Skip to content

⚠️ CONFLICT! Lineage pull request for: skeleton#81

Merged
jsf9k merged 43 commits intodevelopfrom
lineage/skeleton
Apr 3, 2025
Merged

⚠️ CONFLICT! Lineage pull request for: skeleton#81
jsf9k merged 43 commits intodevelopfrom
lineage/skeleton

Conversation

@cisagovbot
Copy link

@cisagovbot cisagovbot commented Mar 28, 2025

Lineage Pull Request: CONFLICT

Achtung!!!

Lineage has created this pull request to incorporate new changes found in an
upstream repository:

Upstream repository: https://github.com/cisagov/skeleton-generic.git
Remote branch: HEAD

Check the changes in this pull request to ensure they won't cause issues with
your project.

The lineage/skeleton branch has one or more unresolved merge conflicts
that you must resolve before merging this pull request!

How to resolve the conflicts

  1. Take ownership of this pull request by removing any other assignees.

  2. Clone the repository locally, and reapply the merge:

    git clone git@github.com:cisagov/setup-env-github-action.git setup-env-github-action
    cd setup-env-github-action
    git remote add skeleton https://github.com/cisagov/skeleton-generic.git
    git remote set-url --push skeleton no_push
    git switch develop
    git switch --create lineage/skeleton --track origin/develop
    git pull skeleton HEAD
    git status
  3. Review the changes displayed by the status command. Fix any conflicts and
    possibly incorrect auto-merges.

  4. After resolving each of the conflicts, add your changes to the
    branch, commit, and push your changes:

    git add .github/dependabot.yml 
    git commit
    git push --force --set-upstream origin lineage/skeleton

    Note that you may append to the default merge commit message
    that git creates for you, but please do not delete the existing
    content
    . It provides useful information about the merge that is
    being performed.

  5. Wait for all the automated tests to pass.

  6. Confirm each item in the "Pre-approval checklist" below.

  7. Remove any of the checklist items that do not apply.

  8. Ensure every remaining checkbox has been checked.

  9. Mark this draft pull request "Ready for review".

✅ Pre-approval checklist

  • ✌️ The conflicts in this pull request have been resolved.
  • All relevant type-of-change labels have been added.
  • All new and existing tests pass.

Note

You are seeing this because one of this repository's maintainers has
configured Lineage to open pull requests.

For more information:

🛠 Lineage configurations for this project are stored in .github/lineage.yml

📚 Read more about Lineage

jsf9k and others added 30 commits November 20, 2024 14:40
Use a specific number of spaces instead of the default of only caring
if the number of spaces used is consistent within a file. Ensure that
block sequences inside of mappings are indented.
The use of flow sequences and mappings is not as readable as block
collections and so should be discouraged. Since it is a cleaner
representation for empty collections we will allow those, but if an
application otherwise requires flow collections they can be explicitly
enabled by disabling the checks per
https://yamllint.readthedocs.io/en/stable/disable_with_comments.html
When running ansible-lint it will throw the following warning with our
current configuration:
WARNING  Found incompatible custom yamllint configuration (.yamllint), please either remove the file or edit it to comply with:
  - comments.min-spaces-from-content must be 1
  - braces.max-spaces-inside must be 1
  - octal-values.forbid-implicit-octal must be true
  - octal-values.forbid-explicit-octal must be true.
Thus we implement these configuration rules.
Previously we disabled the `truthy` rule due to Ansible's use of
`yes`/`no` for boolean values. That is no longer the case and the
default configuration used by ansible-lint now has this rule enabled.
The use of `on` as a key in GitHub Actions workflow syntax means we
needed to add disable-line comments for the truthy rule.
Add a configuration for the `quoted-strings` rule that matches our best
practices. Other files are updated to comply with these new settings.
Also add semver as a dev requirement.

I'd like to start versioning descendants of skeleton-ansible-role (in
anticipation of pinning Ansible role versions at a future date), and I
thought it would make sense to go ahead and implement this at the
skeleton-generic level to force us to start versioning all
repositories.

Repositories that already version can ignore these changes when they
flow down via Lineage, since they will already have their own version
files and version-bumping script.
This is done automatically with the `pre-commit autoupdate` command.
This new action simply applies our standard permissions monitoring and
runner hardening.  Using it allows us to DRY out the GH Actions
workflows in our skeleton repositories a bit.
Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>
GitHubSecurityLab/actions-permissions and step-security/harden-runner
are no longer direct dependencies since we are now using
cisagov/action-job-preamble.

Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>
Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>
Flesh out the comment a little so its meaning is clearer.

Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>
Make sure to mention that the permissions monitoring config can be
changed by creating a repo-level variable; there is no need to modify
the workflow.

Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>
…preamble

This action supports this functionality now, so we may as well take
advantage of it.

Also disable GH permissions monitoring, since that functionality is
poorly implemented and has been causing a lot of problems due to the
MITM implementation hogging or leaking memory.
Apply our standard job preamble via cisagov/action-job-preamble
CodeQL now supports GitHub Actions as a language, so it makes sense to
add such a workflow to this repository.

See this link for more details:
https://github.blog/changelog/2024-12-17-find-and-fix-actions-workflows-vulnerabilities-with-codeql-public-preview/
Also correctly sort YAML keys.

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>
This aligns with the changes in cisagov/skeleton-generic#201.

Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>
Children of this skeleton repository will require this Dependabot
ignore directive.
Use cisagov/action-job-preamble instead of
crazy-max/ghaction-github-status and crazy-max/ghaction-dump-context
directly.
This action reviews dependency changes for vulnerabilities and license
changes.
This aligns with the changes in cisagov/skeleton-generic#201.

Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>
@jsf9k jsf9k unassigned dav3r and mcdonnnj Apr 1, 2025
@jsf9k jsf9k added dependencies Pull requests that update a dependency file github-actions Pull requests that update GitHub Actions code security This issue or pull request addresses a security issue labels Apr 1, 2025
@jsf9k jsf9k force-pushed the lineage/skeleton branch from eba1f87 to dedd185 Compare April 1, 2025 15:05
@mcdonnnj
Copy link
Member

mcdonnnj commented Apr 1, 2025

Please note that the version is, in an unfriendly way, tracked here:

"version": "1.0.0"

Also remove the unnecessary version.txt file.

This is necessary because this project tracks the version in the
package.json file.
@jsf9k
Copy link
Member

jsf9k commented Apr 1, 2025

Please note that the version is, in an unfriendly way, tracked here:

"version": "1.0.0"

Please see commit 04294e4. I tested these changes by bumping the patch version locally, then git rebaseing to remove that commit before pushing.

@jsf9k jsf9k marked this pull request as ready for review April 1, 2025 16:18
@jsf9k jsf9k requested a review from a team April 1, 2025 16:18
Copy link
Member

@mcdonnnj mcdonnnj left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM ✔️ I do have one small change I would like to see if it's not too much of a lift.

Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>
Copy link
Member

@mcdonnnj mcdonnnj left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm having some issues with bump-version. I do not see the version when I run ./bump-version show and the sed command in use does not appear to work with the version of sed that ships with macOS:

$ ./bump-version show

$ sed -n "s/^[[:space:]]*\"version\": \"\(.*\)\",\?$/\1/p" package.json
1.0.0
$ /usr/bin/sed -n "s/^[[:space:]]*\"version\": \"\(.*\)\",\?$/\1/p" package.json

After adding set -x to bump-version I see the following:

$ ./bump-version show
+ VERSION_FILE=package.json
+ VERSION_FILES=("$VERSION_FILE")
++ cat
+ USAGE='Update the version of the project.

Usage:
  bump-version [--push] [--label LABEL] (major | minor | patch | prerelease | build | finalize | show)
  bump-version --list-files
  bump-version (-h | --help)

Options:
  -h | --help    Show this message.
  --push         Perform a `git push` after updating the version.
  --label LABEL  Specify the label to use when updating the build or prerelease version.
  --list-files   List the files that will be updated when the version is bumped.'
++ sed -n 's/^[[:space:]]*"version": "\(.*\)",\?$/\1/p' package.json
+ old_version=
+ old_version_regex='^\([[:space:]]*"version": \)""'
+ new_version=
+ bump_part=
+ label=
+ commit_prefix=Bump
+ with_push=false
+ commands_with_label=("build" "prerelease")
+ commands_with_prerelease=("major" "minor" "patch")
+ with_prerelease=false
+ '[' 1 -eq 0 ']'
+ '[' 1 -gt 0 ']'
+ case $1 in
+ echo ''

+ exit 0

@jsf9k
Copy link
Member

jsf9k commented Apr 3, 2025

I'm having some issues with bump-version. I do not see the version when I run ./bump-version show and the sed command in use does not appear to work with the version of sed that ships with macOS:

bump-version show and bump-version patch both work with GNU sed. Could the problem be the use of the [:space:] character class? Could you try this command using the macOS/BSD version of sed?

$ sed -n "s/^\s*\"version\": \"\(.*\)\",\?$/\1/p" package.json
1.0.0

@mcdonnnj
Copy link
Member

mcdonnnj commented Apr 3, 2025

I'm having some issues with bump-version. I do not see the version when I run ./bump-version show and the sed command in use does not appear to work with the version of sed that ships with macOS:

bump-version show and bump-version patch both work with GNU sed. Could the problem be the use of the [:space:] character class? Could you try this command using the macOS/BSD version of sed?

$ sed -n "s/^\s*\"version\": \"\(.*\)\",\?$/\1/p" package.json
1.0.0

I believe you're correct and the [:space:] character class is the issue. In my terminal I have sed aliased to gsed (GNU sed) so it works as expected when I try to run the command in my terminal. However, the script is using the BSD sed that macOS ships with which is why I am getting the results I see.

* The: macOS version of sed does not support the [:space:] character
class.
* The: macOS version of sed does not support the question mark in
regexes.

Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>
@jsf9k
Copy link
Member

jsf9k commented Apr 3, 2025

I'm having some issues with bump-version.

Please see commit b035dc2.

@jsf9k jsf9k requested a review from mcdonnnj April 3, 2025 13:52
Copy link
Member

@mcdonnnj mcdonnnj left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tested the updates to bump-version on my Mac and can confirm the script works as expected.

@jsf9k jsf9k merged commit 6233c62 into develop Apr 3, 2025
11 checks passed
@jsf9k jsf9k deleted the lineage/skeleton branch April 3, 2025 14:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github-actions Pull requests that update GitHub Actions code security This issue or pull request addresses a security issue upstream update This issue or pull request pulls in upstream updates

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants