Skip to content

Commit 9f78ea5

Browse files
justaugustusjustaugustus
authored
.github: Init GitHub workflows (#3)
Signed-off-by: Stephen Augustus <[email protected]>
1 parent d5583fb commit 9f78ea5

14 files changed

+505
-0
lines changed

‎.github/dependabot.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "github-actions"
4+
directory: "/"
5+
groups:
6+
github:
7+
patterns:
8+
- "actions/*"
9+
- "github/*"
10+
schedule:
11+
interval: "weekly"

‎.github/settings.yml‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
# These settings are synced to GitHub by https://probot.github.io/apps/settings/
2+
3+
repository:
4+
# See https://developer.github.com/v3/repos/#edit for all available settings.
5+
6+
# The name of the repository. Changing this will rename the repository
7+
name: .github
8+
9+
# A short description of the repository that will show up on GitHub
10+
description: Org-wide GitHub configurations
11+
12+
# A URL with more information about the repository
13+
#homepage: https://example.github.io/
14+
15+
# A comma-separated list of topics to set on the repository
16+
#topics: github, probot
17+
18+
# Either `true` to make the repository private, or `false` to make it public.
19+
# private: false
20+
21+
# Either `true` to enable issues for this repository, `false` to disable them.
22+
has_issues: true
23+
24+
# Either `true` to enable projects for this repository, or `false` to disable them.
25+
# If projects are disabled for the organization, passing `true` will cause an API error.
26+
has_projects: true
27+
28+
# Either `true` to enable the wiki for this repository, `false` to disable it.
29+
has_wiki: false
30+
31+
# Either `true` to enable downloads for this repository, `false` to disable them.
32+
has_downloads: true
33+
34+
# Updates the default branch for this repository.
35+
default_branch: main
36+
37+
# Either `true` to allow squash-merging pull requests, or `false` to prevent
38+
# squash-merging.
39+
allow_squash_merge: true
40+
41+
# Either `true` to allow merging pull requests with a merge commit, or `false`
42+
# to prevent merging pull requests with merge commits.
43+
allow_merge_commit: true
44+
45+
# Either `true` to allow rebase-merging pull requests, or `false` to prevent
46+
# rebase-merging.
47+
allow_rebase_merge: true
48+
49+
# Either `true` to enable automatic deletion of branches on merge, or `false` to disable
50+
delete_branch_on_merge: false
51+
52+
# Either `true` to enable automated security fixes, or `false` to disable
53+
# automated security fixes.
54+
enable_automated_security_fixes: true
55+
56+
# Either `true` to enable vulnerability alerts, or `false` to disable
57+
# vulnerability alerts.
58+
enable_vulnerability_alerts: true
59+
60+
# See https://developer.github.com/v3/teams/#add-or-update-team-repository for available options
61+
teams:
62+
# The permission to grant the team. Can be one of:
63+
# * `pull` - can pull, but not push to or administer this repository.
64+
# * `push` - can pull and push, but not administer this repository.
65+
# * `admin` - can pull, push and administer this repository.
66+
# * `maintain` - Recommended for project managers who need to manage the repository without access to sensitive or destructive actions.
67+
# * `triage` - Recommended for contributors who need to proactively manage issues and pull requests without write access.
68+
- name: org-admins
69+
permission: admin
70+
71+
branches:
72+
- name: main
73+
# https://developer.github.com/v3/repos/branches/#update-branch-protection
74+
# Branch Protection settings. Set to null to disable
75+
protection:
76+
# Required. Require at least one approving review on a pull request, before merging. Set to null to disable.
77+
required_pull_request_reviews:
78+
# The number of approvals required. (1-6)
79+
required_approving_review_count: 1
80+
# Dismiss approved reviews automatically when a new commit is pushed.
81+
dismiss_stale_reviews: true
82+
# Blocks merge until code owners have reviewed.
83+
require_code_owner_reviews: true
84+
# Specify which users and teams can dismiss pull request reviews. Pass an empty dismissal_restrictions object to disable. User and team dismissal_restrictions are only available for organization-owned repositories. Omit this parameter for personal repositories.
85+
dismissal_restrictions:
86+
users: []
87+
teams: []
88+
# Required. Require status checks to pass before merging. Set to null to disable
89+
required_status_checks:
90+
# Required. Require branches to be up to date before merging.
91+
strict: true
92+
# Required. The list of status checks to require in order to merge into this branch
93+
contexts: []
94+
# Required. Enforce all configured restrictions for administrators. Set to true to enforce required status checks for repository administrators. Set to null to disable.
95+
enforce_admins: true
96+
# Prevent merge commits from being pushed to matching branches
97+
required_linear_history: true
98+
# Required. Restrict who can push to this branch. Team and user restrictions are only available for organization-owned repositories. Set to null to disable.
99+
restrictions:
100+
apps: []
101+
users: []
102+
teams: []

