne 0 ]; then
   # Read the user's desired Python version.
   # -r: treat backslashes as literal, -p: display prompt before input.
   read -r -p "Enter the desired Python version: " PYTHON_VERSION
-  # Check the Python versions being passed in.
+  # Check the Python version being passed in.
   check_python_version "$PYTHON_VERSION"
 fi
 

From 42ef8c2d7b54cde82d4390a0050622cddfccf92a Mon Sep 17 00:00:00 2001
From: Michael Saki <michael.saki@associates.cisa.dhs.gov>
Date: Thu, 21 Mar 2024 09:19:42 -0500
Subject: [PATCH 09/52] Refactor regex, add link, and improve comments

---
 setup-env | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/setup-env b/setup-env
index b93810ce..2f300211 100755
--- a/setup-env
+++ b/setup-env
@@ -42,31 +42,38 @@ python_versions() {
 check_python_version() {
   local version=$1
 
+  # This is a valid regex for semantically correct Python version strings.
+  # For more information see here: https://regex101.com/r/vkijKf/1/.
   # Break down the regex into readable parts major.minor.patch
-  local major="0|[1-9]\\d*"
-  local minor="0|[1-9]\\d*"
-  local patch="0|[1-9]\\d*"
+  local major="0|[1-9]\d*"
+  local minor="0|[1-9]\d*"
+  local patch="0|[1-9]\d*"
 
   # Splitting the prerelease part for readability
-  # Start of prerelease
+  # Start of the prerelease
   local prerelease="(?:-"
   # Numeric or alphanumeric identifiers
-  local prerelease+="(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)"
+  local prerelease+="(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)"
   # Additional dot-separated identifiers
-  local prerelease+="(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*"
-  # End of prerelease, making it optional
+  local prerelease+="(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*"
+  # End of the prerelease, making it optional
   local prerelease+=")?"
   # Optional build metadata
-  local build="(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?"
+  local build="(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?"
 
   # Final regex composed of parts
-  local regex="^($major)\\.($minor)\\.($patch)$prerelease$build\$"
+  local regex="^($major)\.($minor)\.($patch)$prerelease$build$"
 
+  # This checks if the Python version does not match the regex pattern specified in $regex,
+  # using Perl for regex matching. If the pattern is not found, then prompt the user with
+  # the invalid version message.
   if ! echo "$version" | perl -ne "exit(!/$regex/)"; then
     echo "Invalid version of Python: Python follows semantic versioning," \
       "so any version string that is not a valid semantic version is an" \
       "invalid version of Python."
     exit 1
+  # Else if the Python version isn't installed then notify the user.
+  # grep -E is used for searching through text lines that match the specific verison.
   elif ! python_versions | grep -E "^${version}$" > /dev/null; then
     echo "Error: Python version $version is not installed."
     echo "Installed Python versions are:"

From a77e5e1c9a8752a2072a6a974d4164be116069e9 Mon Sep 17 00:00:00 2001
From: Michael Saki <michael.saki@associates.cisa.dhs.gov>
Date: Thu, 21 Mar 2024 10:13:11 -0500
Subject: [PATCH 10/52] Update link to use semver.org over regex101.com

---
 setup-env | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/setup-env b/setup-env
index 2f300211..8d7b3477 100755
--- a/setup-env
+++ b/setup-env
@@ -43,7 +43,8 @@ check_python_version() {
   local version=$1
 
   # This is a valid regex for semantically correct Python version strings.
-  # For more information see here: https://regex101.com/r/vkijKf/1/.
+  # For more information see here:
+  # https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string.
   # Break down the regex into readable parts major.minor.patch
   local major="0|[1-9]\d*"
   local minor="0|[1-9]\d*"

From 5fe14c7c6066d30381f6746eb313a56e4d447ac5 Mon Sep 17 00:00:00 2001
From: Michael Saki <sakimichael@Yahoo.com>
Date: Thu, 21 Mar 2024 10:29:58 -0500
Subject: [PATCH 11/52] Remove unnecessary period

Co-authored-by: dav3r <david.redmin@trio.dhs.gov>
---
 setup-env | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup-env b/setup-env
index 8d7b3477..059ccad5 100755
--- a/setup-env
+++ b/setup-env
@@ -44,7 +44,7 @@ check_python_version() {
 
   # This is a valid regex for semantically correct Python version strings.
   # For more information see here:
-  # https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string.
+  # https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string
   # Break down the regex into readable parts major.minor.patch
   local major="0|[1-9]\d*"
   local minor="0|[1-9]\d*"

From b7896a0a2790cc121842c6ac1602734bbd5dd726 Mon Sep 17 00:00:00 2001
From: Nicholas McDonnell <50747025+mcdonnnj@users.noreply.github.com>
Date: Sat, 20 Apr 2024 04:11:57 -0400
Subject: [PATCH 12/52] Add a meta hook to the pre-commit configuration

Add the `check-useless-excludes` meta hook to verify that any defined
`exclude` directives apply to at least one file in the repository.
---
 .pre-commit-config.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 2c5b3c83..de8c5879 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -4,6 +4,11 @@ default_language_version:
   python: python3
 
 repos:
+  # Check the pre-commit configuration
+  - repo: meta
+    hooks:
+      - id: check-useless-excludes
+
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v4.5.0
     hooks:

From 260566f177520175530963c469e50d124e5bc0e4 Mon Sep 17 00:00:00 2001
From: Nicholas McDonnell <50747025+mcdonnnj@users.noreply.github.com>
Date: Sat, 20 Apr 2024 04:15:52 -0400
Subject: [PATCH 13/52] Remove `exclude` directive that does not apply to any
 files

---
 .pre-commit-config.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index de8c5879..5ec468e8 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -24,7 +24,6 @@ repos:
           - --allow-missing-credentials
       - id: detect-private-key
       - id: end-of-file-fixer
-        exclude: files/(issue|motd)
       - id: mixed-line-ending
         args:
           - --fix=lf

From a68994d17dcc11e9b90132c50fe52732d5fda07b Mon Sep 17 00:00:00 2001
From: Jeremy Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Mon, 1 Jul 2024 16:19:46 -0400
Subject: [PATCH 14/52] Add a lower-bound pin for flake8-docstrings

---
 .pre-commit-config.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 386c83ff..74c9c764 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -136,7 +136,7 @@ repos:
     hooks:
       - id: flake8
         additional_dependencies:
-          - flake8-docstrings
+          - flake8-docstrings>=1.7.0
   - repo: https://github.com/PyCQA/isort
     rev: 5.13.2
     hooks:

From 43b91c74754e912172c702e20f12ba9f767ac202 Mon Sep 17 00:00:00 2001
From: Nicholas McDonnell <50747025+mcdonnnj@users.noreply.github.com>
Date: Mon, 12 Aug 2024 06:24:06 -0400
Subject: [PATCH 15/52] Use the hashicorp/setup-packer GitHub Action

Instead of manually installing Packer we can instead leverage the
hashicorp/setup-packer Action just as we do for Terraform.
---
 .github/workflows/build.yml | 20 +++-----------------
 1 file changed, 3 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9bb221ad..e12b8427 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -20,7 +20,6 @@ defaults:
     shell: bash -Eueo pipefail -x {0}
 
 env:
-  CURL_CACHE_DIR: ~/.cache/curl
   PIP_CACHE_DIR: ~/.cache/pip
   PRE_COMMIT_CACHE_DIR: ~/.cache/pre-commit
   RUN_TMATE: ${{ secrets.RUN_TMATE }}
@@ -97,25 +96,12 @@ jobs:
           path: |
             ${{ env.PIP_CACHE_DIR }}
             ${{ env.PRE_COMMIT_CACHE_DIR }}
-            ${{ env.CURL_CACHE_DIR }}
             ${{ steps.go-cache.outputs.dir }}
           restore-keys: |
             ${{ env.BASE_CACHE_KEY }}
-      - name: Setup curl cache
-        run: mkdir -p ${{ env.CURL_CACHE_DIR }}
-      - name: Install Packer
-        env:
-          PACKER_VERSION: ${{ steps.setup-env.outputs.packer-version }}
-        run: |
-          PACKER_ZIP="packer_${PACKER_VERSION}_linux_amd64.zip"
-          curl --output ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}" \
-            --time-cond ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}" \
-            --location \
-            "https://releases.hashicorp.com/packer/${PACKER_VERSION}/${PACKER_ZIP}"
-          sudo unzip -d /opt/packer \
-            ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}"
-          sudo mv /usr/local/bin/packer /usr/local/bin/packer-default
-          sudo ln -s /opt/packer/packer /usr/local/bin/packer
+      - uses: hashicorp/setup-packer@v3
+        with:
+          version: ${{ steps.setup-env.outputs.packer-version }}
       - uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: ${{ steps.setup-env.outputs.terraform-version }}

