Skip to content

Commit a14b5bb

Browse files
necipallefnecipallef
committed
chore: add semantic release, tflint, trivy
1 parent dbc1e04 commit a14b5bb

16 files changed

+267
-0
lines changed

‎.github/CODEOWNERS

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# Users referenced in this file will automatically be requested as reviewers for PRs that modify the given paths.
2+
# See https://help.github.com/articles/about-code-owners/
3+
4+
* @necipallef

‎.github/workflows/analyze-commits.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
name: Analyze Commit Messages
2+
on:
3+
pull_request:
4+
5+
permissions:
6+
pull-requests: write
7+
contents: write
8+
jobs:
9+
analyze-commits:
10+
name: Generate docs and coverage report
11+
uses: fingerprintjs/dx-team-toolkit/.github/workflows/analyze-commits.yml@v1

‎.github/workflows/coverage-diff.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
name: Check coverage for PR
2+
3+
on:
4+
pull_request:
5+
6+
jobs:
7+
run-tests-check-coverage:
8+
name: Run tests & check coverage
9+
permissions:
10+
checks: write
11+
pull-requests: write
12+
uses: fingerprintjs/dx-team-toolkit/.github/workflows/coverage-diff.yml@v1
13+
with:
14+
nodeVersion: 20

‎.github/workflows/coverage-report.yml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
name: Coverage
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
8+
jobs:
9+
generate-docs-and-coverage:
10+
name: Generate docs and coverage report
11+
uses: fingerprintjs/dx-team-toolkit/.github/workflows/docs-and-coverage.yml@v1
12+
with:
13+
skip-docs-step: true
14+
prepare-gh-pages-commands: |
15+
mv coverage/lcov-report/* ./gh-pages/

‎.github/workflows/coverage.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Generate docs and coverage report
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
8+
9+
jobs:
10+
generate-docs-and-coverage:
11+
name: Generate docs and coverage report
12+
uses: fingerprintjs/dx-team-toolkit/.github/workflows/docs-and-coverage.yml@v1
13+
with:
14+
skip-docs-step: true
15+
node-version: 20
16+
prepare-gh-pages-commands: |
17+
mv coverage/lcov-report ./gh-pages/coverage
18+

‎.github/workflows/release.yml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
name: release
2+
on:
3+
push:
4+
branches:
5+
- main
6+
- rc
7+
8+
jobs:
9+
build-and-release:
10+
name: 'Build project, run CI checks and publish new release'
11+
uses: fingerprintjs/dx-team-toolkit/.github/workflows/release-typescript-project.yml@v1
12+
with:
13+
nodeVersion: 20
14+
appId: ${{ vars.APP_ID }}
15+
secrets:
16+
APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}

‎.github/workflows/tflint.yml

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: TFlint
2+
3+
on:
4+
pull_request:
5+
types: [opened, synchronize]
6+
branches:
7+
- main
8+
- rc
9+
10+
jobs:
11+
tflint:
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- uses: actions/checkout@v4
16+
name: Checkout source code
17+
18+
- uses: terraform-linters/setup-tflint@v4
19+
name: Setup TFLint
20+
with:
21+
tflint_version: v0.50.3
22+
23+
- name: Show version
24+
run: tflint --version
25+
26+
- name: Init TFLint
27+
run: tflint --init
28+
env:
29+
# https://github.com/terraform-linters/tflint/blob/master/docs/user-guide/plugins.md#avoiding-rate-limiting
30+
# GITHUB_TOKEN: ${{ github.token }}
31+
32+
- name: Run TFLint
33+
run: tflint -f compact

‎.github/workflows/trivy.yml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Run Trivy
2+
3+
on:
4+
pull_request:
5+
types: [opened, synchronize]
6+
branches:
7+
- main
8+
- rc
9+
10+
jobs:
11+
build:
12+
name: Scan
13+
runs-on: ubuntu-20.04
14+
steps:
15+
- name: Checkout code
16+
uses: actions/checkout@v4
17+
18+
- name: Run Trivy vulnerability scanner in config mode
19+
uses: aquasecurity/trivy-action@master
20+
with:
21+
scan-type: 'config'
22+
exit-code: '1'
23+
trivy-config: trivy.yaml

‎.husky/commit-msg

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
#!/bin/sh
2+
. "$(dirname "$0")/_/husky.sh"
3+
4+
npx commitlint --edit $1

‎.husky/pre-commit

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
#!/bin/sh
2+
. "$(dirname "$0")/_/husky.sh"
3+
4+
npx lint-staged