‎.github/workflows/_lint.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
name: _lint
2+
3+
on:
4+
workflow_call:
5+
6+
jobs:
7+
lint:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- uses: actions/checkout@v4
11+
- name: 🧹 lint yaml
12+
uses: ibiqlik/action-yamllint@v3
13+
with:
14+
file_or_dir: "org/**/*.yaml"
15+
config_file: ".yamllint.yml"

‎.github/workflows/_scorecard.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: _scorecard
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
publish-results:
7+
description: Publish results of Scorecard analysis
8+
type: boolean
9+
required: false
10+
default: true
11+
12+
permissions:
13+
id-token: none
14+
security-events: none
15+
16+
jobs:
17+
scorecard:
18+
runs-on: ubuntu-latest
19+
permissions:
20+
id-token: write
21+
security-events: write
22+
steps:
23+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
24+
with:
25+
persist-credentials: false
26+
- name: ✅ run scorecard analysis
27+
uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
28+
with:
29+
results_file: results.sarif
30+
results_format: sarif
31+
repo_token: ${{ secrets.SCORECARD_TOKEN }}
32+
publish_results: ${{ inputs.publish-results }}
33+
- name: ⏫ upload sarif artifact
34+
uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
35+
with:
36+
name: SARIF file
37+
path: results.sarif
38+
retention-days: 5
39+
- name: 📦 upload sarif results
40+
uses: github/codeql-action/upload-sarif@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a # v3.25.15
41+
with:
42+
sarif_file: results.sarif

‎.github/workflows/_stale.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: _stale
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
days-until-stale:
7+
type: number
8+
required: false
9+
default: 15
10+
days-until-close:
11+
type: number
12+
required: false
13+
default: 30
14+
stale-label:
15+
type: string
16+
required: false
17+
default: "stale"
18+
exempt-label:
19+
type: string
20+
required: false
21+
default: "keep"
22+
23+
jobs:
24+
stale:
25+
runs-on: ubuntu-latest
26+
steps:
27+
- name: 📆 mark stale activity
28+
uses: actions/stale@v9
29+
with:
30+
repo-token: ${{ secrets.GITHUB_TOKEN }}
31+
days-before-stale: ${{ inputs.days-until-stale }}
32+
days-before-close: ${{ inputs.days-until-close }}
33+
stale-issue-label: ${{ inputs.stale-label }}
34+
stale-pr-label: ${{ inputs.stale-label }}
35+
exempt-issue-labels: ${{ inputs.exempt-label }}
36+
exempt-pr-labels: ${{ inputs.exempt-label }}
37+
stale-issue-message: >
38+
Thank you for your contribution! This issue has been automatically
39+
marked as `stale` because it has no recent activity in the last
40+
${{ inputs.days-until-stale }} days. It will be closed in
41+
${{ inputs.days-until-close }} days, if no further activity
42+
occurs. If this issue is still relevant, please leave a comment to
43+
let us know, and the `stale` label will be automatically removed.
44+
stale-pr-message: >
45+
Thank you for your contribution! This PR has been automatically
46+
marked as `stale` because it has no recent activity in the last
47+
${{ inputs.days-until-stale }} days. It will be closed in
48+
${{ inputs.days-until-close }} days, if no further activity occurs.
49+
If this pull request is still relevant, please leave a comment to
50+
let us know, and the `stale` label will be automatically removed.
51+
close-issue-message: >
52+
This issue has been marked `stale` for ${{ inputs.days-until-close }}
53+
days, and is now closed due to inactivity. If the issue is still
54+
relevant, please re-open this issue or file a new one. Thank you!
55+
close-pr-message: >
56+
This PR has been marked `stale` for ${{ inputs.days-until-close }}
57+
days, and is now closed due to inactivity. If this contribution is
58+
still relevant, please re-open this PR or file a new one. Thank you!

‎.github/workflows/clean-owners.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: clean-owners
2+
3+
on:
4+
# Scheduled trigger
5+
schedule:
6+
# Run weekly on Saturdays
7+
- cron: "30 1 * * 6"
8+
# Manual trigger
9+
workflow_dispatch:
10+
11+
permissions:
12+
issues: none
13+
14+
jobs:
15+
clean-owners:
16+
runs-on: ubuntu-latest
17+
permissions:
18+
issues: write
19+
steps:
20+
- name: 🧼 clean codeowners
21+
uses: github/cleanowners@c8770cb9f4560fb0434af42607e4932155181b85 # no semver release yet
22+
env:
23+
GH_TOKEN: ${{ secrets.OSPO_SERVICE_TOKEN }}
24+
ORGANIZATION: bloomberg
25+
EXEMPT_REPOS: "bloomberg/.github, bloomberg/.allstar"
26+
DRY_RUN: true