From 8ada75d419c3ea546843fc0772d9d0b678beeea4 Mon Sep 17 00:00:00 2001
From: Jeremy Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Fri, 23 Aug 2024 00:54:54 -0400
Subject: [PATCH 16/52] Remove @jasonodoom as a codeowner

He is no longer a member of @cisagov/vm-dev.
---
 .github/CODEOWNERS | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 229920c6..3af99ba1 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -3,22 +3,22 @@
 # These owners will be the default owners for everything in the
 # repo. Unless a later match takes precedence, these owners will be
 # requested for review when someone opens a pull request.
-* @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
+* @dav3r @felddy @jsf9k @mcdonnnj
 
 # These folks own any files in the .github directory at the root of
 # the repository and any of its subdirectories.
-/.github/ @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
+/.github/ @dav3r @felddy @jsf9k @mcdonnnj
 
 # These folks own all linting configuration files.
-/.ansible-lint @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
-/.bandit.yml @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
-/.flake8 @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
-/.isort.cfg @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
-/.mdl_config.yaml @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
-/.pre-commit-config.yaml @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
-/.prettierignore @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
-/.yamllint @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
-/requirements.txt @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
-/requirements-dev.txt @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
-/requirements-test.txt @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
-/setup-env @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
+/.ansible-lint @dav3r @felddy @jsf9k @mcdonnnj
+/.bandit.yml @dav3r @felddy @jsf9k @mcdonnnj
+/.flake8 @dav3r @felddy @jsf9k @mcdonnnj
+/.isort.cfg @dav3r @felddy @jsf9k @mcdonnnj
+/.mdl_config.yaml @dav3r @felddy @jsf9k @mcdonnnj
+/.pre-commit-config.yaml @dav3r @felddy @jsf9k @mcdonnnj
+/.prettierignore @dav3r @felddy @jsf9k @mcdonnnj
+/.yamllint @dav3r @felddy @jsf9k @mcdonnnj
+/requirements.txt @dav3r @felddy @jsf9k @mcdonnnj
+/requirements-dev.txt @dav3r @felddy @jsf9k @mcdonnnj
+/requirements-test.txt @dav3r @felddy @jsf9k @mcdonnnj
+/setup-env @dav3r @felddy @jsf9k @mcdonnnj

From 293020830fb6830a7324b5eacb8c3122979d9882 Mon Sep 17 00:00:00 2001
From: Shane Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Mon, 26 Aug 2024 09:27:58 -0400
Subject: [PATCH 17/52] Pin to a specific version

Previously we only provided a lower bound for the version, but pinning to a specific version aligns with what has been done with the prettier hook and how pre-commit hooks are pinned in general.

The flake8-docstrings package is rarely updated, so there is no real downside to pinning to a specific version.

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>
---
 .pre-commit-config.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 74c9c764..236eeda0 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -136,7 +136,7 @@ repos:
     hooks:
       - id: flake8
         additional_dependencies:
-          - flake8-docstrings>=1.7.0
+          - flake8-docstrings==1.7.0
   - repo: https://github.com/PyCQA/isort
     rev: 5.13.2
     hooks:

From 46e055367c1e34711ed0980b2934b9df54bf33fe Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 24 Sep 2024 18:23:01 +0000
Subject: [PATCH 18/52] Bump actions/cache from 3 to 4

Bumps [actions/cache](https://github.com/actions/cache) from 3 to 4.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9bb221ad..a403ea9f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -76,7 +76,7 @@ jobs:
         name: Lookup Go cache directory
         run: |
           echo "dir=$(go env GOCACHE)" >> $GITHUB_OUTPUT
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         env:
           BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\
             py${{ steps.setup-python.outputs.python-version }}-\

From 3167421109abf3fe94dc801203587e1bf3ce33a3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 24 Sep 2024 18:23:14 +0000
Subject: [PATCH 19/52] Bump crazy-max/ghaction-github-status from 3 to 4

Bumps [crazy-max/ghaction-github-status](https://github.com/crazy-max/ghaction-github-status) from 3 to 4.
- [Release notes](https://github.com/crazy-max/ghaction-github-status/releases)
- [Commits](https://github.com/crazy-max/ghaction-github-status/compare/v3...v4)

---
updated-dependencies:
- dependency-name: crazy-max/ghaction-github-status
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/sync-labels.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml
index 5a20438e..e83bd414 100644
--- a/.github/workflows/sync-labels.yml
+++ b/.github/workflows/sync-labels.yml
@@ -24,7 +24,7 @@ jobs:
           egress-policy: audit
       - id: github-status
         name: Check GitHub status
-        uses: crazy-max/ghaction-github-status@v3
+        uses: crazy-max/ghaction-github-status@v4
       - id: dump-context
         name: Dump context
         uses: crazy-max/ghaction-dump-context@v2

From 6a58c2c24ef1eb15c7a69a44f16c63964f1c7f82 Mon Sep 17 00:00:00 2001
From: Nicholas McDonnell <50747025+mcdonnnj@users.noreply.github.com>
Date: Mon, 12 Aug 2024 16:23:58 -0400
Subject: [PATCH 20/52] Update pre-commit hook versions

This is done automatically with the `pre-commit autoupdate` command.
The pre-commit/mirrors-prettier hook was manually held back because the
latest tags are for alpha releases of the next major version.
---
 .pre-commit-config.yaml | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 386c83ff..81f3276f 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -31,7 +31,7 @@ repos:
 
   # Text file hooks
   - repo: https://github.com/igorshubovych/markdownlint-cli
-    rev: v0.41.0
+    rev: v0.42.0
     hooks:
       - id: markdownlint
         args:
@@ -56,14 +56,14 @@ repos:
 
   # GitHub Actions hooks
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.28.4
+    rev: 0.29.2
     hooks:
       - id: check-github-actions
       - id: check-github-workflows
 
   # pre-commit hooks
   - repo: https://github.com/pre-commit/pre-commit
-    rev: v3.7.1
+    rev: v3.8.0
     hooks:
       - id: validate_manifest
 
@@ -98,7 +98,7 @@ repos:
 
   # Shell script hooks
   - repo: https://github.com/scop/pre-commit-shfmt
-    rev: v3.8.0-1
+    rev: v3.9.0-1
     hooks:
       - id: shfmt
         args:
@@ -122,17 +122,17 @@ repos:
 
   # Python hooks
   - repo: https://github.com/PyCQA/bandit
-    rev: 1.7.8
+    rev: 1.7.10
     hooks:
       - id: bandit
         args:
           - --config=.bandit.yml
   - repo: https://github.com/psf/black-pre-commit-mirror
-    rev: 24.4.2
+    rev: 24.8.0
     hooks:
       - id: black
   - repo: https://github.com/PyCQA/flake8
-    rev: 7.0.0
+    rev: 7.1.1
     hooks:
       - id: flake8
         additional_dependencies:
@@ -142,17 +142,17 @@ repos:
     hooks:
       - id: isort
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v1.10.0
+    rev: v1.11.2
     hooks:
       - id: mypy
   - repo: https://github.com/asottile/pyupgrade
-    rev: v3.15.2
+    rev: v3.17.0
     hooks:
       - id: pyupgrade
 
   # Ansible hooks
   - repo: https://github.com/ansible/ansible-lint
-    rev: v24.6.0
+    rev: v24.9.2
     hooks:
       - id: ansible-lint
         additional_dependencies:
@@ -177,7 +177,7 @@ repos:
 
   # Terraform hooks
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.90.0
+    rev: v1.96.1
     hooks:
       - id: terraform_fmt
       - id: terraform_validate
@@ -190,7 +190,7 @@ repos:
 
   # Packer hooks
   - repo: https://github.com/cisagov/pre-commit-packer
-    rev: v0.0.2
+    rev: v0.1.0
     hooks:
       - id: packer_validate
       - id: packer_fmt

From 553efcb0d4e755ebd47abb49c865367ed6d0a236 Mon Sep 17 00:00:00 2001
From: Nicholas McDonnell <50747025+mcdonnnj@users.noreply.github.com>
Date: Mon, 12 Aug 2024 16:30:49 -0400
Subject: [PATCH 21/52] Manually update the prettier hook

Use the latest v3 release available from NPM.
---
 .pre-commit-config.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 81f3276f..21047752 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -46,7 +46,7 @@ repos:
         # mirror does not pull tags for old major versions once a new major
         # version tag is published.
         additional_dependencies:
-          - prettier@3.3.1
+          - prettier@3.3.3
   - repo: https://github.com/adrienverge/yamllint
     rev: v1.35.1
     hooks:

From 045a998dcf14dc7e3de9301ba7ee2103272b0ac4 Mon Sep 17 00:00:00 2001
From: Nicholas McDonnell <50747025+mcdonnnj@users.noreply.github.com>
Date: Thu, 18 Jan 2024 16:11:15 -0500
Subject: [PATCH 22/52] Add a pre-commit hook to run pip-audit

The pip-audit tool will audit any supplied pip requirements files for
vulnerable packages.
---
 .pre-commit-config.yaml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 2c5b3c83..78140ffb 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -145,6 +145,18 @@ repos:
     rev: v1.8.0
     hooks:
       - id: mypy
+  - repo: https://github.com/pypa/pip-audit
+    rev: v2.7.3
+    hooks:
+      - id: pip-audit
+        args:
+          # Add any pip requirements files to scan
+          - --requirement
+          - requirements-dev.txt
+          - --requirement
+          - requirements-test.txt
+          - --requirement
+          - requirements.txt
   - repo: https://github.com/asottile/pyupgrade
     rev: v3.15.1
     hooks:

From c502f1ab7cca8bd383a34360ce456b50fd6e8b21 Mon Sep 17 00:00:00 2001
From: Nicholas McDonnell <50747025+mcdonnnj@users.noreply.github.com>
Date: Mon, 12 Aug 2024 16:32:02 -0400
Subject: [PATCH 23/52] Use the rbubley/mirrors-prettier hook for prettier

This replaces the now archived pre-commit/mirrors-prettier hook.
---
 .pre-commit-config.yaml | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index ca59d6f9..3cb1f850 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -40,17 +40,10 @@ repos:
       - id: markdownlint
         args:
           - --config=.mdl_config.yaml
-  - repo: https://github.com/pre-commit/mirrors-prettier
-    # This is the last version of v3 available from the mirror. We should hold
-    # here until v4, which is currently in alpha, is more stable.
-    rev: v3.1.0
+  - repo: https://github.com/rbubley/mirrors-prettier
+    rev: v3.3.3
     hooks:
       - id: prettier
-        # This is the latest version of v3 available from NPM. The pre-commit
-        # mirror does not pull tags for old major versions once a new major
-        # version tag is published.
-        additional_dependencies:
-          - prettier@3.3.3
   - repo: https://github.com/adrienverge/yamllint
     rev: v1.35.1
     hooks:

From 942c0dc98f605282fdf3c0ac6b9a549647f89f41 Mon Sep 17 00:00:00 2001
From: Nicholas McDonnell <50747025+mcdonnnj@users.noreply.github.com>
Date: Tue, 13 Aug 2024 06:17:33 -0400
Subject: [PATCH 24/52] Add a new trigger for the sync-labels GitHub Actions
 workflow

Add a `workflow_dispatch` trigger so we can manually run the workflow
if needed.
---
 .github/workflows/sync-labels.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml
index e83bd414..59aefe4a 100644
--- a/.github/workflows/sync-labels.yml
+++ b/.github/workflows/sync-labels.yml
@@ -6,6 +6,7 @@ on:
     paths:
       - '.github/labels.yml'
       - '.github/workflows/sync-labels.yml'
+  workflow_dispatch:
 
 permissions:
   contents: read

From a267662455c30986086d4ca14173cc20af7161d4 Mon Sep 17 00:00:00 2001
From: Nicholas McDonnell <50747025+mcdonnnj@users.noreply.github.com>
Date: Tue, 13 Aug 2024 06:19:38 -0400
Subject: [PATCH 25/52] Remove unnecessary quotes in the sync-labels workflow

---
 .github/workflows/sync-labels.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml
index 59aefe4a..5d5ab41f 100644
--- a/.github/workflows/sync-labels.yml
+++ b/.github/workflows/sync-labels.yml
@@ -4,8 +4,8 @@ name: sync-labels
 on:
   push:
     paths:
-      - '.github/labels.yml'
-      - '.github/workflows/sync-labels.yml'
+      - .github/labels.yml
+      - .github/workflows/sync-labels.yml
   workflow_dispatch:
 
 permissions:

From dc7f09e29b8466af0fa2f788761e22dd2fcbd0ce Mon Sep 17 00:00:00 2001
From: Nicholas McDonnell <50747025+mcdonnnj@users.noreply.github.com>
Date: Sat, 14 Sep 2024 18:44:01 -0400
Subject: [PATCH 26/52] Add four new hooks from pre-commit/pre-commit-hooks

---
 .pre-commit-config.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 3cb1f850..c98ded8c 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -16,9 +16,13 @@ repos:
       - id: check-executables-have-shebangs
       - id: check-json
       - id: check-merge-conflict
+      - id: check-shebang-scripts-are-executable
+      - id: check-symlinks
       - id: check-toml
+      - id: check-vcs-permalinks
       - id: check-xml
       - id: debug-statements
+      - id: destroyed-symlinks
       - id: detect-aws-credentials
         args:
           - --allow-missing-credentials

From 343d2ccbd1cd983374235e5d3bfcecd3187c00d5 Mon Sep 17 00:00:00 2001
From: Nicholas McDonnell <50747025+mcdonnnj@users.noreply.github.com>
Date: Mon, 28 Oct 2024 17:47:53 -0400
Subject: [PATCH 27/52] Add the GitHubSecurityLab/actions-permissions/monitor
 Action

This Action will provide information about the usage of GITHUB_TOKEN in
the workflow. It should be added to _every_ job in _any_ workflow to
provide information for analysis.
---
 .github/dependabot.yml            |  1 +
 .github/workflows/build.yml       | 10 ++++++++++
 .github/workflows/sync-labels.yml | 10 ++++++++++
 3 files changed, 21 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 17220c6d..4a6667f0 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -16,6 +16,7 @@ updates:
     #   - dependency-name: crazy-max/ghaction-dump-context
     #   - dependency-name: crazy-max/ghaction-github-labeler
     #   - dependency-name: crazy-max/ghaction-github-status
+    #   - dependency-name: GitHubSecurityLab/actions-permissions
     #   - dependency-name: hashicorp/setup-terraform
     #   - dependency-name: mxschmitt/action-tmate
     #   - dependency-name: step-security/harden-runner
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e7a60b20..2cdd9219 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -34,6 +34,12 @@ jobs:
     steps:
       # Note that a duplicate of this step must be added at the top of
       # each job.
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
+        with:
+          # Uses the organization variable unless overridden
+          config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
+      # Note that a duplicate of this step must be added at the top of
+      # each job.
       - id: harden-runner
         name: Harden the runner
         uses: step-security/harden-runner@v2
@@ -50,6 +56,10 @@ jobs:
       - diagnostics
     runs-on: ubuntu-latest
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
+        with:
+          # Uses the organization variable unless overridden
+          config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
       - id: harden-runner
         name: Harden the runner
         uses: step-security/harden-runner@v2
diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml
index e83bd414..d2458d13 100644
--- a/.github/workflows/sync-labels.yml
+++ b/.github/workflows/sync-labels.yml
@@ -17,6 +17,12 @@ jobs:
     steps:
       # Note that a duplicate of this step must be added at the top of
       # each job.
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
+        with:
+          # Uses the organization variable unless overridden
+          config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
+      # Note that a duplicate of this step must be added at the top of
+      # each job.
       - id: harden-runner
         name: Harden the runner
         uses: step-security/harden-runner@v2
@@ -38,6 +44,10 @@ jobs:
       issues: write
     runs-on: ubuntu-latest
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
+        with:
+          # Uses the organization variable unless overridden
+          config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
       - id: harden-runner
         name: Harden the runner
         uses: step-security/harden-runner@v2

From 8a77a8b77a7d5e5247e8ff563d93a14510e09b9a Mon Sep 17 00:00:00 2001
From: Nicholas McDonnell <50747025+mcdonnnj@users.noreply.github.com>
Date: Mon, 28 Oct 2024 17:09:15 -0400
Subject: [PATCH 28/52] Restrict permissions of GITHUB_TOKEN

This changes the default permissions for the GITHUB_TOKEN used in our
GitHub Actions configuration to the minimum required to successfully
run.
---
 .github/workflows/build.yml       | 5 +++++
 .github/workflows/sync-labels.yml | 2 ++
 2 files changed, 7 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e7a60b20..d4340af5 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -30,6 +30,8 @@ env:
 jobs:
   diagnostics:
     name: Run diagnostics
+    # This job does not need any permissions
+    permissions: {}
     runs-on: ubuntu-latest
     steps:
       # Note that a duplicate of this step must be added at the top of
@@ -48,6 +50,9 @@ jobs:
   lint:
     needs:
       - diagnostics
+    permissions:
+      # actions/checkout needs this to fetch code
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - id: harden-runner
diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml
index e83bd414..39e73794 100644
--- a/.github/workflows/sync-labels.yml
+++ b/.github/workflows/sync-labels.yml
@@ -13,6 +13,8 @@ permissions:
 jobs:
   diagnostics:
     name: Run diagnostics
+    # This job does not need any permissions
+    permissions: {}
     runs-on: ubuntu-latest
     steps:
       # Note that a duplicate of this step must be added at the top of