‎.husky/pre-push

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#!/bin/bash
2+
. "$(dirname "$0")/_/husky.sh"
3+
4+
containsref() { if [[ $2 =~ $1 ]]; then echo 1; else echo 0; fi }
5+
6+
push_command=$(ps -ocommand= -p $PPID | cut -d' ' -f 4)
7+
protected_branch='main'
8+
current_branch=$(git symbolic-ref HEAD | sed -e 's,.*/\(.*\),\1,')
9+
is_push_to_main_origin=$(containsref '[email protected]:/?fingerprintjs/' "$push_command")
10+
11+
# Block pushes only to protected branch in main repository
12+
if [ $is_push_to_main_origin = 1 ] && [ "$protected_branch" = "$current_branch" ]; then
13+
echo "You are on the $protected_branch branch, push blocked."
14+
exit 1 # push will not execute
15+
fi

‎.releaserc

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"branches": [
3+
"main",
4+
{
5+
"name": "rc",
6+
"prerelease": true
7+
}
8+
],
9+
"plugins": [
10+
[
11+
"@semantic-release/commit-analyzer",
12+
{
13+
"config": "@fingerprintjs/conventional-changelog-dx-team",
14+
"releaseRules": "@fingerprintjs/conventional-changelog-dx-team/release-rules"
15+
}
16+
],
17+
[
18+
"@semantic-release/release-notes-generator",
19+
{
20+
"config": "@fingerprintjs/conventional-changelog-dx-team"
21+
}
22+
],
23+
"@semantic-release/changelog",
24+
[
25+
"@semantic-release/npm",
26+
{
27+
"npmPublish": false
28+
}
29+
],
30+
[
31+
"@semantic-release/exec",
32+
{
33+
"prepareCmd": "./scripts/preparePackage.sh"
34+
}
35+
],
36+
[
37+
"@semantic-release/git",
38+
{
39+
"message": "chore(release): ${nextRelease.version}\n\n${nextRelease.notes}",
40+
"assets": [
41+
"CHANGELOG.md"
42+
]
43+
}
44+
],
45+
[
46+
"@semantic-release/github",
47+
{
48+
"assets": [
49+
{
50+
"path": "package.zip"
51+
}
52+
]
53+
}
54+
]
55+
]
56+
}

‎.trivyignore

Whitespace-only changes.

‎CONTRIBUTING.md

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Contributing to Fingerprint Pro Cloudfront Integration Terraform Module
2+
3+
## Working with code
4+
5+
6+
For proposing changes, use the standard [pull request approach](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request). It's recommended to discuss fixes or new functionality in the Issues, first.
7+
8+
* The `main` and `rc` branches are locked for the push action.
9+
* Releases are created from the `main` branch. If you have CloudFront Integration set up, it is running code from the `main` branch. Pull requests into the `main` branch are not accepted.
10+
* The `rc` branch functions as a candidate for the next release. Create your pull requests into this branch. The code in `rc` must always pass the tests.
11+
12+
### Code style
13+
14+
Consistent code formatting is enforced by [TFLint](https://github.com/terraform-linters/tflint) and [Prettier](https://prettier.io/).
15+
16+
### Security scans
17+
18+
We are using [Trivy](https://aquasecurity.github.io/trivy/v0.47/tutorials/misconfiguration/terraform/) to do security scans for us.
19+
20+
### Commit style
21+
22+
You are required to follow [conventional commits](https://www.conventionalcommits.org) rules.
23+
24+
### How to test
25+
26+
We manually test the implementation. End-to-end will be provided in the future.
27+
28+
### How to release a new version
29+
30+
Every PR should target `rc` branch first. Upon merge, if there are relevant changes a new release candidate is created.
31+
When that happens, an automated PR is created to `main` branch, and E2E tests run against it. If the tests pass, the PR can be merged and the release is created.
32+
33+
The integration is automatically released on every push to the main branch if there are relevant changes. The workflow must be approved by one of the maintainers, first.
34+
35+
### How to keep your integration up-to-date
36+
37+
This Terraform module is in sync with Lambda function S3 bucket. Running `terraform apply` will deploy the latest version.

‎scripts/preparePackage.sh

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#!/bin/bash
2+
3+
zip package.zip main.tf outputs.tf variables.tf

‎trivy.yaml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
timeout: 10m
2+
format: table
3+
dependency-tree: true
4+
list-all-pkgs: true
5+
exit-code: 1
6+
severity:
7+
- HIGH
8+
- CRITICAL
9+
scan:
10+
11+
config:
12+
misconfig-scanners: Terraform
13+
14+
ignorefile: .trivyignore

0 commit comments

Comments
 (0)