Skip to content

Add Edits From NPD Repo #343

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: dev
Choose a base branch
from
Open

Add Edits From NPD Repo #343

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
063c663
update contributors workflow
IsaacMilarky Sep 22, 2025
ba785be
add gitleaks toml file to all tiers plus repo itself
IsaacMilarky Sep 22, 2025
a51b1b2
straggler
IsaacMilarky Sep 22, 2025
3f89daf
make sure format of file is working
IsaacMilarky Sep 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 23 additions & 19 deletions .github/workflows/contributors.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,51 +19,55 @@ jobs:
- name: Checkout repository
uses: actions/checkout@v4
with:
fetch-depth: 0
fetch-depth: 0
token: ${{ secrets.PUSH_TO_PROTECTED_BRANCH }}

- name: Update contributor list
id: contrib_list
uses: akhilmhdh/[email protected]
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

GITHUB_TOKEN: ${{ secrets.PUSH_TO_PROTECTED_BRANCH }}

with:
readme_path: COMMUNITY.md
use_username: false
commit_message: "update contributors information"
auto_detect_branch_protection: false

- name: Get contributors count
id: get_contributors
env:

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


run: |
OWNER=$(echo $GITHUB_REPOSITORY | cut -d'/' -f1)
REPO=$(echo $GITHUB_REPOSITORY | cut -d'/' -f2)
QUERY='query { repository(owner: \"'"$OWNER"'\", name: \"'"$REPO"'\") { collaborators { totalCount } } }'
OWNER=$(echo $GITHUB_REPOSITORY | cut -d'/' -f1)
REPO=$(echo $GITHUB_REPOSITORY | cut -d'/' -f2)
QUERY='query { repository(owner: \"'"$OWNER"'\", name: \"'"$REPO"'\") { collaborators { totalCount } } }'

CONTRIBUTORS=$(gh api \
-H "Accept: application/vnd.github+json" \
-H "X-GitHub-Api-Version: 2022-11-28" \
"/repos/$OWNER/$REPO/contributors?per_page=100" | \
jq '[.[] | select(.type != "Bot" and (.login | test("\\[bot\\]$") | not) and (.login | test("-bot$") | not))] | length')

CONTRIBUTORS=$(gh api \
-H "Accept: application/vnd.github+json" \
-H "X-GitHub-Api-Version: 2022-11-28" \
"/repos/$OWNER/$REPO/contributors?per_page=100" | \
jq '[.[] | select(.type != "Bot" and (.login | test("\\[bot\\]$") | not) and (.login | test("-bot$") | not))] | length')
echo "Total contributors: $CONTRIBUTORS"
echo "contributors=$CONTRIBUTORS" >> $GITHUB_OUTPUT

echo "Total contributors: $CONTRIBUTORS"
echo "contributors=$CONTRIBUTORS" >> $GITHUB_OUTPUT

- name: Update COMMUNITY.md
run: |

CONTRIBUTORS="${{ steps.get_contributors.outputs.contributors }}"


perl -i -pe 's/(<!--CONTRIBUTOR COUNT START-->).*?(<!--CONTRIBUTOR COUNT END-->)/$1 '"$CONTRIBUTORS"' $2/' COMMUNITY.md

git config user.name 'github-actions[bot]'
git config user.email 'github-actions[bot]@users.noreply.github.com'
git pull
git add COMMUNITY.md
git commit -m "update contributors count to $CONTRIBUTORS" || exit 0

- name: Push protected
uses: CasperWA/push-protected@v2
with:
token: ${{ secrets.GITHUB_TOKEN }}

branch: main
git push
43 changes: 43 additions & 0 deletions .gitleaks.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
title = "Custom Gitleaks Config for Common Secrets"
version = "2"

#[allowlist]
#description = "Global allowlist"
# --- Replace with your local secret files ---

# --- Common Secrets ---
[[rules]]
id = "github-pat"
description = "GitHub Personal Access Token"
regex = '''ghp_[0-9A-Za-z]{36}'''
tags = ["key", "GitHub"]

[[rules]]
id = "slack-token"
description = "Slack Token"
regex = '''xox[baprs]-[0-9A-Za-z]{10,48}'''
tags = ["key", "slack"]

[[rules]]
id = "google-api-key"
description = "Google API Key"
regex = '''AIza[0-9A-Za-z\-_]{35}'''
tags = ["key", "Google"]

