Skip to content

Commit 85bf51f

Browse files
CLJ2006CLJ2006
committed
Merge branch 'APM-6720-ecr-lifecycle-policy' of https://github.com/NHSDigital/api-management-utils into APM-6720-ecr-lifecycle-policy
2 parents 03d2725 + d42f90d commit 85bf51f

File tree

10 files changed

+251
-68
lines changed

10 files changed

+251
-68
lines changed

‎.github/actions/scan-secrets/action.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
name: "Scan secrets"
2+
description: "Scan secrets"
3+
runs:
4+
using: "composite"
5+
steps:
6+
- name: "Scan secrets"
7+
shell: bash
8+
run: |
9+
# Please do not change this `check=whole-history` setting, as new patterns may be added or history may be rewritten.
10+
check=whole-history ./scripts/githooks/scan-secrets.sh

‎.gitleaksignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# SEE: https://github.com/gitleaks/gitleaks/blob/master/README.md#gitleaksignore
2+
3+
cd9c0efec38c5d63053dd865e5d4e207c0760d91:docs/guides/Perform_static_analysis.md:generic-api-key:37

‎azure/build-prereqs.yml‎

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,13 @@ parameters:
44
default: 'utils'
55

66
steps:
7-
# - bash: |
8-
# echo "Setting python tool cache path"
9-
# echo "##vso[task.setvariable variable=LD_LIBRARY_PATH;]:/agent/_work/_tool/Python/3.13.7/x64/lib/"
10-
# displayName: 'Set python tool cache path'
117
- bash: |
12-
PATCH=$(curl -s https://api.github.com/repos/actions/python-versions/releases \
13-
| jq -r '[.[] | .tag_name | select(startswith("3.13"))] | .[]' \
14-
| sort -V | tail -n 1 | cut -d- -f1)
8+
pyversion="3.13"
9+
PATCH=$(curl -fsSL https://raw.githubusercontent.com/actions/python-versions/main/versions-manifest.json \
10+
| jq -r --arg pyversion "$pyversion" '[ .[] | select(.stable == true) | .version
11+
| select(test("^" + ($pyversion|gsub("\\.";"\\.")) + "\\.\\d+$")) | split(".") | map(tonumber)] | max | join(".")')
12+
13+
echo "##vso[task.setvariable variable=PY_VER]$PATCH"
1514
echo "Resolved latest python version: $PATCH"
1615
echo "##vso[task.setvariable variable=LD_LIBRARY_PATH;]/agent/_work/_tool/Python/${PATCH}/x64/lib/"
1716
displayName: 'Query and set python tool cache path'
@@ -21,13 +20,13 @@ steps:
2120
name: UsePy
2221
displayName: 'Use Python 3.13'
2322
inputs:
24-
versionSpec: '3.13'
23+
versionSpec: '$(PY_VER)'
2524

26-
- bash: |
27-
echo "Checking the python version in use to set LD_LIBRARY_PATH"
28-
echo "Python location: $(UsePy.pythonLocation)"
29-
echo "##vso[task.setvariable variable=LD_LIBRARY_PATH]$(UsePy.pythonLocation)/lib"
30-
displayName: 'Set LD_LIBRARY_PATH'
25+
# - bash: |
26+
# echo "Checking the python version in use to set LD_LIBRARY_PATH"
27+
# echo "Python location: $(UsePy.pythonLocation)"
28+
# echo "##vso[task.setvariable variable=LD_LIBRARY_PATH]$(UsePy.pythonLocation)/lib"
29+
# displayName: 'Set LD_LIBRARY_PATH'
3130

3231

3332
- bash: |

‎azure/cleanup-ecs-pr-proxies.yml‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -61,24 +61,26 @@ jobs:
6161
displayName: cache utils pre-requisites
6262

