chore(container): update quay.io/redlib/redlib:latest docker digest ( aa65609 → 2cbe7ad ) #1845
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Check Code health | |
| on: | |
| push: | |
| # paths: | |
| # - ansible/** | |
| # branches: | |
| # - main | |
| pull_request: | |
| types: [opened, reopened, edited] | |
| branches-ignore: | |
| - renovate/* | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| meta: | |
| name: Create meta object | |
| runs-on: ubuntu-latest | |
| permissions: read-all | |
| outputs: | |
| check_files: ${{ steps.vars.outputs.check_files }} | |
| steps: | |
| - uses: actions/checkout@v4.1.7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Get changed files | |
| id: changed-files | |
| # kics-scan ignore-line | |
| uses: tj-actions/changed-files@v44.5.5 | |
| with: | |
| files_ignore_separator: "," | |
| - name: Create Meta variables | |
| id: vars | |
| run: | | |
| if [[ ${GITHUB_REF//refs\/heads\//} =~ ^renovate/.* ]]; then | |
| echo "check_files=${{ steps.changed-files.outputs.all_changed_files }}" >> $GITHUB_OUTPUT | |
| else | |
| echo "check_files=." >> $GITHUB_OUTPUT | |
| fi | |
| yaml: | |
| name: Check YAML files | |
| runs-on: ubuntu-latest | |
| needs: [meta] | |
| steps: | |
| - uses: actions/checkout@v4.1.7 | |
| - uses: actions/cache@v4 | |
| with: | |
| path: ~/.cache/pip | |
| key: ${{ runner.os }}-pip-${{ hashFiles('ansible/requirements.txt') }} | |
| restore-keys: | | |
| ${{ runner.os }}-pip-yamllint | |
| - name: Set up Python | |
| uses: actions/setup-python@v5.1.0 | |
| with: | |
| python-version: 3.11 | |
| - name: Install linters | |
| working-directory: ansible/ | |
| run: | | |
| pip install $(grep wheel requirements.txt) | |
| pip install $(grep yamllint requirements.txt) | |
| - name: Lint YAML files | |
| run: yamllint ${{ needs.meta.outputs.check_files }} | |
| kics: | |
| name: Run kics | |
| runs-on: ubuntu-latest | |
| if: github.ref == 'refs/heads/main' | |
| permissions: | |
| checks: write | |
| contents: read | |
| security-events: write | |
| statuses: write | |
| needs: [yaml, meta] | |
| steps: | |
| - uses: actions/checkout@v4.1.7 | |
| - name: Run kics Scan | |
| uses: Checkmarx/kics-github-action@252e73959bd4809a14863cbfbb42d7a90d5a4860 | |
| with: | |
| path: ${{ needs.meta.outputs.check_files }} | |
| config_path: .kics/config.yml | |
| ignore_on_exit: results | |
| output_formats: sarif | |
| - name: Upload SARIF file | |
| uses: github/codeql-action/upload-sarif@7adf9ac915317792cbeaf8d9c9fa80f2dbacfd48 | |
| with: | |
| sarif_file: results.sarif | |
| category: kics | |
| ansible-lint: | |
| name: Run Ansible Lint | |
| runs-on: ubuntu-latest | |
| if: github.ref == 'refs/heads/main' | |
| permissions: | |
| checks: write | |
| contents: read | |
| security-events: write | |
| statuses: write | |
| needs: [yaml, meta] | |
| steps: | |
| - uses: actions/checkout@v4.1.7 | |
| - uses: actions/cache@v4 | |
| with: | |
| path: ~/.cache/pip | |
| key: ${{ runner.os }}-pip-${{ hashFiles('ansible/requirements.txt') }} | |
| restore-keys: | | |
| ${{ runner.os }}-pip-ansible | |
| - uses: actions/cache@v4 | |
| with: | |
| path: ~/.cache/ansible-compat | |
| key: ${{ runner.os }}-pip-${{ hashFiles('ansible/requirements.yml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-galaxy | |
| - name: Install Ansible-lint | |
| working-directory: ansible/ | |
| run: | | |
| pip install $(grep wheel requirements.txt) | |
| pip install $(grep ansible requirements.txt) | |
| pip install $(grep ansible-lint requirements.txt) | |
| sed -i 's/vault_password_file/#vault_password_file/g' ansible.cfg | |
| - name: Run Ansible-Lint | |
| working-directory: ansible/ | |
| run: ansible-lint -p --nocolor --sarif-file ../ansible.sarif || true | |
| - name: Upload SARIF file | |
| if: "!cancelled()" | |
| uses: github/codeql-action/upload-sarif@7adf9ac915317792cbeaf8d9c9fa80f2dbacfd48 | |
| with: | |
| checkout_path: ${{ github.workspace }}/ansible | |
| sarif_file: ansible.sarif | |
| category: ansible |