From 10649b5e5e96046b828ce74014b6176d27e16d5d Mon Sep 17 00:00:00 2001 From: Andrey Novik Date: Fri, 14 Aug 2026 10:20:11 +0300 Subject: [PATCH] chore: migrate to reusable workflows (#63091) - Add sast.yaml as inline local copy (public repo), exclude .github/workflows; SHA-pinned - Add trivy-scan.yaml as inline local copy (public repo); SHA-pinned - Add verify-linked-issue.yaml as inline local copy (public repo); SHA-pinned - Replace back-merge-handler.yml with reusable back-merge@f9848fa (main) - Update renovate.json to canonical template --- .github/workflows/back-merge.yaml | 16 +++++++ .github/workflows/sast.yaml | 47 ++++++++++++++++++++ .github/workflows/trivy-scan.yaml | 32 ++++++++++++++ .github/workflows/verify-linked-issue.yaml | 50 ++++++++++++++++++++++ renovate.json | 42 ++++++++++++++++++ 5 files changed, 187 insertions(+) create mode 100644 .github/workflows/back-merge.yaml create mode 100644 .github/workflows/sast.yaml create mode 100644 .github/workflows/trivy-scan.yaml create mode 100644 .github/workflows/verify-linked-issue.yaml create mode 100644 renovate.json diff --git a/.github/workflows/back-merge.yaml b/.github/workflows/back-merge.yaml new file mode 100644 index 0000000..37f44cd --- /dev/null +++ b/.github/workflows/back-merge.yaml @@ -0,0 +1,16 @@ +name: Back Merge + +on: + push: + branches: + - master + - stable + +jobs: + back-merge: + uses: regulaforensics/reusable-workflows/.github/workflows/back-merge.yaml@f9848fa9ec1ae1e6285b56200ac1f24fbfaee0c3 # main + with: + source_branch: ${{ github.ref_name }} + merge_pairs: "master:stable,stable:develop" + secrets: + token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/sast.yaml b/.github/workflows/sast.yaml new file mode 100644 index 0000000..5955471 --- /dev/null +++ b/.github/workflows/sast.yaml @@ -0,0 +1,47 @@ +# This repository is public and cannot call reusable workflows from a private +# repository (regulaforensics/reusable-workflows). The logic below is a local +# copy that mirrors the reusable workflow exactly. SHA pins are kept up-to-date +# by Renovate (see renovate.json). +name: SAST + +on: + pull_request: + branches: + - develop + - staging + - production + - stable + - main + - master + +jobs: + semgrep: + name: semgrep-oss/scan + runs-on: ubuntu-latest + container: + image: semgrep/semgrep@sha256:bdf7013b2c3634a487671158da77c554f531742326b543a9464d2adf6c433ac8 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - name: Scan + shell: bash + env: + # Exclude existing .github/workflows/*.yml — they use mutable action tags. + # Pinning those files is tracked separately. + EXCLUDE_PATHS: '.github/workflows' + EXCLUDE_RULES: '' + run: | + EXCLUDED_PATHS=() + if [[ -n "$EXCLUDE_PATHS" ]]; then + for path in $EXCLUDE_PATHS; do + EXCLUDED_PATHS+=("--exclude" "$path") + done + fi + + EXCLUDED_RULES=() + if [[ -n "$EXCLUDE_RULES" ]]; then + for rule in $EXCLUDE_RULES; do + EXCLUDED_RULES+=("--exclude-rule" "$rule") + done + fi + + semgrep scan --config auto "${EXCLUDED_PATHS[@]}" "${EXCLUDED_RULES[@]}" --error --verbose diff --git a/.github/workflows/trivy-scan.yaml b/.github/workflows/trivy-scan.yaml new file mode 100644 index 0000000..df8bcfc --- /dev/null +++ b/.github/workflows/trivy-scan.yaml @@ -0,0 +1,32 @@ +# This repository is public and cannot call reusable workflows from a private +# repository (regulaforensics/reusable-workflows). The logic below is a local +# copy that mirrors the reusable workflow exactly. SHA pins are kept up-to-date +# by Renovate (see renovate.json). +name: Trivy Scan + +on: + pull_request: + branches: + - develop + - staging + - production + - stable + - main + - master + +jobs: + trivy-scan: + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - name: Run Trivy scanner + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 + with: + scan-type: 'fs' + exit-code: '1' + ignore-unfixed: true + severity: 'CRITICAL,HIGH,MEDIUM,LOW' + env: + TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2 diff --git a/.github/workflows/verify-linked-issue.yaml b/.github/workflows/verify-linked-issue.yaml new file mode 100644 index 0000000..a7801a6 --- /dev/null +++ b/.github/workflows/verify-linked-issue.yaml @@ -0,0 +1,50 @@ +# This repository is public and cannot call reusable workflows from a private +# repository (regulaforensics/reusable-workflows). The logic below is a local +# copy that mirrors the reusable workflow exactly. SHA pins are kept up-to-date +# by Renovate (see renovate.json). +name: Verify Issue + +on: + pull_request: + types: [edited, synchronize, opened, reopened] + +jobs: + verify_linked_issue: + runs-on: ubuntu-latest + name: PR has a linked issue. + steps: + - name: Verify Linked Issue + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + with: + script: | + const skipBranchPattern = ''; + const issueUrlPattern = 'https://redmine.regulaforensics.com/'; + const clickupUrlPattern = 'https://app.clickup.com/'; + const pr = context.payload.pull_request; + + if (skipBranchPattern && pr.head.ref.startsWith(skipBranchPattern)) { + console.log(`Skipping verification — branch "${pr.head.ref}" matches skip pattern "${skipBranchPattern}".`); + return; + } + + if (!pr.body) { + console.log("No Linked Issue Found!"); + core.setFailed('No linked issue found in the pull request description.'); + return; + } + + const hasRedmineIssue = issueUrlPattern && pr.body.includes(issueUrlPattern); + const hasClickupIssue = clickupUrlPattern && pr.body.includes(clickupUrlPattern); + + if (!hasRedmineIssue && !hasClickupIssue) { + console.log("No Linked Issue Found!"); + core.setFailed('No linked issue found in the pull request description.'); + return; + } + + if (hasRedmineIssue) { + console.log(`Linked issue found matching pattern "${issueUrlPattern}".`); + } + if (hasClickupIssue) { + console.log(`Linked issue found matching pattern "${clickupUrlPattern}".`); + } diff --git a/renovate.json b/renovate.json new file mode 100644 index 0000000..d952d9d --- /dev/null +++ b/renovate.json @@ -0,0 +1,42 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "config:recommended", + "helpers:pinGitHubActionDigests" + ], + "enabledManagers": [ + "github-actions" + ], + "labels": [ + "dependencies" + ], + "prBodyNotes": [ + "https://redmine.regulaforensics.com/issues/58096" + ], + "packageRules": [ + { + "description": "Update all GitHub Actions to latest, including major version bumps", + "matchManagers": [ + "github-actions" + ], + "groupName": "GitHub Actions dependencies", + "groupSlug": "github-actions-deps", + "matchUpdateTypes": [ + "major", + "minor", + "patch", + "pin", + "digest" + ], + "schedule": [ + "before 6am on wednesday" + ], + "automerge": false, + "enabled": true + } + ], + "github-actions": { + "enabled": true, + "pinDigests": true + } +}