Skip to content

Commit b607f61

Browse files
author
Sebastian Gumprich
committed
Merge branch 'collection'
2 parents 90d4870 + f2804c7 commit b607f61

File tree

153 files changed

+4694
-730
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

153 files changed

+4694
-730
lines changed

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
---
22
name: Bug report
33
about: Create a report to help us improve
4-
54
---
65

76
**Describe the bug**
@@ -11,27 +10,37 @@ A clear and concise description of what the bug is.
1110
A clear and concise description of what you expected to happen.
1211

1312
**Actual behavior**
13+
1414
<!--- Paste verbatim command output between quotes -->
15+
1516
```paste below
1617
1718
```
19+
1820
**Example Playbook**
21+
1922
<!--- Paste an example playbook that can be used to reproduce the problem between quotes -->
23+
2024
```paste below
2125
2226
```
2327

2428
**OS / Environment**
29+
2530
<!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->
2631

2732
**Ansible Version**
33+
2834
<!--- Paste verbatim output from "ansible --version" between quotes -->
35+
2936
```paste below
3037
3138
```
3239

3340
**Role Version**
41+
3442
<!--- Paste version of the role between quotes -->
43+
3544
```paste below
3645
3746
```

‎.github/ISSUE_TEMPLATE/feature_request.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
---
22
name: Feature request
33
about: Suggest an idea for this project
4-
54
---
65

76
**Is your feature request related to a problem? Please describe.**

‎.github/labeler.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
mysql_hardening:
3+
- 'roles/mysql_hardening/**'
4+
- 'molecule/mysql_hardening/**'
5+
- '.github/workflows/mysql_hardening.yml'
6+
7+
os_hardening:
8+
- 'roles/os_hardening/**'
9+
- 'molecule/os_hardening/**'
10+
- '.github/workflows/os_hardening.yml'
11+
12+
ssh_hardening:
13+
- 'roles/ssh_hardening/**'
14+
- 'molecule/ssh_hardening/**'
15+
- '.github/workflows/ssh_hardening.yml'
16+
17+
nginx_hardening:
18+
- 'roles/nginx_hardening/**'
19+
- 'molecule/nginx_hardening/**'
20+
- '.github/workflows/nginx_hardening.yml'

‎.github/workflows/enforce-labels.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: "Enforce PR labels"
2+
3+
on:
4+
pull_request:
5+
types: [labeled, unlabeled, opened, edited, synchronize]
6+
jobs:
7+
enforce-label:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- uses: actions/labeler@main
11+
with:
12+
repo-token: "${{ secrets.GITHUB_TOKEN }}"

‎.github/workflows/galaxy.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
name: Publish collection to Ansible Galaxy
3+
4+
on:
5+
release:
6+
types:
7+
- published
8+
9+
jobs:
10+
deploy:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- uses: actions/checkout@v2
14+
15+
# deploy the collection first, because if it fails, we don't want
16+
# to update the galaxy.yml
17+
- name: Deploy the collection
18+
uses: artis3n/ansible_galaxy_collection@v2
19+
with:
20+
api_key: ${{ secrets.GALAXY_API_KEY }}
21+
galaxy_version: ${{ github.event.release.tag_name }}
22+
23+
- name: update galaxy.yml with new version
24+
uses: microsoft/variable-substitution@v1
25+
with:
26+
files: 'galaxy.yml'
27+
env:
28+
version: "${{ github.event.release.tag_name }}"
29+
30+
- name: push galaxy.yml
31+
uses: github-actions-x/[email protected]
32+
with:
33+
github-token: ${{ secrets.GITHUB_TOKEN }}
34+
push-branch: 'master'
35+
commit-message: 'update galaxy.yml with new version'
36+
force-add: 'true'
37+
files: galaxy.yml
38+
name: dev-sec CI
39+
email: [email protected]

‎.github/workflows/mysql_hardening.yml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
---
2+
name: "devsec.mysql_hardening"
3+
on: # yamllint disable-line rule:truthy
4+
workflow_dispatch:
5+
push:
6+
paths:
7+
- 'roles/mysql_hardening/**'
8+
- 'molecule/mysql_hardening/**'
9+
- '.github/workflows/mysql_hardening.yml'
10+
pull_request:
11+
paths:
12+
- 'roles/mysql_hardening/**'
13+
- 'molecule/mysql_hardening/**'
14+
- '.github/workflows/mysql_hardening.yml'
15+
jobs:
16+
build:
17+
runs-on: ubuntu-18.04
18+
env:
19+
PY_COLORS: 1
20+
ANSIBLE_FORCE_COLOR: 1
21+
strategy:
22+
fail-fast: false
23+
matrix:
24+
molecule_distro:
25+
- centos7
26+
- centos8
27+
- ubuntu1604
28+
- ubuntu1804
29+
- ubuntu2004
30+
- debian9
31+
- debian10
32+
# - amazon # geerlingguy.mysql does not support fedora
33+
# - arch # needs to be fixed
34+
# - opensuse_tumbleweed # needs to be fixed
35+
# - fedora # geerlingguy.mysql does not support fedora
36+
steps:
37+
- name: Checkout repo
38+
uses: actions/checkout@v2
39+
with:
40+
path: ansible_collections/devsec/hardening
41+
submodules: true
42+
43+
- name: Set up Python 3.7
44+
uses: actions/setup-python@v1
45+
with:
46+
python-version: 3.7
47+
48+
- name: Install dependencies
49+
run: |
50+
sudo apt install git
51+
python -m pip install --no-cache-dir --upgrade pip
52+
pip install -r requirements.txt
53+
working-directory: ansible_collections/devsec/hardening
54+
55+
- name: Create default collection path symlink
56+
run: |
57+
mkdir -p /home/runner/.ansible
58+
ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
59+
60+
# that was a hard one to fix. robert did it thankfully
61+
# https://github.com/robertdebock/ansible-role-mysql/commit/7562e99099b06282391ab7ed102b393a0406d212
62+
- name: disable apparmor on debian systems
63+
run: |
64+
set -x
65+
sudo apt-get install apparmor-profiles
66+
sudo ln -s /etc/apparmor.d/usr.sbin.mysqld /etc/apparmor.d/disable/
67+
sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.mysqld
68+
if: ${{ startsWith(matrix.molecule_distro, 'Debian') }}
69+
70+
- name: Test with molecule
71+
run: |
72+
molecule --version
73+
molecule test -s mysql_hardening
74+
env:
75+
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
76+
working-directory: ansible_collections/devsec/hardening

