Skip to content

Commit bc0a8e8

Browse files
massongitgithub-actions[bot]
massongit
and
github-actions[bot]
authored
CI群・README追加 (#8)
* inputの命名規則統一 * super-linter追加 * CI群追加 * README追加 * renovate-config-validatorの設定修正 * 自分自身のWorkflowを実行できるようにする * 自分自身のWorkflowを実行できるようにする * パス修正 * 処理修正 * 処理修正 * 処理修正 * 鳩は唐揚げ！(自動で直してあげたよ！) (#9) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
1 parent efa589c commit bc0a8e8

10 files changed

Lines changed: 23124 additions & 0 deletions

‎.github/workflows/renovate-config-validator.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
name: renovate-config-validator
3+
4+
on:
5+
push:
6+
branches:
7+
- main
8+
pull_request:
9+
10+
jobs:
11+
renovate-config-validator:
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- uses: actions/checkout@v3.0.2
16+
- uses: actions/setup-node@v3.3.0
17+
with:
18+
cache: npm
19+
- run: npm ci --prefer-offline
20+
- run: npx renovate-config-validator

‎.github/workflows/super-linter.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,11 @@ jobs:
4444
# of changed files within `super-linter`
4545
fetch-depth: 0
4646

47+
- uses: actions/setup-node@v3.3.0
48+
with:
49+
cache: npm
50+
- run: npm ci --prefer-offline
51+
4752
################################
4853
# Run Linter against code base #
4954
################################
@@ -52,3 +57,4 @@ jobs:
5257
env:
5358
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
5459
LINTER_RULES_PATH: .
60+
PATH: /github/workspace/node_modules/.bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/node_modules/.bin:/venvs/ansible-lint/bin:/venvs/black/bin:/venvs/cfn-lint/bin:/venvs/cpplint/bin:/venvs/flake8/bin:/venvs/isort/bin:/venvs/mypy/bin:/venvs/pylint/bin:/venvs/snakefmt/bin:/venvs/snakemake/bin:/venvs/sqlfluff/bin:/venvs/yamllint/bin:/venvs/yq/bin:/var/cache/dotnet/tools:/usr/share/dotnet

‎.github/workflows/update-gitleaks.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
---
2+
name: update-gitleaks
3+
4+
on:
5+
pull_request:
6+
push:
7+
branches:
8+
- main
9+
10+
permissions:
11+
contents: write
12+
pull-requests: write
13+
14+
jobs:
15+
update-gitleaks:
16+
runs-on: ubuntu-latest
17+
steps:
18+
- uses: actions/checkout@v3.0.2
19+
with:
20+
fetch-depth: 0
21+
ref: ${{ github.event.pull_request.head.sha }}
22+
- uses: actions/setup-node@v3.3.0
23+
with:
24+
cache: npm
25+
- name: Install packages
26+
run: npm ci --prefer-offline
27+
- name: Update .gitleaks.toml
28+
run: |
29+
version="$(grep super-linter .github/workflows/super-linter.yml | grep uses | sed -e 's/.*@//g')"
30+
curl "https://raw.githubusercontent.com/github/super-linter/${version}/TEMPLATES/.gitleaks.toml" > .gitleaks.toml
31+
- name: Update .pre-commit-config.yaml
32+
uses: actions/github-script@v6.1.0
33+
with:
34+
github-token: ${{secrets.GITHUB_TOKEN}}
35+
script: |
36+
const fs = require('fs')
37+
const yaml = require('js-yaml')
38+
39+
const config_filename = '.pre-commit-config.yaml'
40+
const config = yaml.load(fs.readFileSync(config_filename, 'utf8'))
41+
const common_params = {
42+
owner: 'zricethezav',
43+
repo: 'gitleaks'
44+
}
45+
console.log("call repos.getLatestRelease:", common_params)
46+
const latest_release = await github.rest.repos.getLatestRelease(
47+
common_params
48+
)
49+
config.repos = config.repos.map(repo => {
50+
let repo_name = 'https://github.com/'
51+
repo_name += common_params.owner + '/' + common_params.repo
52+
53+
if (repo.repo === repo_name) {
54+
repo.rev = latest_release.data.tag_name
55+
}
56+
57+
return repo;
58+
})
59+
const content = '---\n' + yaml.dump(config)
60+
61+
try {
62+
fs.writeFileSync(config_filename, content, 'utf8')
63+
} catch (err) {
64+
console.error(err.message)
65+
process.exit(1)
66+
}
67+
- uses: ./
68+
with:
69+
github-token: ${{secrets.GITHUB_TOKEN}}
70+
branch-name-prefix: fix-version-pre-commit-config
71+
pr-title-prefix: gitleaksをアップデートしてあげたよ！
72+
repo-name: ${{ github.event.pull_request.head.repo.full_name }}

‎.github/workflows/update-package.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
name: update-package
3+
4+
on:
5+
pull_request:
6+
push:
7+
branches:
8+
- main
9+
10+
jobs:
11+
# npm installを実行し、package.jsonやpackage-lock.jsonに差分があればPRを作る
12+
update-package:
13+
runs-on: ubuntu-latest
14+
permissions:
15+
contents: write
16+
pull-requests: write
17+
steps:
18+
- uses: actions/checkout@v3.0.2
19+
with:
20+
fetch-depth: 0
21+
ref: ${{ github.event.pull_request.head.sha }}
22+
- uses: actions/setup-node@v3.3.0
23+
with:
24+
cache: npm
25+
- run: npm install
26+
- uses: ./
27+
with:
28+
github-token: ${{secrets.GITHUB_TOKEN}}
29+
branch-name-prefix: fix-package
30+
pr-title-prefix: package.jsonやpackage-lock.jsonを直してあげたよ！
31+
repo-name: ${{ github.event.pull_request.head.repo.full_name }}

‎.gitleaks.toml‎

Lines changed: 175 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,175 @@
1+
2+
title = "gitleaks config"
3+
4+
[[rules]]
5+
description = "AWS Access Key"
6+
regex = '''(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}'''
7+
tags = ["key", "AWS"]
8+
9+
[[rules]]
10+
description = "AWS Secret Key"
11+
regex = '''(?i)aws(.{0,20})?(?-i)['\"][0-9a-zA-Z\/+]{40}['\"]'''
12+
tags = ["key", "AWS"]
13+
14+
[[rules]]
15+
description = "AWS MWS key"
16+
regex = '''amzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'''
17+
tags = ["key", "AWS", "MWS"]
18+
19+
[[rules]]
20+
description = "Facebook Secret Key"
21+
regex = '''(?i)(facebook|fb)(.{0,20})?(?-i)['\"][0-9a-f]{32}['\"]'''
22+
tags = ["key", "Facebook"]
23+
24+
[[rules]]
25+
description = "Facebook Client ID"
26+
regex = '''(?i)(facebook|fb)(.{0,20})?['\"][0-9]{13,17}['\"]'''
27+
tags = ["key", "Facebook"]
28+
29+
[[rules]]
30+
description = "Twitter Secret Key"
31+
regex = '''(?i)twitter(.{0,20})?['\"][0-9a-z]{35,44}['\"]'''
32+
tags = ["key", "Twitter"]
33+
34+
[[rules]]
35+
description = "Twitter Client ID"
36+
regex = '''(?i)twitter(.{0,20})?['\"][0-9a-z]{18,25}['\"]'''
37+
tags = ["client", "Twitter"]
38+
39+
[[rules]]
40+
description = "Github Personal Access Token"
41+
regex = '''ghp_[0-9a-zA-Z]{36}'''
42+
tags = ["key", "Github"]
43+
[[rules]]
44+
description = "Github OAuth Access Token"
45+
regex = '''gho_[0-9a-zA-Z]{36}'''
46+
tags = ["key", "Github"]
47+
[[rules]]
48+
description = "Github App Token"
49+
regex = '''(ghu|ghs)_[0-9a-zA-Z]{36}'''
50+
tags = ["key", "Github"]
51+
[[rules]]
52+
description = "Github Refresh Token"
53+
regex = '''ghr_[0-9a-zA-Z]{76}'''
54+
tags = ["key", "Github"]
55+
56+
[[rules]]
57+
description = "LinkedIn Client ID"
58+
regex = '''(?i)linkedin(.{0,20})?(?-i)[0-9a-z]{12}'''
59+
tags = ["client", "LinkedIn"]
60+
61+
[[rules]]
62+
description = "LinkedIn Secret Key"
63+
regex = '''(?i)linkedin(.{0,20})?[0-9a-z]{16}'''
64+
tags = ["secret", "LinkedIn"]
65+
66+
[[rules]]
67+
description = "Slack"
68+
regex = '''xox[baprs]-([0-9a-zA-Z]{10,48})?'''
69+
tags = ["key", "Slack"]
70+
71+
[[rules]]
72+
description = "Asymmetric Private Key"
73+
regex = '''-----BEGIN ((EC|PGP|DSA|RSA|OPENSSH) )?PRIVATE KEY( BLOCK)?-----'''