From 3b1d4ef0fae08e6444e9b414ce1315841e681322 Mon Sep 17 00:00:00 2001
From: Nicholas McDonnell <50747025+mcdonnnj@users.noreply.github.com>
Date: Wed, 16 Oct 2024 12:53:42 -0400
Subject: [PATCH 29/52] Update pre-commit hook versions

This is done automatically with the `pre-commit autoupdate` command.
---
 .pre-commit-config.yaml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 3cb1f850..26b399d7 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -10,7 +10,7 @@ repos:
       - id: check-useless-excludes
 
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.6.0
+    rev: v5.0.0
     hooks:
       - id: check-case-conflict
       - id: check-executables-have-shebangs
@@ -53,14 +53,14 @@ repos:
 
   # GitHub Actions hooks
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.29.2
+    rev: 0.29.4
     hooks:
       - id: check-github-actions
       - id: check-github-workflows
 
   # pre-commit hooks
   - repo: https://github.com/pre-commit/pre-commit
-    rev: v3.8.0
+    rev: v4.0.1
     hooks:
       - id: validate_manifest
 
@@ -95,7 +95,7 @@ repos:
 
   # Shell script hooks
   - repo: https://github.com/scop/pre-commit-shfmt
-    rev: v3.9.0-1
+    rev: v3.10.0-1
     hooks:
       - id: shfmt
         args:
@@ -125,7 +125,7 @@ repos:
         args:
           - --config=.bandit.yml
   - repo: https://github.com/psf/black-pre-commit-mirror
-    rev: 24.8.0
+    rev: 24.10.0
     hooks:
       - id: black
   - repo: https://github.com/PyCQA/flake8
@@ -139,7 +139,7 @@ repos:
     hooks:
       - id: isort
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v1.11.2
+    rev: v1.13.0
     hooks:
       - id: mypy
   - repo: https://github.com/pypa/pip-audit
@@ -155,7 +155,7 @@ repos:
           - --requirement
           - requirements.txt
   - repo: https://github.com/asottile/pyupgrade
-    rev: v3.17.0
+    rev: v3.19.0
     hooks:
       - id: pyupgrade
 
@@ -199,7 +199,7 @@ repos:
 
   # Packer hooks
   - repo: https://github.com/cisagov/pre-commit-packer
-    rev: v0.1.0
+    rev: v0.3.0
     hooks:
       - id: packer_validate
       - id: packer_fmt

From 1d285f2d851926effdbfbdcf58853ce70d1bf016 Mon Sep 17 00:00:00 2001
From: Nicholas McDonnell <50747025+mcdonnnj@users.noreply.github.com>
Date: Tue, 29 Oct 2024 16:36:27 -0400
Subject: [PATCH 30/52] Sort hook ids in each pre-commit hook entry

Ensure that all hook ids are sorted alphabetically in each hook entry
in our pre-commit configuration.
---
 .pre-commit-config.yaml | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 3cb1f850..0fd32346 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -68,25 +68,25 @@ repos:
   - repo: https://github.com/TekWizely/pre-commit-golang
     rev: v1.0.0-rc.1
     hooks:
-      # Style Checkers
-      - id: go-critic
-      # StaticCheck
-      - id: go-staticcheck-repo-mod
       # Go Build
       - id: go-build-repo-mod
+      # Style Checkers
+      - id: go-critic
+      # goimports
+      - id: go-imports-repo
+        args:
+          # Write changes to files
+          - -w
       # Go Mod Tidy
       - id: go-mod-tidy-repo
+      # GoSec
+      - id: go-sec-repo-mod
+      # StaticCheck
+      - id: go-staticcheck-repo-mod
       # Go Test
       - id: go-test-repo-mod
       # Go Vet
       - id: go-vet-repo-mod
-      # GoSec
-      - id: go-sec-repo-mod
-      # goimports
-      - id: go-imports-repo
-        args:
-          # Write changes to files
-          - -w
   # Nix hooks
   - repo: https://github.com/nix-community/nixpkgs-fmt
     rev: v1.3.0
@@ -201,5 +201,5 @@ repos:
   - repo: https://github.com/cisagov/pre-commit-packer
     rev: v0.1.0
     hooks:
-      - id: packer_validate
       - id: packer_fmt
+      - id: packer_validate

From 3843f1799f4ef95f62ef9c280fb4351005029048 Mon Sep 17 00:00:00 2001
From: Jeremy Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Wed, 30 Oct 2024 13:17:04 -0400
Subject: [PATCH 31/52] Uncomment new Dependabot ignore directive from upstream

---
 .github/dependabot.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a11003a5..27bad88b 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -16,7 +16,7 @@ updates:
       - dependency-name: crazy-max/ghaction-dump-context
       - dependency-name: crazy-max/ghaction-github-labeler
       - dependency-name: crazy-max/ghaction-github-status
-  #   - dependency-name: GitHubSecurityLab/actions-permissions
+      - dependency-name: GitHubSecurityLab/actions-permissions
       - dependency-name: hashicorp/setup-terraform
       - dependency-name: mxschmitt/action-tmate
       - dependency-name: step-security/harden-runner

From 8824475dfadd1a9cbc9ce9bd1c9f31e4a688994b Mon Sep 17 00:00:00 2001
From: Nicholas McDonnell <50747025+mcdonnnj@users.noreply.github.com>
Date: Fri, 1 Nov 2024 12:25:35 -0400
Subject: [PATCH 32/52] Update the commented out dependabot ignore directives

Add a directive for hashicorp/setup-packer that was missed when it was
added to the `build` workflow. Add a directive for
cisagov/setup-env-github-action that is not strictly necessary since we
currently just pull from the `develop` branch, but is good to have in
case we were to change that in the future.
---
 .github/dependabot.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 4a6667f0..81cd6bdc 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -13,10 +13,12 @@ updates:
     #   - dependency-name: actions/checkout
     #   - dependency-name: actions/setup-go
     #   - dependency-name: actions/setup-python
+    #   - dependency-name: cisagov/setup-env-github-action
     #   - dependency-name: crazy-max/ghaction-dump-context
     #   - dependency-name: crazy-max/ghaction-github-labeler
     #   - dependency-name: crazy-max/ghaction-github-status
     #   - dependency-name: GitHubSecurityLab/actions-permissions
+    #   - dependency-name: hashicorp/setup-packer
     #   - dependency-name: hashicorp/setup-terraform
     #   - dependency-name: mxschmitt/action-tmate
     #   - dependency-name: step-security/harden-runner

From 5a6801b6de42f7126233ea0ec0582e6208d2078c Mon Sep 17 00:00:00 2001
From: Jeremy Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Wed, 30 Oct 2024 13:22:08 -0400
Subject: [PATCH 33/52] Install Packer via hashicorp/setup-packer everywhere

---
 .github/workflows/build.yml      | 39 +++++---------------------------
 .github/workflows/prerelease.yml | 20 +++-------------
 .github/workflows/release.yml    | 20 +++-------------
 3 files changed, 12 insertions(+), 67 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e160f4f3..aba95706 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -21,7 +21,6 @@ defaults:
 