[[rules]]
id = "aws-access-key"
description = "AWS Access Key"
regex = '''(A3T[A-Z0-9]|AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA)[A-Z0-9]{16}'''
tags = ["AWS"]

[[rules]]
id = "aws-secret-key"
description = "AWS Secret Key"
regex = '''(?i)aws(.{0,20})?(?-i)['"][0-9a-zA-Z/+]{40}['"]'''
tags = ["AWS"]

[[rules]]
id = "private-key"
description = "Private Key"
regex = '''-----BEGIN( RSA| EC| DSA)? PRIVATE KEY-----'''
tags = ["private"]
43 changes: 43 additions & 0 deletions tier0/{{cookiecutter.project_slug}}/.gitleaks.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
title = "Custom Gitleaks Config for Common Secrets"
version = "2"

#[allowlist]
#description = "Global allowlist"
# --- Replace with your local secret files ---

# --- Common Secrets ---
[[rules]]
id = "github-pat"
description = "GitHub Personal Access Token"
regex = '''ghp_[0-9A-Za-z]{36}'''
tags = ["key", "GitHub"]

[[rules]]
id = "slack-token"
description = "Slack Token"
regex = '''xox[baprs]-[0-9A-Za-z]{10,48}'''
tags = ["key", "slack"]

[[rules]]
id = "google-api-key"
description = "Google API Key"
regex = '''AIza[0-9A-Za-z\-_]{35}'''
tags = ["key", "Google"]

[[rules]]
id = "aws-access-key"
description = "AWS Access Key"
regex = '''(A3T[A-Z0-9]|AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA)[A-Z0-9]{16}'''
tags = ["AWS"]

[[rules]]
id = "aws-secret-key"
description = "AWS Secret Key"
regex = '''(?i)aws(.{0,20})?(?-i)['"][0-9a-zA-Z/+]{40}['"]'''
tags = ["AWS"]

[[rules]]
id = "private-key"
description = "Private Key"
regex = '''-----BEGIN( RSA| EC| DSA)? PRIVATE KEY-----'''
tags = ["private"]
43 changes: 43 additions & 0 deletions tier1/{{cookiecutter.project_slug}}/.gitleaks.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
title = "Custom Gitleaks Config for Common Secrets"
version = "2"

#[allowlist]
#description = "Global allowlist"
# --- Replace with your local secret files

# --- Common Secrets ---
[[rules]]
id = "github-pat"
description = "GitHub Personal Access Token"
regex = '''ghp_[0-9A-Za-z]{36}'''
tags = ["key", "GitHub"]

[[rules]]
id = "slack-token"
description = "Slack Token"
regex = '''xox[baprs]-[0-9A-Za-z]{10,48}'''
tags = ["key", "slack"]

[[rules]]
id = "google-api-key"
description = "Google API Key"
regex = '''AIza[0-9A-Za-z\-_]{35}'''
tags = ["key", "Google"]

[[rules]]
id = "aws-access-key"
description = "AWS Access Key"
regex = '''(A3T[A-Z0-9]|AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA)[A-Z0-9]{16}'''
tags = ["AWS"]

[[rules]]
id = "aws-secret-key"
description = "AWS Secret Key"
regex = '''(?i)aws(.{0,20})?(?-i)['"][0-9a-zA-Z/+]{40}['"]'''
tags = ["AWS"]

[[rules]]
id = "private-key"
description = "Private Key"
regex = '''-----BEGIN( RSA| EC| DSA)? PRIVATE KEY-----'''
tags = ["private"]
27 changes: 11 additions & 16 deletions tier2/{{cookiecutter.project_slug}}/.github/workflows/contributors.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,25 +20,27 @@ jobs:
uses: actions/checkout@v4
with:
fetch-depth: 0
token: ${{ secrets.PUSH_TO_PROTECTED_BRANCH }}

- name: Update contributor list
id: contrib_list
uses: akhilmhdh/[email protected]
env:
{% raw %}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
{% endraw %}

GITHUB_TOKEN: ${{ secrets.PUSH_TO_PROTECTED_BRANCH }}

Comment on lines -28 to +31
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add raw tags

with:
readme_path: COMMUNITY.md
use_username: false
commit_message: "update contributors information"
auto_detect_branch_protection: false

- name: Get contributors count
id: get_contributors
env:
{% raw %}

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add raw tags

{% endraw %}


run: |
OWNER=$(echo $GITHUB_REPOSITORY | cut -d'/' -f1)
Expand All @@ -57,22 +59,15 @@ jobs:

- name: Update COMMUNITY.md
run: |
{% raw %}

CONTRIBUTORS="${{ steps.get_contributors.outputs.contributors }}"
{% endraw %}
Comment on lines -60 to -62
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add raw tags



perl -i -pe 's/(<!--CONTRIBUTOR COUNT START-->).*?(<!--CONTRIBUTOR COUNT END-->)/$1 '"$CONTRIBUTORS"' $2/' COMMUNITY.md

git config user.name 'github-actions[bot]'
git config user.email 'github-actions[bot]@users.noreply.github.com'
git pull
git add COMMUNITY.md
git commit -m "update contributors count to $CONTRIBUTORS" || exit 0

- name: Push protected
uses: CasperWA/push-protected@v2
with:
{% raw %}
token: ${{ secrets.PUSH_TO_PROTECTED_BRANCH }}
{% endraw %}

branch: main
git push
43 changes: 43 additions & 0 deletions tier2/{{cookiecutter.project_slug}}/.gitleaks.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
title = "Custom Gitleaks Config for Common Secrets"
version = "2"

#[allowlist]
#description = "Global allowlist"
# --- Replace with your local secret files ---

# --- Common Secrets ---
[[rules]]
id = "github-pat"
description = "GitHub Personal Access Token"
regex = '''ghp_[0-9A-Za-z]{36}'''
tags = ["key", "GitHub"]

[[rules]]
id = "slack-token"
description = "Slack Token"
regex = '''xox[baprs]-[0-9A-Za-z]{10,48}'''
tags = ["key", "slack"]

[[rules]]
id = "google-api-key"
description = "Google API Key"
regex = '''AIza[0-9A-Za-z\-_]{35}'''
tags = ["key", "Google"]

[[rules]]
id = "aws-access-key"
description = "AWS Access Key"
regex = '''(A3T[A-Z0-9]|AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA)[A-Z0-9]{16}'''
tags = ["AWS"]

[[rules]]
id = "aws-secret-key"
description = "AWS Secret Key"
regex = '''(?i)aws(.{0,20})?(?-i)['"][0-9a-zA-Z/+]{40}['"]'''
tags = ["AWS"]

[[rules]]
id = "private-key"
description = "Private Key"
regex = '''-----BEGIN( RSA| EC| DSA)? PRIVATE KEY-----'''
tags = ["private"]
27 changes: 11 additions & 16 deletions tier3/{{cookiecutter.project_slug}}/.github/workflows/contributors.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,25 +20,27 @@ jobs:
uses: actions/checkout@v4
with:
fetch-depth: 0
token: ${{ secrets.PUSH_TO_PROTECTED_BRANCH }}

- name: Update contributor list
id: contrib_list
uses: akhilmhdh/[email protected]
env:
{% raw %}
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did some testing to create a new repo using cookiecutter and got the error below:

Unable to create file '.github/workflows/contributors.yml'
Error message: 'secrets' is undefined

I think it's cause we need to have the {% raw %} tags embedded between each secrets variable because cookiecutter interprets it as a variable as part of its context

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
{% endraw %}

GITHUB_TOKEN: ${{ secrets.PUSH_TO_PROTECTED_BRANCH }}

with:
readme_path: COMMUNITY.md
use_username: false
commit_message: "update contributors information"
auto_detect_branch_protection: false

- name: Get contributors count
id: get_contributors
env:
{% raw %}

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
{% endraw %}
Comment on lines -39 to -41
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add raw tags



run: |
OWNER=$(echo $GITHUB_REPOSITORY | cut -d'/' -f1)
Expand All @@ -57,22 +59,15 @@ jobs:

- name: Update COMMUNITY.md
run: |
{% raw %}
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add raw tags


CONTRIBUTORS="${{ steps.get_contributors.outputs.contributors }}"
{% endraw %}


perl -i -pe 's/(<!--CONTRIBUTOR COUNT START-->).*?(<!--CONTRIBUTOR COUNT END-->)/$1 '"$CONTRIBUTORS"' $2/' COMMUNITY.md

git config user.name 'github-actions[bot]'
git config user.email 'github-actions[bot]@users.noreply.github.com'
git pull
git add COMMUNITY.md
git commit -m "update contributors count to $CONTRIBUTORS" || exit 0

- name: Push protected
uses: CasperWA/push-protected@v2
with:
{% raw %}
token: ${{ secrets.PUSH_TO_PROTECTED_BRANCH }}
{% endraw %}

branch: main
git push
Loading