6363
- bash: |
64-
PATCH=$(curl -s https://api.github.com/repos/actions/python-versions/releases \
65-
| jq -r '[.[] | .tag_name | select(startswith("3.13"))] | .[]' \
66-
| sort -V | tail -n 1 | cut -d- -f1)
64+
pyversion="3.13"
65+
PATCH=$(curl -fsSL https://raw.githubusercontent.com/actions/python-versions/main/versions-manifest.json \
66+
| jq -r --arg pyversion "$pyversion" '[ .[] | select(.stable == true) | .version
67+
| select(test("^" + ($pyversion|gsub("\\.";"\\.")) + "\\.\\d+$")) | split(".") | map(tonumber)] | max | join(".")')
6768
echo "Resolved latest python version: $PATCH"
6869
echo "##vso[task.setvariable variable=LD_LIBRARY_PATH;]/agent/_work/_tool/Python/${PATCH}/x64/lib/"
69-
displayName: 'Query and set python tool cache path'
70+
displayName: 'Query and set python tool cache path'
71+
7072
7173
- task: UsePythonVersion@0
7274
name: UsePy
73-
displayName: "Use Python 3.13"
75+
displayName: 'Use Python 3.13'
7476
inputs:
75-
versionSpec: 3.13
77+
versionSpec: '$(PY_VER)'
7678

77-
- bash: |
78-
echo "Checking the python version in use to set LD_LIBRARY_PATH"
79-
echo "Python location: $(UsePy.pythonLocation)"
80-
echo "##vso[task.setvariable variable=LD_LIBRARY_PATH]$(UsePy.pythonLocation)/lib"
81-
displayName: 'Set LD_LIBRARY_PATH'
79+
# - bash: |
80+
# echo "Checking the python version in use to set LD_LIBRARY_PATH"
81+
# echo "Python location: $(UsePy.pythonLocation)"
82+
# echo "##vso[task.setvariable variable=LD_LIBRARY_PATH]$(UsePy.pythonLocation)/lib"
83+
# displayName: 'Set LD_LIBRARY_PATH'
8284

8385
- bash: |
8486
make install

‎azure/common/apigee-build.yml‎

Lines changed: 15 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -143,32 +143,29 @@ jobs:
143143
parameters:
144144
service_name: "${{ parameters.service_name }}"
145145

146-
# - bash: |
147-
# echo "Setting python tool cache path"
148-
# echo "##vso[task.setvariable variable=LD_LIBRARY_PATH;]:/agent/_work/_tool/Python/${{ parameters.python_version }}/x64/lib/"
149-
# displayName: 'Set python tool cache path'
150-
151146
- bash: |
152-
PATCH=$(curl -s https://api.github.com/repos/actions/python-versions/releases \
153-
| jq -r '[.[] | .tag_name | select(startswith("'"${{ parameters.python_version }}"'"))] | .[]' \
154-
| sort -V | tail -n 1 | cut -d- -f1)
147+
pyversion=${{ parameters.python_version }}
148+
PATCH=$(curl -fsSL https://raw.githubusercontent.com/actions/python-versions/main/versions-manifest.json \
149+
| jq -r --arg pyversion "$pyversion" '[ .[] | select(.stable == true) | .version
150+
| select(test("^" + ($pyversion|gsub("\\.";"\\.")) + "\\.\\d+$")) | split(".") | map(tonumber)] | max | join(".")')
151+
152+
echo "##vso[task.setvariable variable=PY_VER]$PATCH"
155153
echo "Resolved latest python version: $PATCH"
156154
echo "##vso[task.setvariable variable=LD_LIBRARY_PATH;]/agent/_work/_tool/Python/${PATCH}/x64/lib/"
157-
displayName: 'Query and set python tool cache path'
155+
displayName: 'Query and set python tool cache path'
156+
158157
159158
- task: UsePythonVersion@0
160159
name: UsePy
161-
displayName: "Use Python ${{ parameters.python_version }}"
160+
displayName: 'Use Python ${{ parameters.python_version }}'
162161
inputs:
163-
versionSpec: ${{ parameters.python_version }}
164-
162+
versionSpec: '$(PY_VER)'
165163

