diff --git a/.github/auto-labeler-config.yaml b/.github/auto-labeler-config.yaml new file mode 100644 index 00000000..89be0327 --- /dev/null +++ b/.github/auto-labeler-config.yaml @@ -0,0 +1,23 @@ +--- +conventional-commits: +- type: 'fix' + nouns: ['FIX', 'Fix', 'fix', 'FIXED', 'Fixed', 'fixed'] + labels: ['bug'] +- type: 'feature' + nouns: ['FEATURE', 'Feature', 'feature', 'FEAT', 'Feat', 'feat'] + labels: ['enhancement'] +- type: 'breaking_change' + nouns: ['BREAKING CHANGE', 'BREAKING', 'MAJOR'] + labels: ['breaking-change'] +- type: 'refactor' + nouns: ['refactor', 'Refactor'] + labels: ['refactor'] +- type: 'documentation' + nouns: ['docs', 'doc', 'document', 'documentation'] + labels: ['documentation'] +- type: 'build' + nouns: ['build', 'rebuild'] + labels: ['build'] +- type: 'config' + nouns: ['config', 'conf', 'configuration', 'configure'] + labels: ['config'] diff --git a/.github/linters/.checkov.yaml b/.github/linters/.checkov.yaml new file mode 100644 index 00000000..0b86e0d1 --- /dev/null +++ b/.github/linters/.checkov.yaml @@ -0,0 +1,22 @@ +--- + +quiet: true + +skip-check: +# https://www.checkov.io/5.Policy%20Index/kubernetes.html +- CKV_K8S_15 # Image Pull Policy should be Always +- CKV_K8S_21 # The default namespace should not be used +- CKV_K8S_22 # Use read-only filesystem for containers where possible +- CKV_K8S_35 # Prefer using secrets as files over secrets as environment variables +- CKV_K8S_38 # Ensure that Service Account Tokens are only mounted where necessary +- CKV_K8S_40 # Containers should run as a high UID to avoid host conflict +- CKV_K8S_43 # Image should use digest +- CKV2_K8S_5 # No ServiceAccount/Node should be able to read all secrets +- CKV2_K8S_6 # Minimize the admission of pods which lack an associated NetworkPolicy +# https://www.checkov.io/5.Policy%20Index/dockerfile.html +- CKV_DOCKER_2 # Ensure that HEALTHCHECK instructions have been added to container images +# https://www.checkov.io/5.Policy%20Index/secrets.html +- CKV_SECRET_6 # Base64 High Entropy String +# https://www.checkov.io/5.Policy%20Index/github_actions.html +- CKV2_GHA_1 # Ensure top-level permissions are not set to write-all +- CKV_GHA_7 # The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. diff --git a/.github/linters/.eslintrc.yml b/.github/linters/.eslintrc.yml new file mode 100644 index 00000000..6f2987b0 --- /dev/null +++ b/.github/linters/.eslintrc.yml @@ -0,0 +1,17 @@ +--- +env: + es6: true + +extends: +- "eslint:recommended" + +parser: "@typescript-eslint/parser" + +plugins: +- "@typescript-eslint" + +rules: + no-undef: 'warn' + +globals: + module: "writable" diff --git a/.github/linters/.flake8 b/.github/linters/.flake8 new file mode 100644 index 00000000..6deafc26 --- /dev/null +++ b/.github/linters/.flake8 @@ -0,0 +1,2 @@ +[flake8] +max-line-length = 120 diff --git a/.github/linters/.golangci.yml b/.github/linters/.golangci.yml new file mode 100644 index 00000000..32c844b7 --- /dev/null +++ b/.github/linters/.golangci.yml @@ -0,0 +1,2 @@ +run: + timeout: 10m diff --git a/.github/linters/.jscpd.json b/.github/linters/.jscpd.json new file mode 100644 index 00000000..2ccd8d44 --- /dev/null +++ b/.github/linters/.jscpd.json @@ -0,0 +1,9 @@ +{ + "threshold": 2, + "ignore": [ + "**/.git/**", + "**/charts/*/templates/*/*.yaml", + "**/charts/*/templates/*/*/*.yaml", + "**/docs/examples/**" + ] +} diff --git a/.github/linters/.yaml-lint.yml b/.github/linters/.yaml-lint.yml new file mode 100644 index 00000000..57b64797 --- /dev/null +++ b/.github/linters/.yaml-lint.yml @@ -0,0 +1,66 @@ +--- +#### Config file for yamllint +# Rules: https://yamllint.readthedocs.io/en/stable/rules.html + +# Exclude not required files +# ignore-from-file: +# - .gitignore +# - .yamlignore + +rules: + braces: + min-spaces-inside: 1 + max-spaces-inside: 1 + min-spaces-inside-empty: 0 + max-spaces-inside-empty: 0 + brackets: + min-spaces-inside: 0 + max-spaces-inside: 1 + min-spaces-inside-empty: -1 + max-spaces-inside-empty: -1 + colons: + max-spaces-before: 0 + max-spaces-after: -1 + commas: + max-spaces-before: 0 + min-spaces-after: 1 + max-spaces-after: 1 + comments: + level: warning + require-starting-space: true + min-spaces-from-content: 1 + comments-indentation: + level: warning + document-end: disable + document-start: disable + # level: warning + # present: false + empty-lines: + level: warning + max: 2 + max-start: 0 + max-end: 2 + empty-values: + forbid-in-block-mappings: true + forbid-in-flow-mappings: true + hyphens: + max-spaces-after: 1 + indentation: + level: warning + spaces: 2 + indent-sequences: true + check-multi-line-strings: false + key-duplicates: enable + key-ordering: disable + line-length: disable + # max: 100 + # allow-non-breakable-words: true + # allow-non-breakable-inline-mappings: true + new-line-at-end-of-file: disable + new-lines: + type: unix + octal-values: + forbid-implicit-octal: false + forbid-explicit-octal: false + trailing-spaces: enable + truthy: disable diff --git a/.github/linters/actionlint.yml b/.github/linters/actionlint.yml new file mode 100644 index 00000000..5e04acc8 --- /dev/null +++ b/.github/linters/actionlint.yml @@ -0,0 +1,5 @@ +paths: + .github/workflows/**/*.{yml,yaml}: + ignore: + - 'shellcheck reported issue in this script: SC2086:info.+' + - 'shellcheck reported issue in this script: SC2002:style.+' diff --git a/.github/linters/checkstyle.xml b/.github/linters/checkstyle.xml new file mode 100644 index 00000000..a6f3b19e --- /dev/null +++ b/.github/linters/checkstyle.xml @@ -0,0 +1,311 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/.github/release-drafter-config.yml b/.github/release-drafter-config.yml new file mode 100644 index 00000000..bfd08d2f --- /dev/null +++ b/.github/release-drafter-config.yml @@ -0,0 +1,50 @@ +name-template: 'v$RESOLVED_VERSION' +tag-template: 'v$RESOLVED_VERSION' + + +categories: +- title: '💥 Breaking Changes' + labels: + - breaking-change +- title: '💡 New Features' + labels: + - feature + - enhancement +- title: '🐞 Bug Fixes' + labels: + - bug + - fix + - bugfix +- title: '⚙️ Technical Debt' + labels: + - refactor +- title: '📝 Documentation' + labels: + - documentation + +change-template: | + - (#$NUMBER) $TITLE by @$AUTHOR + +no-changes-template: 'No significant changes' + +template: | + ## 🚀 Release + + ### What's Changed + $CHANGES + + --- + + **Full Changelog**: https://github.com/$OWNER/$REPOSITORY/compare/$PREVIOUS_TAG...v$RESOLVED_VERSION + +version-resolver: + major: + labels: + - major + minor: + labels: + - minor + patch: + labels: + - patch + default: patch diff --git a/.github/super-linter.env b/.github/super-linter.env new file mode 100644 index 00000000..427ac01b --- /dev/null +++ b/.github/super-linter.env @@ -0,0 +1,22 @@ +# File will be loaded as environment variables +# It must contain strings like: +# name=value + +GITLEAKS_LOG_LEVEL=warn +VALIDATE_JAVASCRIPT_PRETTIER=false +VALIDATE_JAVASCRIPT_STANDARD=false +VALIDATE_JSCPD=false +VALIDATE_JSON_PRETTIER=false +VALIDATE_KUBERNETES_KUBECONFORM=false +VALIDATE_MARKDOWN_PRETTIER=false +VALIDATE_YAML=false +VALIDATE_YAML_PRETTIER=false + +# TODO: fix python files and enable the check again +VALIDATE_PYTHON_BLACK=false +VALIDATE_PYTHON_FLAKE8=false +VALIDATE_PYTHON_MYPY=false +VALIDATE_PYTHON_PYINK=false +VALIDATE_PYTHON_PYLINT=false + +VALIDATE_GO=false diff --git a/.github/workflows/automatic-pr-labeler.yaml b/.github/workflows/automatic-pr-labeler.yaml new file mode 100644 index 00000000..36d9ba27 --- /dev/null +++ b/.github/workflows/automatic-pr-labeler.yaml @@ -0,0 +1,45 @@ +--- + +# The workflow template for automatic PR labeler. +# It requires to have a configuration file with labels and conditions to apply them. +# The configuration file should be placed in the .github folder and named auto-labeler-config.yaml. +# Example file can be found there: +# https://github.com/Netcracker/.github/blob/main/config/examples/auto-labeler-config.yaml + +name: Automatic PR Labeler + +on: + pull_request: + branches: [main] + types: + [opened, reopened, synchronize] + +permissions: + pull-requests: write + contents: read + issues: write + +jobs: + assign-labels: + if: github.event.pull_request.merged == false + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: "Execute assign labels" + id: action-assign-labels + uses: mauroalderete/action-assign-labels@v1 + with: + pull-request-number: ${{ github.event.pull_request.number }} + github-token: ${{ github.token }} + conventional-commits: "./.github/auto-labeler-config.yaml" + maintain-labels-not-matched: true + apply-changes: ${{ github.event.pull_request.base.repo.id == github.event.pull_request.head.repo.id }} + - name: "Drop warning if PR from fork" + if: ${{ github.event.pull_request.base.repo.id != github.event.pull_request.head.repo.id }} + run: | + { + echo "⚠️ Pull request from fork! ⚠️"; + echo "Labels will not be applied to PR. Assign them manually please."; + echo "Labels to assign: ${{ steps.action-assign-labels.outputs.labels-next }}"; + } >> $GITHUB_STEP_SUMMARY diff --git a/.github/workflows/cla.yaml b/.github/workflows/cla.yaml new file mode 100644 index 00000000..e4947233 --- /dev/null +++ b/.github/workflows/cla.yaml @@ -0,0 +1,19 @@ +--- +name: CLA Assistant +on: + issue_comment: + types: [created] + pull_request_target: + types: [opened, closed, synchronize] + +permissions: + actions: write + contents: read + pull-requests: write + statuses: write + +jobs: + cla_assistant: + uses: Netcracker/qubership-workflow-hub/.github/workflows/cla.yaml@main + secrets: + personal_access_token: ${{ secrets.CLA_ACCESS_TOKEN }} diff --git a/.github/workflows/pr-conventional-commits.yaml b/.github/workflows/pr-conventional-commits.yaml new file mode 100644 index 00000000..1177d012 --- /dev/null +++ b/.github/workflows/pr-conventional-commits.yaml @@ -0,0 +1,21 @@ +--- + +name: Conventional Commits PR Check + +on: + pull_request: + types: + - opened + - edited + - synchronize + +permissions: + pull-requests: read +jobs: + build: + name: Conventional Commits + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - uses: webiny/action-conventional-commits@v1.3.0 diff --git a/.github/workflows/pr-lint-title.yaml b/.github/workflows/pr-lint-title.yaml new file mode 100644 index 00000000..b5a54af5 --- /dev/null +++ b/.github/workflows/pr-lint-title.yaml @@ -0,0 +1,21 @@ +--- + +name: "Lint PR Title" + +on: + pull_request: + types: + - opened + - edited + +permissions: + pull-requests: read + +jobs: + main: + name: Validate PR title + runs-on: ubuntu-latest + steps: + - uses: amannn/action-semantic-pull-request@v5 + env: + GITHUB_TOKEN: ${{ github.token }} diff --git a/.github/workflows/profanity-filter.yaml b/.github/workflows/profanity-filter.yaml new file mode 100644 index 00000000..b8ab7782 --- /dev/null +++ b/.github/workflows/profanity-filter.yaml @@ -0,0 +1,27 @@ +--- +name: Profanity filter + +on: + issue_comment: + types: [created, edited] + issues: + types: [opened, edited, reopened] + pull_request: + types: [opened, edited, reopened] + +permissions: + issues: write + pull-requests: write + +jobs: + call-apply-filter: + if: ${{ github.event_name == 'issue_comment' || github.event_name == 'issues' || (github.event_name == 'pull_request' && github.event.pull_request.base.repo.id == github.event.pull_request.head.repo.id) }} + uses: Netcracker/qubership-workflow-hub/.github/workflows/profanityFilter.yaml@main + warning: + runs-on: ubuntu-latest + if: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.repo.id != github.event.pull_request.head.repo.id }} + steps: + - name: "Warning" + run: | + echo "⚠️ Pull request from fork! ⚠️" >> $GITHUB_STEP_SUMMARY + echo "The action cannot be run over PRs from fork." >> $GITHUB_STEP_SUMMARY diff --git a/.github/workflows/super-linter.yaml b/.github/workflows/super-linter.yaml new file mode 100644 index 00000000..da308b2c --- /dev/null +++ b/.github/workflows/super-linter.yaml @@ -0,0 +1,53 @@ +--- +# This workflow executes several linters on changed files based on languages used in your code base whenever +# you push a code or open a pull request. +# +# You can adjust the behavior by modifying this file. +# For more information, see: +# https://github.com/super-linter/super-linter +# Configuration file for super-linter example: +# .github/super-linter.env +# Configuration files for individual linters should be placed in .github/linters + +name: Lint Code Base + +on: + push: + branches: + - '**' + pull_request: + branches: + - '**' + workflow_dispatch: + inputs: + full_scan: + type: boolean + default: false + required: false + description: "Lint all codebase" +permissions: + contents: read + +jobs: + run-lint: + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + with: + # Full git history is needed to get a proper list of changed files within `super-linter` + fetch-depth: 0 + + - name: "Load super-linter environment file" + run: | + # shellcheck disable=2086 + if [ -f "./.github/super-linter.env" ]; then + grep "\S" ./.github/super-linter.env | grep -v "^#" + grep "\S" ./.github/super-linter.env | grep -v "^#" >> $GITHUB_ENV + fi + + - name: Lint Code Base + uses: super-linter/super-linter@v7 + env: + VALIDATE_ALL_CODEBASE: ${{ inputs.full_scan || false }} + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/charts/patroni-core/templates/deployment.yaml b/charts/patroni-core/templates/deployment.yaml index 9969159c..4a127e98 100644 --- a/charts/patroni-core/templates/deployment.yaml +++ b/charts/patroni-core/templates/deployment.yaml @@ -2,6 +2,9 @@ apiVersion: apps/v1 kind: Deployment metadata: name: patroni-core-operator + annotations: + checkov.io/skip1: CKV_K8S_8=Liveness probe is not required + checkov.io/skip2: CKV_K8S_9=Readiness probe is not required spec: replicas: 1 strategy: @@ -115,7 +118,7 @@ spec: imagePullSecrets: {{- range $i, $v := .Values.privateRegistry.secrets }} - name: {{ $v.name }} - {{- end }} + {{- end }} {{- end }} {{ if .Values.externalDataBase }} {{ if eq (lower .Values.externalDataBase.type) "cloudsql"}} diff --git a/charts/patroni-services/templates/deployment.yaml b/charts/patroni-services/templates/deployment.yaml index 801d1c56..546df8fe 100644 --- a/charts/patroni-services/templates/deployment.yaml +++ b/charts/patroni-services/templates/deployment.yaml @@ -2,6 +2,9 @@ apiVersion: apps/v1 kind: Deployment metadata: name: postgres-operator + annotations: + checkov.io/skip1: CKV_K8S_8=Liveness probe is not required + checkov.io/skip2: CKV_K8S_9=Readiness probe is not required spec: replicas: 1 selector: @@ -127,7 +130,7 @@ spec: imagePullSecrets: {{- range $i, $v := .Values.privateRegistry.secrets }} - name: {{ $v.name }} - {{- end }} + {{- end }} {{- end }} volumes: {{ if .Values.externalDataBase }} diff --git a/docker-transfer/Dockerfile b/docker-transfer/Dockerfile index 4569cbd4..a5f00d71 100644 --- a/docker-transfer/Dockerfile +++ b/docker-transfer/Dockerfile @@ -1,3 +1,4 @@ +#checkov:skip=CKV_DOCKER_3:User is not required for transfer container FROM scratch # Transfer