‎.github/workflows/contributor-report.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: contributor-report
2+
3+
on:
4+
# Scheduled trigger
5+
schedule:
6+
# Run the first day of the month at 00:00
7+
- cron: "0 0 1 * *"
8+
# Manual trigger
9+
workflow_dispatch:
10+
11+
permissions:
12+
issues: none
13+
14+
jobs:
15+
contributor-report:
16+
runs-on: ubuntu-latest
17+
strategy:
18+
matrix:
19+
# Define orgs to report contributor activity
20+
org:
21+
[
22+
"bloomberg",
23+
]
24+
permissions:
25+
# Required to create contributor report
26+
issues: write
27+
steps:
28+
- name: 📅 calculate date
29+
shell: bash
30+
run: |
31+
# Calculate the first day of the previous month
32+
START_DATE=$(date -d "last month" +%Y-%m-01)
33+
# Calculate the last day of the previous month
34+
END_DATE=$(date -d "$START_DATE +1 month -1 day" +%Y-%m-%d)
35+
# Set an environment variable with the date range
36+
echo "START_DATE=$START_DATE" >> "$GITHUB_ENV"
37+
echo "END_DATE=$END_DATE" >> "$GITHUB_ENV"
38+
- name: 📰 run contributors action
39+
uses: github/contributors@135b0430e856ade27175cbd1d4e1e11b0dd8ef95 # v1.4.3
40+
env:
41+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
42+
START_DATE: ${{ env.START_DATE }}
43+
END_DATE: ${{ env.END_DATE }}
44+
ORGANIZATION: ${{ matrix.org }}
45+
LINK_TO_PROFILE: "True"
46+
- name: 📥 create issue
47+
uses: peter-evans/create-issue-from-file@24452a72d85239eacf1468b0f1982a9f3fec4c94 # v5.0.0
48+
with:
49+
title: "📰 Monthly Contributor Report: ${{ matrix.org }}"
50+
token: ${{ secrets.GITHUB_TOKEN }}
51+
content-filepath: "./contributors.md"
52+
assignees: ${{ github.actor }}

‎.github/workflows/dependency-review.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: dependency-review
2+
3+
on:
4+
pull_request:
5+
6+
permissions:
7+
contents: none
8+
pull-requests: none
9+
10+
jobs:
11+
dependency-review:
12+
runs-on: ubuntu-latest
13+
permissions:
14+
contents: read
15+
pull-requests: write
16+
steps:
17+
- name: 🔒 harden runner
18+
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
19+
with:
20+
egress-policy: audit
21+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
22+
- name: 🔂 dependency review
23+
uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4
24+
with:
25+
deny-licenses: AGPL-3.0
26+
fail-on-severity: moderate
27+
comment-summary-in-pr: true

‎.github/workflows/evergreen-check.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: evergreen-check
2+
3+
on:
4+
# Scheduled trigger
5+
schedule:
6+
# Run weekly on Saturdays
7+
- cron: "30 1 * * 6"
8+
# Manual trigger
9+
workflow_dispatch:
10+
11+
permissions:
12+
pull-requests: none
13+
issues: none
14+
15+
jobs:
16+
evergreen-check:
17+
runs-on: ubuntu-latest
18+
permissions:
19+
# Required to create pull requests
20+
pull-requests: write
21+
# Required to create issues
22+
issues: write
23+
steps:
24+
# - name: 📅 calculate date
25+
# shell: bash
26+
# run: |
27+
# # Get the current date
28+
# CURRENT_DATE=$(date +'%Y-%m-%d')
29+
# # Calculate the previous month
30+
# PREVIOUS_DATE=$(date -d "$CURRENT_DATE -7 day" +'%Y-%m-%d')
31+
# echo "$PREVIOUS_DATE..$CURRENT_DATE"
32+
# # Create env variable for next step
33+
# echo "ONE_WEEK_AGO=$PREVIOUS_DATE" >> "$GITHUB_ENV"
34+
- name: 🌲 evergreen check
35+
uses: github/evergreen@89980256962fae821ba73ae35c9e0216e6bb674f # v1.11.1
36+
env:
37+
GH_TOKEN: ${{ secrets.OSPO_SERVICE_TOKEN }}
38+
ORGANIZATION: bloomberg
39+
EXEMPT_REPOS: "bloomberg/.github, bloomberg/.allstar"
40+
TYPE: pull
41+
TITLE: ".github: Add Dependabot configuration"
42+
BODY: |
43+
👋 This pull request was generated using GitHub's [Evergreen Action](https://github.com/github/evergreen) to enable [Dependabot](https://github.com/dependabot).
44+
45+
Dependabot helps open source maintainers automatically manage dependencies and security updates.
46+
47+
📖 Check out the official documentation for configuring Dependabot [here](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file)!
48+
COMMIT_MESSAGE: ".github: Add Dependabot configuration"
49+
# CREATED_AFTER_DATE: ${{ env.ONE_WEEK_AGO }}
50+
GROUP_DEPENDENCIES: true
51+
ENABLE_SECURITY_UPDATES: false

0 commit comments

Comments
 (0)