166-
- bash: |
167-
echo "Checking the python version in use to set LD_LIBRARY_PATH"
168-
echo "Python location: $(UsePy.pythonLocation)"
169-
echo "##vso[task.setvariable variable=LD_LIBRARY_PATH]$(UsePy.pythonLocation)/lib"
170-
displayName: 'Set LD_LIBRARY_PATH'
171-
164+
# - bash: |
165+
# echo "Checking the python version in use to set LD_LIBRARY_PATH"
166+
# echo "Python location: $(UsePy.pythonLocation)"
167+
# echo "##vso[task.setvariable variable=LD_LIBRARY_PATH]$(UsePy.pythonLocation)/lib"
168+
# displayName: 'Set LD_LIBRARY_PATH'
172169

173170
- ${{ each cache_step in parameters.cache_steps }}:
174171
- ${{ cache_step }}

‎azure/common/deploy-stage.yml‎

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -125,24 +125,28 @@ stages:
125125
aws_account: "${{ parameters.aws_account }}"
126126

127127
- bash: |
128-
PATCH=$(curl -s https://api.github.com/repos/actions/python-versions/releases \
129-
| jq -r '[.[] | .tag_name | select(startswith("3.13"))] | .[]' \
130-
| sort -V | tail -n 1 | cut -d- -f1)
128+
pyversion="3.13"
129+
PATCH=$(curl -fsSL https://raw.githubusercontent.com/actions/python-versions/main/versions-manifest.json \
130+
| jq -r --arg pyversion "$pyversion" '[ .[] | select(.stable == true) | .version
131+
| select(test("^" + ($pyversion|gsub("\\.";"\\.")) + "\\.\\d+$")) | split(".") | map(tonumber)] | max | join(".")')
132+
133+
echo "##vso[task.setvariable variable=PY_VER]$PATCH"
131134
echo "Resolved latest python version: $PATCH"
132135
echo "##vso[task.setvariable variable=LD_LIBRARY_PATH;]/agent/_work/_tool/Python/${PATCH}/x64/lib/"
133-
displayName: 'Query and set python tool cache path'
136+
displayName: 'Query and set python tool cache path'
137+
134138
135139
- task: UsePythonVersion@0
136140
name: UsePy
137-
displayName: "Use Python 3.13"
141+
displayName: 'Use Python 3.13'
138142
inputs:
139-
versionSpec: 3.13
143+
versionSpec: '$(PY_VER)'
140144

141-
- bash: |
142-
echo "Checking the python version in use to set LD_LIBRARY_PATH"
143-
echo "Python location: $(UsePy.pythonLocation)"
144-
echo "##vso[task.setvariable variable=LD_LIBRARY_PATH]$(UsePy.pythonLocation)/lib"
145-
displayName: 'Set LD_LIBRARY_PATH'
145+
# - bash: |
146+
# echo "Checking the python version in use to set LD_LIBRARY_PATH"
147+
# echo "Python location: $(UsePy.pythonLocation)"
148+
# echo "##vso[task.setvariable variable=LD_LIBRARY_PATH]$(UsePy.pythonLocation)/lib"
149+
# displayName: 'Set LD_LIBRARY_PATH'
146150

147151
- template: "../components/set-facts.yml"
148152
parameters:

‎azure/utils-pr-pipeline.yml‎

Lines changed: 13 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -29,31 +29,29 @@ jobs:
2929
workspace:
3030
clean: all
3131
steps:
32-
# - bash: |
33-
# echo "Setting python tool cache path"
34-
# echo "##vso[task.setvariable variable=LD_LIBRARY_PATH;]:/agent/_work/_tool/Python/3.13.7/x64/lib/"
35-
# displayName: 'Set python tool cache path'
36-
3732
- bash: |
38-
PATCH=$(curl -s https://api.github.com/repos/actions/python-versions/releases \
39-
| jq -r '[.[] | .tag_name | select(startswith("3.13"))] | .[]' \
40-
| sort -V | tail -n 1 | cut -d- -f1)
33+
pyversion="3.13"
34+
PATCH=$(curl -fsSL https://raw.githubusercontent.com/actions/python-versions/main/versions-manifest.json \
35+
| jq -r --arg pyversion "$pyversion" '[ .[] | select(.stable == true) | .version
36+
| select(test("^" + ($pyversion|gsub("\\.";"\\.")) + "\\.\\d+$")) | split(".") | map(tonumber)] | max | join(".")')
37+
38+
echo "##vso[task.setvariable variable=PY_VER]$PATCH"
4139
echo "Resolved latest python version: $PATCH"
4240
echo "##vso[task.setvariable variable=LD_LIBRARY_PATH;]/agent/_work/_tool/Python/${PATCH}/x64/lib/"
43-
displayName: 'Query and set python tool cache path'
41+
displayName: 'Query and set python tool cache path'
4442
4543
4644
- task: UsePythonVersion@0
4745
name: UsePy
4846
displayName: 'Use Python 3.13'
4947
inputs:
50-
versionSpec: 3.13
48+
versionSpec: '$(PY_VER)'
5149

