Skip to content

Commit f9edb8e

Browse files
anthony-nhsanthony-nhs
authored
Chore: [AEA-0000] - add pre-commit hooks, update docs, tighten security on workflows (#9)
## Summary - Routine Change ### Details - add pre-commit hooks - update example in docs - tighten security on workflows - add workflow to update devcontainer version
1 parent 304ab2f commit f9edb8e

11 files changed

Lines changed: 405 additions & 3 deletions

File tree

‎.gitallowed‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
id-token: write
2+
password: \${{secrets\.GITHUB_TOKEN}}
3+
token: ?"?\$\{\{\s*secrets\.GITHUB_TOKEN\s*\}\}"?
4+
github-token: ?"?\$\{\{\s*secrets\.GITHUB_TOKEN\s*\}\}"?
5+
token: ?"?\$\{\{\s*secrets\.DEPENDABOT_TOKEN\s*\}\}"?
6+
\.gitallowed
7+
id-token: "write"

‎.github/workflows/ci.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,22 @@ on:
44
push:
55
branches: [main]
66

7+
permissions: {}
78
jobs:
89
get_config_values:
910
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
11+
permissions:
12+
attestations: "read"
13+
contents: "read"
14+
packages: "read"
1015
with:
1116
verify_published_from_main_image: false
1217

1318
quality_checks:
1419
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
1520
needs: [get_config_values]
21+
permissions:
22+
contents: "read"
1623
with:
1724
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
1825
secrets:

‎.github/workflows/pull_request.yml‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,20 +4,31 @@ on:
44
pull_request:
55
branches: [main]
66

7+
permissions: {}
8+
79
jobs:
810
get_config_values:
911
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
12+
permissions:
13+
attestations: "read"
14+
contents: "read"
15+
packages: "read"
1016
with:
1117
verify_published_from_main_image: false
1218

1319
dependabot-auto-approve-and-merge:
1420
uses: NHSDigital/eps-common-workflows/.github/workflows/dependabot-auto-approve-and-merge.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
21+
permissions:
22+
contents: "write"
23+
pull-requests: "write"
1524
secrets:
1625
AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
1726
AUTOMERGE_PEM: ${{ secrets.AUTOMERGE_PEM }}
1827

1928
quality_checks:
2029
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
30+
permissions:
31+
contents: "read"
2132
needs: [get_config_values]
2233
with:
2334
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
@@ -26,7 +37,8 @@ jobs:
2637

2738
pr_title_format_check:
2839
uses: NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
29-
40+
permissions:
41+
pull-requests: "write"
3042
tag_release:
3143
needs: [get_config_values]
3244
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7

‎.github/workflows/release.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,23 @@ on:
55
schedule:
66
- cron: "0 8 * * 3"
77

8+
permissions: {}
9+
810
jobs:
911
get_config_values:
1012
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
13+
permissions:
14+
attestations: "read"
15+
contents: "read"
16+
packages: "read"
1117
with:
1218
verify_published_from_main_image: false
1319

1420
quality_checks:
1521
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
1622
needs: [get_config_values]
23+
permissions:
24+
contents: "read"
1725
with:
1826
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
1927
secrets:

‎.github/workflows/update_dev_container.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: Update devcontainer version
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: "0 6 * * 1"
7+
8+
permissions: {}
9+
10+
jobs:
11+
update-devcontainer-version:
12+
runs-on: ubuntu-22.04
13+
environment: create_pull_request
14+
permissions:
15+
contents: read
16+
packages: read
17+
18+
steps:
19+
- name: Update devcontainer version
20+
uses: NHSDigital/eps-update-devcontainer@95118f6746ca7081258cc7f651dca1c5bb7339f1
21+
with:
22+
calling_repo_base_branch: main
23+
CREATE_PULL_REQUEST_APP_ID: ${{ secrets.CREATE_PULL_REQUEST_APP_ID }}
24+
CREATE_PULL_REQUEST_PEM: ${{ secrets.CREATE_PULL_REQUEST_PEM }}

‎.pre-commit-config.yaml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
repos:
2+
- repo: https://github.com/pre-commit/pre-commit-hooks
3+
rev: v6.0.0
4+
hooks:
5+
- id: check-merge-conflict
6+
name: Check for merge conflict strings
7+
8+
- id: end-of-file-fixer
9+
name: Fix missing newline at the end of files
10+
11+
- id: check-shebang-scripts-are-executable
12+
name: Check shell scripts are executable
13+
files: \.(sh)$
14+
15+
- id: check-yaml
16+
name: Check pipelines configuration
17+
files: ^(.github)
18+
19+
- repo: https://github.com/pycqa/flake8
20+
rev: "7ef0350a439c93166bc8ba89fcc3de6a9a664e6c"
21+
hooks:
22+
- id: flake8
23+
24+
- repo: local
25+
hooks:
26+
- id: zizmor-action
27+
name: Check action.yml
28+
entry: zizmor
29+
args: ["action.yml"]
30+
language: system
31+
files: action.yml
32+
pass_filenames: false
33+
34+
- id: lint-githubactions
35+
name: Lint github actions
36+
entry: make
37+
args: ["actionlint"]
38+
language: system
39+
files: ^.github
40+
types_or: [yaml]
41+
pass_filenames: false
42+
43+
- id: lint-githubaction-scripts
44+
name: Lint github action scripts
45+
entry: make
46+
args: ["shellcheck"]
47+
language: system
48+
files: ^.github/scripts
49+
types_or: [sh, shell]
50+
pass_filenames: false
51+
52+
- id: check-commit-signing
53+
name: Check commit signing
54+
description: Ensures that commits are GPG signed
55+
entry: bash
56+
args:
57+
- -c
58+
- |
59+
if ! git config --get user.signingkey > /dev/null 2>&1; then
60+
echo "Error: Git signing key not configured."
61+
echo "Please configure your GPG signing key with:"
62+
echo " git config user.signingkey <YOUR_GPG_KEY_ID>"
63+
echo ""
64+
echo "To find your GPG key ID, run: gpg --list-secret-keys --keyid-format=long"
65+
echo "For more information, see: https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits"
66+
exit 1
67+
fi
68+
if ! git config --get commit.gpgsign | grep -q "true" > /dev/null 2>&1; then
69+
echo "Error: Commit signing is not enabled."
70+
echo "Please enable commit signing with:"
71+
echo " git config commit.gpgsign true"
72+
echo ""
73+
echo "For more information, see: https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits"
74+
exit 1
75+
fi
76+
echo "Commit signing is properly configured."
77+
language: system
78+
pass_filenames: false
79+
always_run: true
80+
81+
- id: git-secrets
82+
name: Git Secrets
83+
description: git-secrets scans commits, commit messages, and --no-ff merges to prevent adding secrets into your git repositories.
84+
entry: bash
85+
args:
86+
- -c
87+
- "git-secrets --pre_commit_hook"
88+
language: system
89+
90+
fail_fast: true
91+
default_stages: [pre-commit]

‎Makefile‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,11 @@
11
.PHONY: install install-node compile lint test
2-
install:
3-
echo "Nothing to install"
2+
install: install-node install-python install-hooks
43
install-node:
54
echo "Nothing to install"
5+
install-python:
6+
poetry install
7+
install-hooks: install-python
8+
poetry run pre-commit install --install-hooks --overwrite
69
compile:
710
echo "Nothing to compile"
811
lint:

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,8 @@ on:
4848
schedule:
4949
- cron: '0 6 * * 1'
5050

51+
permissions: {}
52+
5153
jobs:
5254
sync-copilot-instructions:
5355
runs-on: ubuntu-22.04

0 commit comments

Comments
 (0)