Skip to content

Commit 2971294

Browse files
stord-engineering-accountgithub-actions[bot]
stord-engineering-account
and
github-actions[bot]
authored
chore: sync files with stordco/common-config-elixir (#45)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
1 parent b0fdb25 commit 2971294

File tree

9 files changed

+146
-35
lines changed

9 files changed

+146
-35
lines changed

‎.credo.exs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@
8181
# You can customize the priority of any check
8282
# Priority values are: `low, normal, high, higher`
8383
#
84-
{Credo.Check.Design.AliasUsage, [priority: :low, if_nested_deeper_than: 2, if_called_more_often_than: 2]},
84+
{Credo.Check.Design.AliasUsage, [priority: :low, if_nested_deeper_than: 4, if_called_more_often_than: 2]},
8585
{Credo.Check.Design.DuplicatedCode, false},
8686
# You can also customize the exit_status of each check.
8787
# If you don't want TODO comments to cause `mix credo` to fail, just

‎.github/pull_request_template.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
## Related Ticket(s)
2+
3+
<!--
4+
Enter the Jira issue below in the following format: PROJECT-##
5+
-->
6+
17
## Checklist
28

39
<!--

‎.github/release-please-config.json renamed to ‎.github/release-please-config-stable.json

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,11 @@
77
"section": "Features",
88
"hidden": false
99
},
10+
{
11+
"type": "hotfix",
12+
"section": "Hotfixes",
13+
"hidden": true
14+
},
1015
{
1116
"type": "fix",
1217
"section": "Bug Fixes",
@@ -22,9 +27,7 @@
2227
"draft-pull-request": false,
2328
"packages": {
2429
".": {
25-
"extra-files": [
26-
"README.md"
27-
],
30+
"extra-files": ["README.md"],
2831
"release-type": "elixir"
2932
}
3033
},

‎.github/workflows/ci.yaml

Lines changed: 71 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,11 @@ jobs:
3333
runs-on: ubuntu-latest
3434

3535
outputs:
36-
database: ${{ steps.changed.outputs.database_any_changed }}
37-
docker: ${{ steps.changed.outputs.docker_any_changed }}
38-
elixir: ${{ steps.changed.outputs.elixir_any_changed }}
39-
helm: ${{ steps.changed.outputs.helm_any_changed }}
36+
database: ${{ steps.changed.outputs.database }}
37+
docker: ${{ steps.changed.outputs.docker }}
38+
documentation: ${{ steps.changed.outputs.documentation }}
39+
elixir: ${{ steps.changed.outputs.elixir }}
40+
helm: ${{ steps.changed.outputs.helm }}
4041

4142
steps:
4243
- name: Checkout
@@ -46,26 +47,37 @@ jobs:
4647

4748
- id: changed
4849
name: Get Changed Files
49-
uses: tj-actions/changed-files@v43
50-
with:
51-
files_yaml: |
52-
database:
53-
- '.github/workflows/ci.yaml'
54-
- 'priv/*repo/**'
55-
docker:
56-
- '.github/workflows/ci.yaml'
57-
- 'Dockerfile'
58-
elixir:
59-
- '.github/workflows/ci.yaml'
60-
- 'priv/**'
61-
- '**.ex'
62-
- '**.exs'
63-
- '**.heex'
64-
helm:
65-
- '.github/workflows/ci.yaml'
66-
- '.github/workflows/staging.yaml'
67-
- '.github/workflows/production.yaml'
68-
- 'helm/**'
50+
run: |
51+
# Using fetch-depth 2 above, we should always be able to get the full list of changes files:
52+
# - In a pull-request, GHA merges the PR branch into main
53+
# - When pushed to main, we always squash merge, so there is only one new commit
54+
55+
CHANGED_FILES=$(git diff --name-only HEAD^1 HEAD)
56+
57+
declare -A patterns
58+
patterns["database"]=".github/workflows/ci.yaml priv/.*repo/.*"
59+
patterns["docker"]=".github/workflows/ci.yaml Dockerfile"
60+
patterns["documentation"]="docs/.* priv/documentation/.* .*.ex .*.md"
61+
patterns["elixir"]=".github/workflows/ci.yaml .tool-versions priv/.* .*.ex .*.exs .*.heex"
62+
patterns["helm"]=".github/workflows/ci.yaml .github/workflows/staging.yaml .github/workflows/production.yaml helm/.*"
63+
64+
for filetype in ${!patterns[@]}; do
65+
found="false"
66+
echo "==> Checking: $filetype"
67+
for pattern in ${patterns[$filetype]}; do
68+
for changed_file in $CHANGED_FILES; do
69+
if [[ "$changed_file" =~ $pattern ]]; then
70+
echo "====> Found change: $changed_file"
71+
found="true"
72+
break
73+
fi
74+
done
75+
if [[ "$found" == "true" ]]; then
76+
break
77+
fi
78+
done
79+
echo "$filetype=$found" >> $GITHUB_OUTPUT
80+
done
6981
7082
Credo:
7183
if: ${{ !startsWith(github.head_ref, 'release-please--branches') && needs.Changed.outputs.elixir == 'true' }}
@@ -92,6 +104,9 @@ jobs:
92104
needs: [Changed]
93105
runs-on: ubuntu-latest
94106

107+
env:
108+
MIX_ENV: test
109+
95110
steps:
96111
- name: Checkout
97112
uses: actions/checkout@v4
@@ -128,7 +143,7 @@ jobs:
128143
run: mix dialyzer --format github
129144