74+
tags = ["key", "AsymmetricPrivateKey"]
75+
76+
[[rules]]
77+
description = "Google API key"
78+
regex = '''AIza[0-9A-Za-z\\-_]{35}'''
79+
tags = ["key", "Google"]
80+
81+
[[rules]]
82+
description = "Google (GCP) Service Account"
83+
regex = '''"type": "service_account"'''
84+
tags = ["key", "Google"]
85+
86+
[[rules]]
87+
description = "Heroku API key"
88+
regex = '''(?i)heroku(.{0,20})?[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'''
89+
tags = ["key", "Heroku"]
90+
91+
[[rules]]
92+
description = "MailChimp API key"
93+
regex = '''(?i)(mailchimp|mc)(.{0,20})?[0-9a-f]{32}-us[0-9]{1,2}'''
94+
tags = ["key", "Mailchimp"]
95+
96+
[[rules]]
97+
description = "Mailgun API key"
98+
regex = '''((?i)(mailgun|mg)(.{0,20})?)?key-[0-9a-z]{32}'''
99+
tags = ["key", "Mailgun"]
100+
101+
[[rules]]
102+
description = "PayPal Braintree access token"
103+
regex = '''access_token\$production\$[0-9a-z]{16}\$[0-9a-f]{32}'''
104+
tags = ["key", "Paypal"]
105+
106+
[[rules]]
107+
description = "Picatic API key"
108+
regex = '''sk_live_[0-9a-z]{32}'''
109+
tags = ["key", "Picatic"]
110+
111+
[[rules]]
112+
description = "SendGrid API Key"
113+
regex = '''SG\.[\w_]{16,32}\.[\w_]{16,64}'''
114+
tags = ["key", "SendGrid"]
115+
116+
[[rules]]
117+
description = "Slack Webhook"
118+
regex = '''https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8,12}/[a-zA-Z0-9_]{24}'''
119+
tags = ["key", "slack"]
120+
121+
[[rules]]
122+
description = "Stripe API key"
123+
regex = '''(?i)stripe(.{0,20})?[sr]k_live_[0-9a-zA-Z]{24}'''
124+
tags = ["key", "Stripe"]
125+
126+
[[rules]]
127+
description = "Square access token"
128+
regex = '''sq0atp-[0-9A-Za-z\-_]{22}'''
129+
tags = ["key", "square"]
130+
131+
[[rules]]
132+
description = "Square OAuth secret"
133+
regex = '''sq0csp-[0-9A-Za-z\\-_]{43}'''
134+
tags = ["key", "square"]
135+
136+
[[rules]]
137+
description = "Twilio API key"
138+
regex = '''(?i)twilio(.{0,20})?SK[0-9a-f]{32}'''
139+
tags = ["key", "twilio"]
140+
141+
[[rules]]
142+
description = "Dynatrace ttoken"
143+
regex = '''dt0[a-zA-Z]{1}[0-9]{2}\.[A-Z0-9]{24}\.[A-Z0-9]{64}'''
144+
tags = ["key", "Dynatrace"]
145+
146+
[[rules]]
147+
description = "Shopify shared secret"
148+
regex = '''shpss_[a-fA-F0-9]{32}'''
149+
tags = ["key", "Shopify"]
150+
151+
[[rules]]
152+
description = "Shopify access token"
153+
regex = '''shpat_[a-fA-F0-9]{32}'''
154+
tags = ["key", "Shopify"]
155+
156+
[[rules]]
157+
description = "Shopify custom app access token"
158+
regex = '''shpca_[a-fA-F0-9]{32}'''
159+
tags = ["key", "Shopify"]
160+
161+
[[rules]]
162+
description = "Shopify private app access token"
163+
regex = '''shppa_[a-fA-F0-9]{32}'''
164+
tags = ["key", "Shopify"]
165+
166+
[[rules]]
167+
description = "PyPI upload token"
168+
regex = '''pypi-AgEIcHlwaS5vcmc[A-Za-z0-9-_]{50,1000}'''
169+
tags = ["key", "pypi"]
170+
171+
[allowlist]
172+
description = "Allowlisted files"
173+
files = ['''^\.?gitleaks.toml$''',
174+
'''(.*?)(png|jpg|gif|doc|docx|pdf|bin|xls|pyc|zip)$''',
175+
'''(go.mod|go.sum)$''']