 env:
   AWS_DEFAULT_REGION: us-east-1
-  CURL_CACHE_DIR: ~/.cache/curl
   PIP_CACHE_DIR: ~/.cache/pip
   PRE_COMMIT_CACHE_DIR: ~/.cache/pre-commit
   RUN_TMATE: ${{ secrets.RUN_TMATE }}
@@ -201,27 +200,14 @@ jobs:
         with:
           path: |
             ${{ env.PIP_CACHE_DIR }}
-            ${{ env.CURL_CACHE_DIR }}
           key: "${{ env.BASE_CACHE_KEY }}\
             ${{ hashFiles('**/requirements-test.txt') }}-\
             ${{ hashFiles('**/requirements.txt') }}"
           restore-keys: |
             ${{ env.BASE_CACHE_KEY }}
-      - name: Setup curl cache
-        run: mkdir -p ${{ env.CURL_CACHE_DIR }}
-      - name: Install Packer
-        env:
-          PACKER_VERSION: ${{ steps.setup-env.outputs.packer-version }}
-        run: |
-          PACKER_ZIP="packer_${PACKER_VERSION}_linux_amd64.zip"
-          curl --output ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}" \
-            --time-cond ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}" \
-            --location \
-            "https://releases.hashicorp.com/packer/${PACKER_VERSION}/${PACKER_ZIP}"
-          sudo unzip -d /opt/packer \
-            ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}"
-          sudo mv /usr/local/bin/packer /usr/local/bin/packer-default
-          sudo ln -s /opt/packer/packer /usr/local/bin/packer
+      - uses: hashicorp/setup-packer@v3
+        with:
+          version: ${{ steps.setup-env.outputs.packer-version }}
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
@@ -268,26 +254,13 @@ jobs:
         with:
           path: |
             ${{ env.PIP_CACHE_DIR }}
-            ${{ env.CURL_CACHE_DIR }}
           key: "${{ env.BASE_CACHE_KEY }}\
             ${{ hashFiles('**/requirements.txt') }}"
           restore-keys: |
             ${{ env.BASE_CACHE_KEY }}
-      - name: Setup curl cache
-        run: mkdir -p ${{ env.CURL_CACHE_DIR }}
-      - name: Install Packer
-        env:
-          PACKER_VERSION: ${{ steps.setup-env.outputs.packer-version }}
-        run: |
-          PACKER_ZIP="packer_${PACKER_VERSION}_linux_amd64.zip"
-          curl --output ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}" \
-            --time-cond ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}" \
-            --location \
-            "https://releases.hashicorp.com/packer/${PACKER_VERSION}/${PACKER_ZIP}"
-          sudo unzip -d /opt/packer \
-            ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}"
-          sudo mv /usr/local/bin/packer /usr/local/bin/packer-default
-          sudo ln -s /opt/packer/packer /usr/local/bin/packer
+      - uses: hashicorp/setup-packer@v3
+        with:
+          version: ${{ steps.setup-env.outputs.packer-version }}
       - uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: ${{ steps.setup-env.outputs.terraform-version }}
diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
index dcc3d6a0..c2e25fe0 100644
--- a/.github/workflows/prerelease.yml
+++ b/.github/workflows/prerelease.yml
@@ -7,7 +7,6 @@ on:
 
 env:
   AWS_DEFAULT_REGION: us-east-1
-  CURL_CACHE_DIR: ~/.cache/curl
   PIP_CACHE_DIR: ~/.cache/pip
   RUN_TMATE: ${{ secrets.RUN_TMATE }}
 
@@ -61,26 +60,13 @@ jobs:
         with:
           path: |
             ${{ env.PIP_CACHE_DIR }}
-            ${{ env.CURL_CACHE_DIR }}
           key: "${{ env.BASE_CACHE_KEY }}\
             ${{ hashFiles('**/requirements.txt') }}"
           restore-keys: |
             ${{ env.BASE_CACHE_KEY }}
-      - name: Setup curl cache
-        run: mkdir -p ${{ env.CURL_CACHE_DIR }}
-      - name: Install Packer
-        env:
-          PACKER_VERSION: ${{ steps.setup-env.outputs.packer-version }}
-        run: |
-          PACKER_ZIP="packer_${PACKER_VERSION}_linux_amd64.zip"
-          curl --output ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}" \
-            --time-cond ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}" \
-            --location \
-            "https://releases.hashicorp.com/packer/${PACKER_VERSION}/${PACKER_ZIP}"
-          sudo unzip -d /opt/packer \
-            ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}"
-          sudo mv /usr/local/bin/packer /usr/local/bin/packer-default
-          sudo ln -s /opt/packer/packer /usr/local/bin/packer
+      - uses: hashicorp/setup-packer@v3
+        with:
+          version: ${{ steps.setup-env.outputs.packer-version }}
       - uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: ${{ steps.setup-env.outputs.terraform-version }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f0555082..9bb5e022 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,7 +14,6 @@ env:
   # COPY_REGIONS_KMS_MAP: "us-east-2:alias/cool-amis,
   #                        us-west-1:alias/cool-amis,
   #                        us-west-2:alias/cool-amis"
-  CURL_CACHE_DIR: ~/.cache/curl
   PIP_CACHE_DIR: ~/.cache/pip
   RUN_TMATE: ${{ secrets.RUN_TMATE }}
 
@@ -68,26 +67,13 @@ jobs:
         with:
           path: |
             ${{ env.PIP_CACHE_DIR }}
-            ${{ env.CURL_CACHE_DIR }}
           key: "${{ env.BASE_CACHE_KEY }}\
             ${{ hashFiles('**/requirements.txt') }}"
           restore-keys: |
             ${{ env.BASE_CACHE_KEY }}
-      - name: Setup curl cache
-        run: mkdir -p ${{ env.CURL_CACHE_DIR }}
-      - name: Install Packer
-        env:
-          PACKER_VERSION: ${{ steps.setup-env.outputs.packer-version }}
-        run: |
-          PACKER_ZIP="packer_${PACKER_VERSION}_linux_amd64.zip"
-          curl --output ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}" \
-            --time-cond ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}" \
-            --location \
-            "https://releases.hashicorp.com/packer/${PACKER_VERSION}/${PACKER_ZIP}"
-          sudo unzip -d /opt/packer \
-            ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}"
-          sudo mv /usr/local/bin/packer /usr/local/bin/packer-default
-          sudo ln -s /opt/packer/packer /usr/local/bin/packer
+      - uses: hashicorp/setup-packer@v3
+        with:
+          version: ${{ steps.setup-env.outputs.packer-version }}
       - uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: ${{ steps.setup-env.outputs.terraform-version }}

From 7caddb4884f3ddf23a4a9b5f79c337c1679cc90a Mon Sep 17 00:00:00 2001
From: Jeremy Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Wed, 30 Oct 2024 13:24:01 -0400
Subject: [PATCH 34/52] Upgrade Bandit to 1.7.10

We should use the same version of Bandit throughout the pre-commit
configuration.
---
 .pre-commit-config.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 12c848c1..c4c8bf95 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -133,7 +133,7 @@ repos:
           - --config=.bandit.yml
   # Run bandit on everything except the "tests" tree
   - repo: https://github.com/PyCQA/bandit
-    rev: 1.7.7
+    rev: 1.7.10
     hooks:
       - id: bandit
         name: bandit (everything else)

From e0fac13547fc7e76b8724585665476d82156f241 Mon Sep 17 00:00:00 2001
From: Jeremy Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Wed, 30 Oct 2024 13:31:49 -0400
Subject: [PATCH 35/52] Add explicit permissions for jobs that lack them

---
 .github/workflows/build.yml      | 4 ++++
 .github/workflows/prerelease.yml | 4 ++++
 .github/workflows/release.yml    | 4 ++++
 3 files changed, 12 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index aba95706..22dcf420 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -178,6 +178,8 @@ jobs:
   test:
     needs:
       - diagnostics
+    # This job does not need any permissions
+    permissions: {}
     runs-on: ubuntu-latest
     steps:
       - id: harden-runner
@@ -225,6 +227,8 @@ jobs:
     needs:
       - lint
       - test
+    # This job does not need any permissions
+    permissions: {}
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
index c2e25fe0..61053053 100644
--- a/.github/workflows/prerelease.yml
+++ b/.github/workflows/prerelease.yml
@@ -13,6 +13,8 @@ env:
 jobs:
   diagnostics:
     name: Run diagnostics
+    # This job does not need any permissions
+    permissions: {}
     runs-on: ubuntu-latest
     steps:
       # Note that a duplicate of this step must be added at the top of
@@ -31,6 +33,8 @@ jobs:
   prerelease:
     needs:
       - diagnostics
+    # This job does not need any permissions
+    permissions: {}
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9bb5e022..e438d59c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,6 +20,8 @@ env:
 jobs:
   diagnostics:
     name: Run diagnostics
+    # This job does not need any permissions
+    permissions: {}
     runs-on: ubuntu-latest
     steps:
       # Note that a duplicate of this step must be added at the top of
@@ -38,6 +40,8 @@ jobs:
   release:
     needs:
       - diagnostics
+    # This job does not need any permissions
+    permissions: {}
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false

From c98703c8b28c6d7ead8e85731584020831b8417c Mon Sep 17 00:00:00 2001
From: Jeremy Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Wed, 30 Oct 2024 13:35:46 -0400
Subject: [PATCH 36/52] Add GitHubSecurityLab/actions-permissions/monitor task
 to each job that lacks it

