Skip to content

Commit 87141a6

Browse files
diegolagospagopadiegolagospagopa
authored
feat: Setup Github-actions (#2)
1 parent 4fdba37 commit 87141a6

6 files changed

+197
-0
lines changed

‎.github/PULL_REQUEST_TEMPLATE.md

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<!--- Please always add a PR description as if nobody knows anything about the context these changes come from. -->
2+
<!--- Even if we are all from our internal team, we may not be on the same page. -->
3+
<!--- Write this PR as you were contributing to a public OSS project, where nobody knows you and you have to earn their trust. -->
4+
<!--- This will improve our projects in the long run! Thanks. -->
5+
6+
### List of changes
7+
8+
<!--- Describe your changes in detail -->
9+
10+
### Motivation and context
11+
12+
<!--- Why is this change required? What problem does it solve? -->
13+
14+
### Type of changes
15+
16+
- [ ] Add new feature
17+
- [ ] Update existing feature
18+
- [ ] Remove existing feature
19+
- [ ] Other changes
20+
21+
### Does this introduce a breaking change?
22+
23+
- [ ] Yes
24+
- [ ] No
25+
26+
### Other information
27+
28+
<!-- Any other information that is important to this PR such as screenshots of how the component looks before and after the change. -->

‎.github/workflows/pr-title.yml

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: "Validate PR title"
2+
3+
on:
4+
pull_request_target:
5+
types:
6+
- opened
7+
- edited
8+
- synchronize
9+
10+
jobs:
11+
main:
12+
name: Validate PR title
13+
runs-on: ubuntu-22.04
14+
steps:
15+
# Please look up the latest version from
16+
# https://github.com/amannn/action-semantic-pull-request/releases
17+
# from https://github.com/amannn/action-semantic-pull-request/commits/main
18+
- uses: amannn/action-semantic-pull-request@01d5fd8a8ebb9aafe902c40c53f0f4744f7381eb
19+
env:
20+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
21+
with:
22+
# Configure which types are allowed.
23+
# Default: https://github.com/commitizen/conventional-commit-types
24+
types: |
25+
fix
26+
feat
27+
docs
28+
chore
29+
breaking
30+
# Configure that a scope must always be provided.
31+
requireScope: false
32+
# Configure additional validation for the subject based on a regex.
33+
# This example ensures the subject starts with an uppercase character.
34+
subjectPattern: ^[A-Z].+$
35+
# If `subjectPattern` is configured, you can use this property to override
36+
# the default error message that is shown when the pattern doesn't match.
37+
# The variables `subject` and `title` can be used within the message.
38+
subjectPatternError: |
39+
The subject "{subject}" found in the pull request title "{title}"
40+
didn't match the configured pattern. Please ensure that the subject
41+
starts with an uppercase character.
42+
# For work-in-progress PRs you can typically use draft pull requests
43+
# from Github. However, private repositories on the free plan don't have
44+
# this option and therefore this action allows you to opt-in to using the
45+
# special "[WIP]" prefix to indicate this state. This will avoid the
46+
# validation of the PR title and the pull request checks remain pending.
47+
# Note that a second check will be reported if this is enabled.
48+
wip: true
49+
# When using "Squash and merge" on a PR with only one commit, GitHub
50+
# will suggest using that commit message instead of the PR title for the
51+
# merge commit, and it's easy to commit this by mistake. Enable this option
52+
# to also validate the commit message for one commit PRs.
53+
validateSingleCommit: false
54+
# Related to `validateSingleCommit` you can opt-in to validate that the PR
55+
# title matches a single commit to avoid confusion.
56+
validateSingleCommitMatchesPrTitle: false

‎.github/workflows/release.yml

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: Release
2+
3+
on:
4+
# Trigger the workflow on push on the main branch
5+
push:
6+
branches:
7+
- main
8+
paths-ignore:
9+
- 'CODEOWNERS'
10+
- '**.md'
11+
- '.**'
12+
13+
jobs:
14+
release:
15+
name: Release
16+
runs-on: ubuntu-22.04
17+
18+
steps:
19+
20+
- name: 🚀 Release with docker action
21+
id: release
22+
uses: pagopa/eng-github-actions-iac-template/global/release-with-docker@main #
23+
with:
24+
github_token: ${{ secrets.GITHUB_TOKEN }}
25+

‎.github/workflows/snapshot-docker.yml

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Snapshot docker build and push
2+
3+
on:
4+
push:
5+
# Sequence of patterns matched against refs/heads
6+
branches-ignore:
7+
- 'main'
8+
paths-ignore:
9+
- 'CODEOWNERS'
10+
- '**.md'
11+
- '.**'
12+
13+
jobs:
14+
release:
15+
name: Snapshot Docker
16+
runs-on: ubuntu-22.04
17+
18+
steps:
19+
- name: 📦 Docker build and push
20+
id: release
21+
uses: pagopa/eng-github-actions-iac-template/global/docker-build-push@main #
22+
with:
23+
github_token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/trivy.yml

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
name: Docker security scan
7+
8+
on:
9+
push:
10+
branches: [ "main", "master" ]
11+
pull_request:
12+
# The branches below must be a subset of the branches above
13+
branches: [ "main", "master" ]
14+
schedule:
15+
- cron: '00 07 * * *'
16+
17+
permissions:
18+
contents: read
19+
20+
jobs:
21+
build:
22+
permissions:
23+
contents: read # for actions/checkout to fetch code
24+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
25+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
26+
name: Build
27+
runs-on: ubuntu-22.04
28+
steps:
29+
- name: Checkout code
30+
# from https://github.com/actions/checkout/commits/main
31+
uses: actions/checkout@1f9a0c22da41e6ebfa534300ef656657ea2c6707
32+
33+
- name: Build an image from Dockerfile
34+
run: |
35+
docker build -t docker.io/my-organization/my-app:${{ github.sha }} .
36+
37+
- name: Run Trivy vulnerability scanner
38+
# from https://github.com/aquasecurity/trivy-action/commits/master
39+
uses: aquasecurity/trivy-action@d63413b0a4a4482237085319f7f4a1ce99a8f2ac
40+
with:
41+
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
42+
format: 'template'
43+
template: '@/contrib/sarif.tpl'
44+
output: 'trivy-results.sarif'
45+
severity: 'CRITICAL,HIGH'
46+
timeout: '10m0s'
47+
48+
- name: Upload Trivy scan results to GitHub Security tab
49+
# from https://github.com/github/codeql-action/commits/main
50+
uses: github/codeql-action/upload-sarif@f0a12816612c7306b485a22cb164feb43c6df818
51+
with:
52+
sarif_file: 'trivy-results.sarif'

‎.releaserc.json

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"plugins": [
3+
[
4+
"@semantic-release/commit-analyzer",
5+
{
6+
"preset": "angular",
7+
"releaseRules": [{ "type": "breaking", "release": "major" }]
8+
}
9+
],
10+
"@semantic-release/release-notes-generator",
11+
"@semantic-release/github"
12+
]
13+
}

0 commit comments

Comments
 (0)