diff --git a/.github/linters/.checkov.yaml b/.github/linters/.checkov.yaml new file mode 100644 index 0000000..0b86e0d --- /dev/null +++ b/.github/linters/.checkov.yaml @@ -0,0 +1,22 @@ +--- + +quiet: true + +skip-check: +# https://www.checkov.io/5.Policy%20Index/kubernetes.html +- CKV_K8S_15 # Image Pull Policy should be Always +- CKV_K8S_21 # The default namespace should not be used +- CKV_K8S_22 # Use read-only filesystem for containers where possible +- CKV_K8S_35 # Prefer using secrets as files over secrets as environment variables +- CKV_K8S_38 # Ensure that Service Account Tokens are only mounted where necessary +- CKV_K8S_40 # Containers should run as a high UID to avoid host conflict +- CKV_K8S_43 # Image should use digest +- CKV2_K8S_5 # No ServiceAccount/Node should be able to read all secrets +- CKV2_K8S_6 # Minimize the admission of pods which lack an associated NetworkPolicy +# https://www.checkov.io/5.Policy%20Index/dockerfile.html +- CKV_DOCKER_2 # Ensure that HEALTHCHECK instructions have been added to container images +# https://www.checkov.io/5.Policy%20Index/secrets.html +- CKV_SECRET_6 # Base64 High Entropy String +# https://www.checkov.io/5.Policy%20Index/github_actions.html +- CKV2_GHA_1 # Ensure top-level permissions are not set to write-all +- CKV_GHA_7 # The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. diff --git a/.github/linters/.yaml-lint.yml b/.github/linters/.yaml-lint.yml new file mode 100644 index 0000000..57b6479 --- /dev/null +++ b/.github/linters/.yaml-lint.yml @@ -0,0 +1,66 @@ +--- +#### Config file for yamllint +# Rules: https://yamllint.readthedocs.io/en/stable/rules.html + +# Exclude not required files +# ignore-from-file: +# - .gitignore +# - .yamlignore + +rules: + braces: + min-spaces-inside: 1 + max-spaces-inside: 1 + min-spaces-inside-empty: 0 + max-spaces-inside-empty: 0 + brackets: + min-spaces-inside: 0 + max-spaces-inside: 1 + min-spaces-inside-empty: -1 + max-spaces-inside-empty: -1 + colons: + max-spaces-before: 0 + max-spaces-after: -1 + commas: + max-spaces-before: 0 + min-spaces-after: 1 + max-spaces-after: 1 + comments: + level: warning + require-starting-space: true + min-spaces-from-content: 1 + comments-indentation: + level: warning + document-end: disable + document-start: disable + # level: warning + # present: false + empty-lines: + level: warning + max: 2 + max-start: 0 + max-end: 2 + empty-values: + forbid-in-block-mappings: true + forbid-in-flow-mappings: true + hyphens: + max-spaces-after: 1 + indentation: + level: warning + spaces: 2 + indent-sequences: true + check-multi-line-strings: false + key-duplicates: enable + key-ordering: disable + line-length: disable + # max: 100 + # allow-non-breakable-words: true + # allow-non-breakable-inline-mappings: true + new-line-at-end-of-file: disable + new-lines: + type: unix + octal-values: + forbid-implicit-octal: false + forbid-explicit-octal: false + trailing-spaces: enable + truthy: disable diff --git a/.github/linters/actionlint.yml b/.github/linters/actionlint.yml new file mode 100644 index 0000000..93c3df3 --- /dev/null +++ b/.github/linters/actionlint.yml @@ -0,0 +1,13 @@ +paths: + .github/workflows/**/*.{yml,yaml}: + ignore: + - 'shellcheck reported issue in this script: SC2086:info.+' + - 'shellcheck reported issue in this script: SC2002:style.+' + workflows-templates/**/*.{yml,yaml}: + ignore: + - 'shellcheck reported issue in this script: SC2086:info.+' + - 'shellcheck reported issue in this script: SC2002:style.+' + actions/**/*.{yml,yaml}: + ignore: + - 'shellcheck reported issue in this script: SC2086:info.+' + - 'shellcheck reported issue in this script: SC2002:style.+' diff --git a/.github/super-linter.env b/.github/super-linter.env new file mode 100644 index 0000000..af2118d --- /dev/null +++ b/.github/super-linter.env @@ -0,0 +1,20 @@ +# File will be loaded as environment variables +# It must contain strings like: +# name=value + +GITLEAKS_LOG_LEVEL=warn +VALIDATE_JAVASCRIPT_PRETTIER=false +VALIDATE_JAVASCRIPT_STANDARD=false +VALIDATE_JSCPD=false +VALIDATE_JSON_PRETTIER=false +VALIDATE_KUBERNETES_KUBECONFORM=false +VALIDATE_MARKDOWN_PRETTIER=false +VALIDATE_YAML_PRETTIER=false + +# TODO: fix python files and enable the check again +VALIDATE_PYTHON_BLACK=false +VALIDATE_PYTHON_FLAKE8=false +VALIDATE_PYTHON_ISORT=false +VALIDATE_PYTHON_MYPY=false +VALIDATE_PYTHON_PYINK=false +VALIDATE_PYTHON_PYLINT=false