---
 .github/workflows/build.yml      | 12 ++++++++++++
 .github/workflows/prerelease.yml | 12 ++++++++++++
 .github/workflows/release.yml    | 12 ++++++++++++
 3 files changed, 36 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 22dcf420..91b460ce 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -182,6 +182,12 @@ jobs:
     permissions: {}
     runs-on: ubuntu-latest
     steps:
+      # Note that a duplicate of this step must be added at the top of
+      # each job.
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
+        with:
+          # Uses the organization variable unless overridden
+          config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
       - id: harden-runner
         name: Harden the runner
         uses: step-security/harden-runner@v2
@@ -237,6 +243,12 @@ jobs:
           - arm64
           - x86_64
     steps:
+      # Note that a duplicate of this step must be added at the top of
+      # each job.
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
+        with:
+          # Uses the organization variable unless overridden
+          config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
       - id: harden-runner
         name: Harden the runner
         uses: step-security/harden-runner@v2
diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
index 61053053..62f9ecfa 100644
--- a/.github/workflows/prerelease.yml
+++ b/.github/workflows/prerelease.yml
@@ -19,6 +19,12 @@ jobs:
     steps:
       # Note that a duplicate of this step must be added at the top of
       # each job.
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
+        with:
+          # Uses the organization variable unless overridden
+          config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
+      # Note that a duplicate of this step must be added at the top of
+      # each job.
       - id: harden-runner
         name: Harden the runner
         uses: step-security/harden-runner@v2
@@ -43,6 +49,12 @@ jobs:
           - arm64
           - x86_64
     steps:
+      # Note that a duplicate of this step must be added at the top of
+      # each job.
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
+        with:
+          # Uses the organization variable unless overridden
+          config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
       - id: harden-runner
         name: Harden the runner
         uses: step-security/harden-runner@v2
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e438d59c..ad733756 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,6 +26,12 @@ jobs:
     steps:
       # Note that a duplicate of this step must be added at the top of
       # each job.
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
+        with:
+          # Uses the organization variable unless overridden
+          config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
+      # Note that a duplicate of this step must be added at the top of
+      # each job.
       - id: harden-runner
         name: Harden the runner
         uses: step-security/harden-runner@v2
@@ -50,6 +56,12 @@ jobs:
           - arm64
           - x86_64
     steps:
+      # Note that a duplicate of this step must be added at the top of
+      # each job.
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
+        with:
+          # Uses the organization variable unless overridden
+          config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
       - id: harden-runner
         name: Harden the runner
         uses: step-security/harden-runner@v2

From 469c1661d4e6c7c7cd7fda70e3c3e4e682cc0f9b Mon Sep 17 00:00:00 2001
From: Jeremy Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Wed, 30 Oct 2024 13:59:22 -0400
Subject: [PATCH 37/52] Remove shebang

This file is not executable and hence it should not have a shebang.
---
 tests/test_version.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tests/test_version.py b/tests/test_version.py
index b4181dda..54cdd0aa 100644
--- a/tests/test_version.py
+++ b/tests/test_version.py
@@ -1,4 +1,3 @@
-#!/usr/bin/env pytest -vs
 """Version tests for packer skeleton project."""
 
 # Standard Python Libraries

From b752ed86f1f59c024624e1f6f7880457f84dc82e Mon Sep 17 00:00:00 2001
From: Jeremy Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Wed, 30 Oct 2024 22:33:26 -0400
Subject: [PATCH 38/52] Add repo read permissions for all jobs that checkout
 code

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>
---
 .github/workflows/build.yml      | 10 ++++++----
 .github/workflows/prerelease.yml |  5 +++--
 .github/workflows/release.yml    |  5 +++--
 3 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 91b460ce..1a959154 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -178,8 +178,9 @@ jobs:
   test:
     needs:
       - diagnostics
-    # This job does not need any permissions
-    permissions: {}
+    permissions:
+      # actions/checkout needs this to fetch code
+      contents: read
     runs-on: ubuntu-latest
     steps:
       # Note that a duplicate of this step must be added at the top of
@@ -233,8 +234,9 @@ jobs:
     needs:
       - lint
       - test
-    # This job does not need any permissions
-    permissions: {}
+    permissions:
+      # actions/checkout needs this to fetch code
+      contents: read
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
index 62f9ecfa..5a05ad83 100644
--- a/.github/workflows/prerelease.yml
+++ b/.github/workflows/prerelease.yml
@@ -39,8 +39,9 @@ jobs:
   prerelease:
     needs:
       - diagnostics
-    # This job does not need any permissions
-    permissions: {}
+    permissions:
+      # actions/checkout needs this to fetch code
+      contents: read
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ad733756..a09282c2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -46,8 +46,9 @@ jobs:
   release:
     needs:
       - diagnostics
-    # This job does not need any permissions
-    permissions: {}
+    permissions:
+      # actions/checkout needs this to fetch code
+      contents: read
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false

From 36300f3bab2ea1021997162763c30af642da284c Mon Sep 17 00:00:00 2001
From: Jeremy Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Thu, 31 Oct 2024 14:31:13 -0400
Subject: [PATCH 39/52] Remove repeated comment

---
 .github/workflows/build.yml      | 4 ----
 .github/workflows/prerelease.yml | 2 --
 .github/workflows/release.yml    | 2 --
 3 files changed, 8 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1a959154..602d9e1e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -183,8 +183,6 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      # Note that a duplicate of this step must be added at the top of
-      # each job.
       - uses: GitHubSecurityLab/actions-permissions/monitor@v1
         with:
           # Uses the organization variable unless overridden
@@ -245,8 +243,6 @@ jobs:
           - arm64
           - x86_64
     steps:
-      # Note that a duplicate of this step must be added at the top of
-      # each job.
       - uses: GitHubSecurityLab/actions-permissions/monitor@v1
         with:
           # Uses the organization variable unless overridden
diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
index 5a05ad83..af5b3259 100644
--- a/.github/workflows/prerelease.yml
+++ b/.github/workflows/prerelease.yml
@@ -50,8 +50,6 @@ jobs:
           - arm64
           - x86_64
     steps:
-      # Note that a duplicate of this step must be added at the top of
-      # each job.
       - uses: GitHubSecurityLab/actions-permissions/monitor@v1
         with:
           # Uses the organization variable unless overridden
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a09282c2..d14d3b0a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -57,8 +57,6 @@ jobs:
           - arm64
           - x86_64
     steps:
-      # Note that a duplicate of this step must be added at the top of
-      # each job.
       - uses: GitHubSecurityLab/actions-permissions/monitor@v1
         with:
           # Uses the organization variable unless overridden

From 97a31b940e1b7c3177ae936d8a417c1dbc5285fd Mon Sep 17 00:00:00 2001
From: Jeremy Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Thu, 7 Nov 2024 15:53:00 -0500
Subject: [PATCH 40/52] Update the commented out dependabot ignore directives

Add a directive for hashicorp/setup-packer that was missed when it was
added to the `build` workflow. Add a directive for
cisagov/setup-env-github-action that is not strictly necessary since we
currently just pull from the `develop` branch, but is good to have in
case we were to change that in the future.
---
 .github/dependabot.yml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 27bad88b..632829e7 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,6 +7,7 @@
 
 updates:
   - directory: /
+<<<<<<< HEAD
     ignore:
       # Managed by cisagov/skeleton-generic
       - dependency-name: actions/cache
@@ -22,6 +23,23 @@ updates:
       - dependency-name: step-security/harden-runner
       # # Managed by cisagov/skeleton-packer
       # - dependency-name: aws-actions/configure-aws-credentials
+=======
+    # ignore:
+    #   # Managed by cisagov/skeleton-generic
+    #   - dependency-name: actions/cache
+    #   - dependency-name: actions/checkout
+    #   - dependency-name: actions/setup-go
+    #   - dependency-name: actions/setup-python
+    #   - dependency-name: cisagov/setup-env-github-action
+    #   - dependency-name: crazy-max/ghaction-dump-context
+    #   - dependency-name: crazy-max/ghaction-github-labeler
+    #   - dependency-name: crazy-max/ghaction-github-status
+    #   - dependency-name: GitHubSecurityLab/actions-permissions
+    #   - dependency-name: hashicorp/setup-packer
+    #   - dependency-name: hashicorp/setup-terraform
+    #   - dependency-name: mxschmitt/action-tmate
+    #   - dependency-name: step-security/harden-runner
+>>>>>>> 8824475 (Update the commented out dependabot ignore directives)
     package-ecosystem: github-actions
     schedule:
       interval: weekly

From 52945c22c99d7102a9a9e9c68a6e43417ae2d6bc Mon Sep 17 00:00:00 2001
From: Jeremy Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Thu, 7 Nov 2024 15:55:16 -0500
Subject: [PATCH 41/52] Resolve conflict from follow-on Lineage update