‎.github/workflows/nginx_hardening.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
---
2+
name: "devsec.nginx_hardening"
3+
on: # yamllint disable-line rule:truthy
4+
workflow_dispatch:
5+
push:
6+
paths:
7+
- 'roles/nginx_hardening/**'
8+
- 'molecule/nginx_hardening/**'
9+
- '.github/workflows/nginx_hardening.yml'
10+
pull_request:
11+
paths:
12+
- 'roles/nginx_hardening/**'
13+
- 'molecule/nginx_hardening/**'
14+
- '.github/workflows/nginx_hardening.yml'
15+
jobs:
16+
build:
17+
runs-on: ubuntu-18.04
18+
env:
19+
PY_COLORS: 1
20+
ANSIBLE_FORCE_COLOR: 1
21+
strategy:
22+
fail-fast: false
23+
matrix:
24+
molecule_distro:
25+
- centos7
26+
- centos8
27+
- ubuntu1604
28+
- ubuntu1804
29+
- ubuntu2004
30+
- debian9
31+
- debian10
32+
- amazon
33+
# - arch # needs to be fixed
34+
# - opensuse_tumbleweed # needs to be fixed
35+
# - fedora # no support from geerlingguy role
36+
steps:
37+
- name: Checkout repo
38+
uses: actions/checkout@v2
39+
with:
40+
path: ansible_collections/devsec/hardening
41+
submodules: true
42+
43+
- name: Set up Python 3.7
44+
uses: actions/setup-python@v1
45+
with:
46+
python-version: 3.7
47+
48+
- name: Install dependencies
49+
run: |
50+
sudo apt install git
51+
python -m pip install --no-cache-dir --upgrade pip
52+
pip install -r requirements.txt
53+
working-directory: ansible_collections/devsec/hardening
54+
55+
- name: Create default collection path symlink
56+
run: |
57+
mkdir -p /home/runner/.ansible
58+
ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
59+
60+
- name: Test with molecule
61+
run: |
62+
molecule --version
63+
molecule test -s nginx_hardening
64+
env:
65+
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
66+
working-directory: ansible_collections/devsec/hardening

‎.github/workflows/os_hardening.yml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
---
2+
name: "devsec.os_hardening"
3+
on: # yamllint disable-line rule:truthy
4+
workflow_dispatch:
5+
push:
6+
paths:
7+
- 'roles/os_hardening/**'
8+
- 'molecule/os_hardening/**'
9+
- '.github/workflows/os_hardening.yml'
10+
pull_request:
11+
paths:
12+
- 'roles/os_hardening/**'
13+
- 'molecule/os_hardening/**'
14+
- '.github/workflows/os_hardening.yml'
15+
jobs:
16+
build:
17+
runs-on: ubuntu-18.04
18+
env:
19+
PY_COLORS: 1
20+
ANSIBLE_FORCE_COLOR: 1
21+
strategy:
22+
fail-fast: false
23+
matrix:
24+
molecule_distro:
25+
- centos7
26+
- centos8
27+
- ubuntu1604
28+
- ubuntu1804
29+
- ubuntu2004
30+
- debian9
31+
- debian10
32+
- amazon
33+
- opensuse_tumbleweed
34+
# - arch # needs to be fixed
35+
steps:
36+
- name: Checkout repo
37+
uses: actions/checkout@v2
38+
with:
39+
path: ansible_collections/devsec/hardening
40+
submodules: true
41+
42+
- name: Set up Python 3.7
43+
uses: actions/setup-python@v1
44+
with:
45+
python-version: 3.7
46+
47+
- name: Install dependencies
48+
run: |
49+
sudo apt install git
50+
python -m pip install --no-cache-dir --upgrade pip
51+
pip install -r requirements.txt
52+
working-directory: ansible_collections/devsec/hardening
53+
54+
- name: Create default collection path symlink
55+
run: |
56+
mkdir -p /home/runner/.ansible
57+
ln -s /home/runner/work/ansible-os-hardening/ansible-os-hardening /home/runner/.ansible/collections
58+
59+
- name: Test with molecule
60+
run: |
61+
if [ "$MOLECULE_DISTRO" = "opensuse_tumbleweed" ]; then
62+
export MOLECULE_DOCKER_COMMAND="/usr/lib/systemd/systemd"
63+
fi
64+
molecule --version
65+
molecule test -s os_hardening
66+
env:
67+
MOLECULE_DISTRO: ${{ matrix.molecule_distro }}
68+
working-directory: ansible_collections/devsec/hardening

0 commit comments

Comments
 (0)