‎.pre-commit-config.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
repos:
3+
- repo: https://github.com/zricethezav/gitleaks
4+
rev: v8.8.11
5+
hooks:
6+
- id: gitleaks

‎.textlintrc‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"filters": {
3+
"comments": true
4+
},
5+
"rules": {
6+
"@textlint-ja/no-insert-dropping-sa": true,
7+
"@proofdict/proofdict": {
8+
"dictURL": "https://azu.github.io/proof-dictionary/"
9+
},
10+
"abbr-within-parentheses": true,
11+
"footnote-order": true,
12+
"general-novel-style-ja": {
13+
// 各段落の先頭に許可する文字 (false: チェックしない)
14+
"chars_leading_paragraph": false,
15+
// アラビア数字の桁数は2桁まで (false: チェックしない)
16+
"max_arabic_numeral_digits": false
17+
},
18+
"ja-hiragana-fukushi": true,
19+
"ja-hiragana-hojodoushi": true,
20+
"ja-hiragana-keishikimeishi": true,
21+
"ja-unnatural-alphabet": true,
22+
"ng-word": true,
23+
"no-dead-link": true,
24+
"no-mixed-zenkaku-and-hankaku-alphabet": true,
25+
"prefer-tari-tari": true,
26+
"preset-ja-spacing": true,
27+
"preset-ja-technical-writing": true,
28+
"preset-jtf-style": {
29+
"1.1.3.箇条書き": false,
30+
"4.3.1.丸かっこ（）": false,
31+
"4.3.2.大かっこ［］": false
32+
},
33+
"terminology": true
34+
}
35+
}

‎README.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# actions-diff-pr-management
2+
3+
diffを元にPRを作成するGitHub ActionsのWorkflowです。
4+
5+
## 開発
6+
7+
### 設定
8+
9+
<https://pre-commit.com/> の手順に従って `pre-commit` をインストールする。
10+
これにより、[.pre-commit-config.yaml](.pre-commit-config.yaml)の設定に基づいて、コミット時にクレデンシャルが含まれていないかの検査が行われるようになる。

0 commit comments

Comments
 (0)