52-
- bash: |
53-
echo "Checking the python version in use to set LD_LIBRARY_PATH"
54-
echo "Python location: $(UsePy.pythonLocation)"
55-
echo "##vso[task.setvariable variable=LD_LIBRARY_PATH]$(UsePy.pythonLocation)/lib"
56-
displayName: 'Set LD_LIBRARY_PATH'
50+
# - bash: |
51+
# echo "Checking the python version in use to set LD_LIBRARY_PATH"
52+
# echo "Python location: $(UsePy.pythonLocation)"
53+
# echo "##vso[task.setvariable variable=LD_LIBRARY_PATH]$(UsePy.pythonLocation)/lib"
54+
# displayName: 'Set LD_LIBRARY_PATH'
5755

5856
- bash: |
5957
instance_id="$(curl -s http://169.254.169.254/latest/meta-data/instance-id)"

‎scripts/config/gitleaks.toml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# SEE: https://github.com/gitleaks/gitleaks/#configuration
2+
3+
[extend]
4+
useDefault = true # SEE: https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml
5+
6+
[[rules]]
7+
description = "IPv4"
8+
id = "ipv4"
9+
regex = '''[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'''
10+
11+
[rules.allowlist]
12+
regexTarget = "match"
13+
regexes = [
14+
# Exclude the private network IPv4 addresses as well as the DNS servers for Google and OpenDNS
15+
'''(127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.[0-9]{1,3}\.[0-9]{1,3}|192\.168\.[0-9]{1,3}\.[0-9]{1,3}|0\.0\.0\.0|255\.255\.255\.255|8\.8\.8\.8|8\.8\.4\.4|208\.67\.222\.222|208\.67\.220\.220)''',
16+
]
17+
18+
[allowlist]
19+
paths = ['''.terraform.lock.hcl''', '''poetry.lock''', '''yarn.lock''']

‎scripts/config/pre-commit.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
repos:
2+
- repo: local
3+
hooks:
4+
- id: scan-secrets
5+
name: Scan secrets
6+
entry: ./scripts/githooks/scan-secrets.sh
7+
args: ["check=staged-changes"]
8+
language: script
9+
pass_filenames: false
10+
- repo: local
11+
hooks:
12+
- id: check-file-format
13+
name: Check file format
14+
entry: ./scripts/githooks/check-file-format.sh
15+
args: ["check=staged-changes"]
16+
language: script
17+
pass_filenames: false
18+
- repo: local
19+
hooks:
20+
- id: check-markdown-format
21+
name: Check Markdown format
22+
entry: ./scripts/githooks/check-markdown-format.sh
23+
args: ["check=staged-changes"]
24+
language: script
25+
pass_filenames: false
26+
- repo: local
27+
hooks:
28+
- id: check-english-usage
29+
name: Check English usage
30+
entry: ./scripts/githooks/check-english-usage.sh
31+
args: ["check=staged-changes"]
32+
language: script
33+
pass_filenames: false
34+
- repo: local
35+
hooks:
36+
- id: lint-terraform
37+
name: Lint Terraform
38+
entry: ./scripts/githooks/check-terraform-format.sh
39+
language: script
40+
pass_filenames: false

0 commit comments

Comments
 (0)