---
 .github/dependabot.yml | 20 ++------------------
 1 file changed, 2 insertions(+), 18 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 632829e7..0bebd17c 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,39 +7,23 @@
 
 updates:
   - directory: /
-<<<<<<< HEAD
     ignore:
       # Managed by cisagov/skeleton-generic
       - dependency-name: actions/cache
       - dependency-name: actions/checkout
       - dependency-name: actions/setup-go
       - dependency-name: actions/setup-python
+      # - dependency-name: cisagov/setup-env-github-action
       - dependency-name: crazy-max/ghaction-dump-context
       - dependency-name: crazy-max/ghaction-github-labeler
       - dependency-name: crazy-max/ghaction-github-status
       - dependency-name: GitHubSecurityLab/actions-permissions
+      # - dependency-name: hashicorp/setup-packer
       - dependency-name: hashicorp/setup-terraform
       - dependency-name: mxschmitt/action-tmate
       - dependency-name: step-security/harden-runner
       # # Managed by cisagov/skeleton-packer
       # - dependency-name: aws-actions/configure-aws-credentials
-=======
-    # ignore:
-    #   # Managed by cisagov/skeleton-generic
-    #   - dependency-name: actions/cache
-    #   - dependency-name: actions/checkout
-    #   - dependency-name: actions/setup-go
-    #   - dependency-name: actions/setup-python
-    #   - dependency-name: cisagov/setup-env-github-action
-    #   - dependency-name: crazy-max/ghaction-dump-context
-    #   - dependency-name: crazy-max/ghaction-github-labeler
-    #   - dependency-name: crazy-max/ghaction-github-status
-    #   - dependency-name: GitHubSecurityLab/actions-permissions
-    #   - dependency-name: hashicorp/setup-packer
-    #   - dependency-name: hashicorp/setup-terraform
-    #   - dependency-name: mxschmitt/action-tmate
-    #   - dependency-name: step-security/harden-runner
->>>>>>> 8824475 (Update the commented out dependabot ignore directives)
     package-ecosystem: github-actions
     schedule:
       interval: weekly

From 7748de41cc11b0516fc3f64aa9b3ff7ecdc206bb Mon Sep 17 00:00:00 2001
From: Jeremy Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Wed, 6 Nov 2024 10:14:38 -0500
Subject: [PATCH 42/52] Uncomment new Dependabot directives from upstream

---
 .github/dependabot.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 0bebd17c..c0add003 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -13,12 +13,12 @@ updates:
       - dependency-name: actions/checkout
       - dependency-name: actions/setup-go
       - dependency-name: actions/setup-python
-      # - dependency-name: cisagov/setup-env-github-action
+      - dependency-name: cisagov/setup-env-github-action
       - dependency-name: crazy-max/ghaction-dump-context
       - dependency-name: crazy-max/ghaction-github-labeler
       - dependency-name: crazy-max/ghaction-github-status
       - dependency-name: GitHubSecurityLab/actions-permissions
-      # - dependency-name: hashicorp/setup-packer
+      - dependency-name: hashicorp/setup-packer
       - dependency-name: hashicorp/setup-terraform
       - dependency-name: mxschmitt/action-tmate
       - dependency-name: step-security/harden-runner

From e9db1f59c5bd5dc791143e86373af2a1f8156d59 Mon Sep 17 00:00:00 2001
From: Jeremy Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Thu, 7 Nov 2024 15:59:25 -0500
Subject: [PATCH 43/52] Upgrade to actions/cache@v4 everywhere

---
 .github/workflows/build.yml      | 4 ++--
 .github/workflows/prerelease.yml | 2 +-
 .github/workflows/release.yml    | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 602d9e1e..a2d99e83 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -199,7 +199,7 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: ${{ steps.setup-env.outputs.python-version }}
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         env:
           BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\
             py${{ steps.setup-python.outputs.python-version }}-\
@@ -259,7 +259,7 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: ${{ steps.setup-env.outputs.python-version }}
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         env:
           BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\
             py${{ steps.setup-python.outputs.python-version }}-\
diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
index af5b3259..98f72127 100644
--- a/.github/workflows/prerelease.yml
+++ b/.github/workflows/prerelease.yml
@@ -66,7 +66,7 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: ${{ steps.setup-env.outputs.python-version }}
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         env:
           BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\
             py${{ steps.setup-python.outputs.python-version }}-\
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d14d3b0a..7d02eabc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -73,7 +73,7 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: ${{ steps.setup-env.outputs.python-version }}
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         env:
           BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\
             py${{ steps.setup-python.outputs.python-version }}-\

From 1845fd72cef9e647aeeddcdb2426a7c785e04caa Mon Sep 17 00:00:00 2001
From: Jeremy Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Thu, 7 Nov 2024 18:38:30 -0500
Subject: [PATCH 44/52] Resolve conflict from follow-on Lineage update

---
 .github/dependabot.yml | 18 ------------------
 1 file changed, 18 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a5e74ff6..c0add003 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,7 +7,6 @@
 
 updates:
   - directory: /
-<<<<<<< HEAD
     ignore:
       # Managed by cisagov/skeleton-generic
       - dependency-name: actions/cache
@@ -25,23 +24,6 @@ updates:
       - dependency-name: step-security/harden-runner
       # # Managed by cisagov/skeleton-packer
       # - dependency-name: aws-actions/configure-aws-credentials
-=======
-    # ignore:
-    #   # Managed by cisagov/skeleton-generic
-    #   - dependency-name: actions/cache
-    #   - dependency-name: actions/checkout
-    #   - dependency-name: actions/setup-go
-    #   - dependency-name: actions/setup-python
-    #   - dependency-name: cisagov/setup-env-github-action
-    #   - dependency-name: crazy-max/ghaction-dump-context
-    #   - dependency-name: crazy-max/ghaction-github-labeler
-    #   - dependency-name: crazy-max/ghaction-github-status
-    #   - dependency-name: GitHubSecurityLab/actions-permissions
-    #   - dependency-name: hashicorp/setup-packer
-    #   - dependency-name: hashicorp/setup-terraform
-    #   - dependency-name: mxschmitt/action-tmate
-    #   - dependency-name: step-security/harden-runner
->>>>>>> e6afb68083e4b6e1ec38f036dee2f5e294b5cc96
     package-ecosystem: github-actions
     schedule:
       interval: weekly

From 26a8bafe25f49a099a07342a1539e4dd6eb60095 Mon Sep 17 00:00:00 2001
From: Jeremy Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Fri, 8 Nov 2024 13:22:49 -0500
Subject: [PATCH 45/52] Bump up the lower bound on ansible-core

This is being done because the pip-audit pre-commit hook identifies a
vulnerability in ansible-core version 2.16.13.  Note that this
requires that we bump up ansible to version 10 since all versions of
ansible 9 have a dependency on ~=2.16.X.
---
 requirements.txt | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/requirements.txt b/requirements.txt
index bdf26b2a..0f38eb1e 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -8,20 +8,27 @@
 # as using the dnf package manager, and version 8 is currently the
 # oldest supported version.
 #
-# We have tested against version 9.  We want to avoid automatically
+# Version 10 is required because the pip-audit pre-commit hook
+# identifies a vulnerability in ansible-core 2.16.13, but all versions
+# of ansible 9 have a dependency on ~=2.16.X.
+#
+# We have tested against version 10.  We want to avoid automatically
 # jumping to another major version without testing, since there are
 # often breaking changes across major versions.  This is the reason
 # for the upper bound.
-ansible>=8,<10
+ansible>=10,<11
 # ansible-core 2.16.3 through 2.16.6 suffer from the bug discussed in
 # ansible/ansible#82702, which breaks any symlinked files in vars,
 # tasks, etc. for any Ansible role installed via ansible-galaxy.
 # Hence we never want to install those versions.
 #
+# Note that the pip-audit pre-commit hook identifies a vulnerability
+# in ansible-core 2.16.13.
+#
 # Note that any changes made to this dependency must also be made in
 # requirements-test.txt in cisagov/skeleton-ansible-role and
 # .pre-commit-config.yaml in cisagov/skeleton-generic.
-ansible-core>=2.16.7
+ansible-core>2.16.13
 boto3
 docopt
 semver

From 12a91ad97e76cd2f221fffaef4f66956533f6540 Mon Sep 17 00:00:00 2001
From: Jeremy Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Fri, 8 Nov 2024 13:40:44 -0500
Subject: [PATCH 46/52] Bump up the lower bound on ansible-core