130145
Documentation:
131-
if: ${{ !startsWith(github.head_ref, 'release-please--branches') && needs.Changed.outputs.elixir == 'true' }}
146+
if: ${{ !startsWith(github.head_ref, 'release-please--branches') && needs.Changed.outputs.documentation == 'true' }}
132147
needs: [Changed]
133148
runs-on: ubuntu-latest
134149

@@ -209,3 +224,34 @@ jobs:
209224
- elixir: 1.15
210225
otp: 26
211226

227+
Trivy_Filesystem:
228+
if: ${{ !startsWith(github.head_ref, 'release-please--branches') }}
229+
name: Trivy Filesystem Scan
230+
runs-on: ubuntu-latest
231+
232+
permissions:
233+
contents: read
234+
id-token: write
235+
pull-requests: write
236+
237+
steps:
238+
- name: Checkout
239+
uses: actions/checkout@v4
240+
241+
- name: Setup Elixir
242+
uses: stordco/actions-elixir/setup@v1
243+
with:
244+
github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
245+
hex-token: ${{ secrets.HEX_API_KEY }}
246+
oban-fingerprint: ${{ secrets.OBAN_KEY_FINGERPRINT }}
247+
oban-token: ${{ secrets.OBAN_LICENSE_KEY }}
248+
249+
- name: Trivy Scan
250+
uses: stordco/actions-trivy@v1
251+
with:
252+
github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
253+
scan-type: fs
254+
slack-bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
255+
slack-channel-id: ${{ secrets.SLACK_SECURITY_ALERTS }}
256+
update-db: false
257+

‎.github/workflows/pr.yaml

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ jobs:
3030
return;
3131
}
3232
33-
const REGEX = /^(feat!|fix!|fix|feat|chore|(fix|feat|chore)\(\w.*\)):\s(\[\w{1,8}-\d{1,8}\]|.*).*/;
33+
const REGEX = /^(feat!|fix!|hotfix!|fix|feat|chore|hotfix|(fix|feat|chore|hotfix)\(\w.*\)):\s(\[\w{1,8}-\d{1,8}\]|.*).*/;
3434
3535
if (!REGEX.test(title)) {
3636
core.setFailed("Pull request title does not follow conventional commits");
@@ -43,7 +43,10 @@ jobs:
4343
fix: [JIRA-1234] fix an existing feature
4444
feat: [JIRA-1234] a new feature to release
4545
feat!: a breaking change
46+
hotfix: needed in production immediately
4647
47-
Note: Adding ! (i.e. \`feat!:\`) represents a breaking change and will result in a SemVer major release.
48+
Adding ! (i.e. \`feat!:\`) represents a breaking change and will result in a SemVer major release.
49+
50+
Starting a commit with \`hotfix\` will result in a seperate hotfix release PR.
4851
`.trim());
4952
}

‎.github/workflows/release.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,15 @@ concurrency:
1212
cancel-in-progress: false
1313

1414
jobs:
15-
Please:
15+
Stable:
1616
runs-on: ubuntu-latest
1717

1818
steps:
1919
- id: release
2020
name: Release
21-
uses: google-github-actions/release-please-action@v4
21+
uses: googleapis/release-please-action@v4
2222
with:
23-
config-file: .github/release-please-config.json
23+
config-file: .github/release-please-config-stable.json
2424
manifest-file: .github/release-please-manifest.json
2525
target-branch: main
2626
token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}

‎.github/workflows/staging.yaml

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@ jobs:
2626

2727
runs-on: ubuntu-latest
2828

29+
env:
30+
MIX_ENV: test
31+
2932
steps:
3033
- name: Checkout
3134
uses: actions/checkout@v4
@@ -38,7 +41,7 @@ jobs:
3841
oban-fingerprint: ${{ secrets.OBAN_KEY_FINGERPRINT }}
3942
oban-token: ${{ secrets.OBAN_LICENSE_KEY }}
4043

41-
- name: Build
44+
- name: Docs
4245
run: mix docs
4346

4447
- name: Set CNAME

‎.github/workflows/trivy.yaml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# This file is synced with stordco/common-config-elixir. Any changes will be overwritten.
2+
3+
name: Update Trivy Cache
4+
5+
on:
6+
schedule:
7+
- cron: "0 0 * * *" # Run daily at midnight UTC
8+
workflow_dispatch: # Allow manual triggering
9+
10+
jobs:
11+
update-trivy-db:
12+
runs-on: ubuntu-latest
13+
steps:
14+
- name: Setup oras
15+
uses: oras-project/setup-oras@v1
16+
17+
- name: Get current date
18+
id: date
19+
run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
20+
21+
- name: Download and extract the vulnerability DB
22+
run: |
23+
mkdir -p $GITHUB_WORKSPACE/.cache/trivy/db
24+
oras pull ghcr.io/aquasecurity/trivy-db:2
25+
tar -xzf db.tar.gz -C $GITHUB_WORKSPACE/.cache/trivy/db
26+
rm db.tar.gz
27+
28+
- name: Cache DBs
29+
uses: actions/cache/save@v4
30+
with:
31+
path: ${{ github.workspace }}/.cache/trivy
32+
key: cache-trivy-${{ steps.date.outputs.date }}

‎.trivy/fs-config.yaml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# This file is synced with stordco/common-config-elixir. Any changes will be overwritten.
2+
3+
exit-code: '1'
4+
format: 'json'
5+
output: 'trivy-fs-results.json'
6+
scanners:
7+
- vuln
8+
severity:
9+
- CRITICAL
10+
- HIGH
11+
- MEDIUM
12+
- LOW
13+
- UNKNOWN
14+
timeout: '3m'
15+
vulnerability:
16+
type:
17+
- os
18+
- library

0 commit comments

Comments
 (0)