This is being done because the pip-audit pre-commit hook identifies a
vulnerability in ansible-core version 2.16.13.  Note that this
requires that we bump up ansible to version 10 since all versions of
ansible 9 have a dependency on ~=2.16.X.
---
 .pre-commit-config.yaml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index c5e1096f..8b402fb9 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -176,17 +176,25 @@ repos:
           # necessary to add the ansible package itself as an
           # additional dependency, with the same pinning as is done in
           # requirements-test.txt of cisagov/skeleton-ansible-role.
-          # - ansible>=9,<10
+          #
+          # Version 10 is required because the pip-audit pre-commit
+          # hook identifies a vulnerability in ansible-core 2.16.13,
+          # but all versions of ansible 9 have a dependency on
+          # ~=2.16.X.
+          # - ansible>=10,<11
           # ansible-core 2.16.3 through 2.16.6 suffer from the bug
           # discussed in ansible/ansible#82702, which breaks any
           # symlinked files in vars, tasks, etc. for any Ansible role
           # installed via ansible-galaxy.  Hence we never want to
           # install those versions.
           #
+          # Note that the pip-audit pre-commit hook identifies a
+          # vulnerability in ansible-core 2.16.13.
+          #
           # Note that any changes made to this dependency must also be
           # made in requirements.txt in cisagov/skeleton-packer and
           # requirements-test.txt in cisagov/skeleton-ansible-role.
-          - ansible-core>=2.16.7
+          - ansible-core>2.16.13
 
   # Terraform hooks
   - repo: https://github.com/antonbabenko/pre-commit-terraform

From b9f798d03afb72f33ffa625982dd5b548dea5132 Mon Sep 17 00:00:00 2001
From: Jeremy Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Wed, 13 Nov 2024 10:29:42 -0500
Subject: [PATCH 47/52] Update the version of the ansible-lint pre-commit hook

Version 24.10.0 is the first version that supports Fedora 41 as a
valid platform.
---
 .pre-commit-config.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index c5e1096f..ebd61382 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -165,7 +165,7 @@ repos:
 
   # Ansible hooks
   - repo: https://github.com/ansible/ansible-lint
-    rev: v24.9.2
+    rev: v24.10.0
     hooks:
       - id: ansible-lint
         additional_dependencies:

From cca133a2710c5ed99e4c0ce3d06a57ec118bcf13 Mon Sep 17 00:00:00 2001
From: Jeremy Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Wed, 13 Nov 2024 21:33:32 -0500
Subject: [PATCH 48/52] Adjust pin for ansible-core

The pin of ansible-core was originally put in place because the
pip-audit pre-commit hook identifies a vulnerability in ansible-core
2.16.13.  Normally we would pin ansible-core to >2.16.13, but in the
spirit of the earlier, optional pin of ansible>=10 we pin ansible-core
to >=2.17.  This effectively also pins ansible to >=10.

Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>
---
 .pre-commit-config.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 8b402fb9..b61a8f54 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -189,12 +189,14 @@ repos:
           # install those versions.
           #
           # Note that the pip-audit pre-commit hook identifies a
-          # vulnerability in ansible-core 2.16.13.
+          # vulnerability in ansible-core 2.16.13.  The pin of
+          # ansible-core to >=2.17 effectively also pins ansible to
+          # >=10.
           #
           # Note that any changes made to this dependency must also be
           # made in requirements.txt in cisagov/skeleton-packer and
           # requirements-test.txt in cisagov/skeleton-ansible-role.
-          - ansible-core>2.16.13
+          - ansible-core>=2.17
 
   # Terraform hooks
   - repo: https://github.com/antonbabenko/pre-commit-terraform

From a00c336b5f533326f97288784423db9275f2f590 Mon Sep 17 00:00:00 2001
From: Jeremy Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Wed, 13 Nov 2024 21:41:45 -0500
Subject: [PATCH 49/52] Upgrade pin for ansible-core

The pin of ansible-core was originally put in place because the
pip-audit pre-commit hook identifies a vulnerability in ansible-core
2.16.13.  Normally we would pin ansible-core accordingly (>2.16.13),
but the earlier pin of ansible>=10 effectively pins ansible-core to
>=2.17 so that's what do.

Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>
---
 requirements.txt | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/requirements.txt b/requirements.txt
index 0f38eb1e..8d6bd0fd 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -23,12 +23,14 @@ ansible>=10,<11
 # Hence we never want to install those versions.
 #
 # Note that the pip-audit pre-commit hook identifies a vulnerability
-# in ansible-core 2.16.13.
+# in ansible-core 2.16.13.  Normally we would pin ansible-core
+# accordingly (>2.16.13), but the above pin of ansible>=10 effectively
+# pins ansible-core to >=2.17 anyway so that's what we use.
 #
 # Note that any changes made to this dependency must also be made in
 # requirements-test.txt in cisagov/skeleton-ansible-role and
 # .pre-commit-config.yaml in cisagov/skeleton-generic.
-ansible-core>2.16.13
+ansible-core>=2.17
 boto3
 docopt
 semver

From b2020a838ac8851c40d8aba74af0bf2e6691d89b Mon Sep 17 00:00:00 2001
From: Jeremy Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Mon, 18 Nov 2024 16:05:09 -0500
Subject: [PATCH 50/52] Ignore a particular ansible-core vulnerability

This is being done only temporarily, and only because there is no
recent version of ansible-core that does not exhibit the
vulnerability.  Without this change we get a failure from the
pip-audit pre-commit hook that we cannot do anything about.

See cisagov/skeleton-packer#380 for more details.
---
 .pre-commit-config.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index c4c8bf95..a4686f32 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -161,6 +161,11 @@ repos:
     hooks:
       - id: pip-audit
         args:
+          # We have to ignore this particular vulnerability in
+          # ansible-core>=2.11 as there is currently no fix.  See
+          # cisagov/skeleton-packer#380 for more details.
+          - --ignore-vuln
+          - GHSA-99w6-3xph-cx78
           # Add any pip requirements files to scan
           - --requirement
           - requirements-dev.txt

From bd852610595fdd2eee77f489d4b184f88d90643b Mon Sep 17 00:00:00 2001
From: Jeremy Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Wed, 20 Nov 2024 12:21:14 -0500
Subject: [PATCH 51/52] Add comments about looming EOL issues for ansible and
 ansible-core

This adds even more evidence for why it is a good idea to go ahead and
upgrade ansible and ansible-core, in addition to the vulnerability
that pip-audit turned up.

Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>
---
 .pre-commit-config.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index b61a8f54..97fbf1ce 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -181,6 +181,10 @@ repos:
           # hook identifies a vulnerability in ansible-core 2.16.13,
           # but all versions of ansible 9 have a dependency on
           # ~=2.16.X.
+          #
+          # It is also a good idea to go ahead and upgrade to version
+          # 10 since version 9 is going EOL at the end of November:
+          # https://endoflife.date/ansible
           # - ansible>=10,<11
           # ansible-core 2.16.3 through 2.16.6 suffer from the bug
           # discussed in ansible/ansible#82702, which breaks any
@@ -193,6 +197,11 @@ repos:
           # ansible-core to >=2.17 effectively also pins ansible to
           # >=10.
           #
+          # It is also a good idea to go ahead and upgrade to
+          # ansible-core 2.17 since security support for ansible-core
+          # 2.16 ends this month:
+          # https://docs.ansible.com/ansible/devel/reference_appendices/release_and_maintenance.html#ansible-core-support-matrix
+          #
           # Note that any changes made to this dependency must also be
           # made in requirements.txt in cisagov/skeleton-packer and
           # requirements-test.txt in cisagov/skeleton-ansible-role.

From d077b675429cda3a937a7bcac24abffff19665a5 Mon Sep 17 00:00:00 2001
From: Jeremy Frasier <jeremy.frasier@gwe.cisa.dhs.gov>
Date: Wed, 20 Nov 2024 12:50:05 -0500
Subject: [PATCH 52/52] Add comments about looming EOL issues for ansible and
 ansible-core

This adds even more evidence for why it is a good idea to go ahead and
upgrade ansible and ansible-core, in addition to the vulnerability
that pip-audit turned up.

Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>
---
 requirements.txt | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/requirements.txt b/requirements.txt
index 8d6bd0fd..5d2d6073 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -12,6 +12,10 @@
 # identifies a vulnerability in ansible-core 2.16.13, but all versions
 # of ansible 9 have a dependency on ~=2.16.X.
 #
+# It is also a good idea to go ahead and upgrade to version 10 since
+# version 9 is going EOL at the end of November:
+# https://endoflife.date/ansible
+#
 # We have tested against version 10.  We want to avoid automatically
 # jumping to another major version without testing, since there are
 # often breaking changes across major versions.  This is the reason
@@ -27,6 +31,10 @@ ansible>=10,<11
 # accordingly (>2.16.13), but the above pin of ansible>=10 effectively
 # pins ansible-core to >=2.17 anyway so that's what we use.
 #
+# It is also a good idea to go ahead and upgrade to ansible-core 2.17
+# since security support for ansible-core 2.16 ends this month:
+# https://docs.ansible.com/ansible/devel/reference_appendices/release_and_maintenance.html#ansible-core-support-matrix
+#
 # Note that any changes made to this dependency must also be made in
 # requirements-test.txt in cisagov/skeleton-ansible-role and
 # .pre-commit-config.yaml in cisagov/skeleton-generic.