chore: synced file(s) with honestbank/.github

.checkov.yaml

@@ -0,0 +1,13 @@
+compact: true
+directory:
+- .
+download-external-modules: true
+evaluate-variables: true
+external-modules-download-path: .external_modules
+framework:
+- all
+quiet: true
+skip-path:
+  - .external_modules
+  - modules
+  - catalog-info.yml

.github/CODEOWNERS

@@ -1,8 +1,11 @@
+# DO NOT CHANGE. This file is being managed from a central repository
+# To know more simply visit https://github.com/honestbank/.github/blob/main/docs/about.md
+
 # This is a comment.
 # Each line is a file pattern followed by one or more owners.
 
 # These owners will be the default owners for everything in
 # the repo. Unless a later match takes precedence,
 # @global-owner1 and @global-owner2 will be requested for
 # review when someone opens a pull request.
-*       @honestbank/devops-engineers @honestbank/honestbank-engineers
+*       @honestbank/devops-engineers

.github/pull_request_template.md

@@ -3,8 +3,17 @@
 
 * All PRs should reference an issue in our issue tracker. If one doesn't exist, please create one!
 * PR titles should follow https://www.conventionalcommits.org.
+
 -->
 
+## Pull Request Submission Checklist
+
+Please confirm that you have done the following before requesting reviews:
+
+- [ ] I have confirmed that the PR type is appropriate for the change I am making according to the [Honest Pull Request and Commit Message Naming Conventions](https://www.notion.so/honestbank/Pull-Request-and-Commit-Message-Naming-Conventions-bd97f2cbb34c4c73b1ff3a3e384b850c).
+- [ ] I have typed an adequate description that explains **why** I am making this change.
+- [ ] I have installed and run standard pre-commit hooks that lints and validates my code.
+
 ### Description
 
 * <!-- WRITE A SHORT DESCRIPTION OF CHANGES -->

.github/workflows/checkov.yaml

@@ -0,0 +1,20 @@
+name: "Checkov GitHub Action"
+on:
+  pull_request:
+    branches: [test, dev, qa, prod, main]
+
+jobs:
+  checkov:
+    name: checkov
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+        with:
+          submodules: "recursive"
+          token: ${{ secrets.ENGINEERING_GITHUB_PERSONAL_ACCESS_TOKEN }}
+      - name: Run Checkov
+        id: checkov
+        uses: bridgecrewio/checkov-action@master
+        with:
+          config_file: ".checkov.yaml"

.github/workflows/semantic-pr.yaml

@@ -0,0 +1,18 @@
+# yamllint disable rule:line-length
+# Use template from https://github.com/honestbank/workflows/tree/main/examples/repository-workflows
+---
+name: "repository-semantic-pr"
+permissions: read-all
+
+on:  # yamllint disable-line rule:truthy
+  pull_request:
+    types:
+      - opened
+      - edited
+      - synchronize
+
+jobs:
+  repository-semantic-pr:
+    name: repository-semantic-pr
+    uses: honestbank/workflows/.github/workflows/shared-semantic-pr.yaml@main
+    secrets: inherit

.github/workflows/shiftleft-terraform.yaml

@@ -0,0 +1,26 @@
+---
+# This workflow integrates ShiftLeft NG SAST with GitHub
+# Visit https://docs.shiftleft.io for help
+name: shiftleft-terraform
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  shiftleft-terraform:
+    runs-on: ubuntu-20.04
+    steps:
+    - uses: actions/checkout@v2
+    - run: echo "REPO_NAME=${GITHUB_REPOSITORY#*/}" >> $GITHUB_ENV
+    - name: Download ShiftLeft CLI
+      run: |
+        curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl
+    - name: Extract branch name
+      shell: bash
+      run: echo "##[set-output name=branch;]$(echo ${GITHUB_REF#refs/heads/})"
+      id: extract_branch
+    - name: NextGen Static Analysis
+      run: ${GITHUB_WORKSPACE}/sl analyze --strict --wait --app ${{ env.REPO_NAME}} --tag branch=${{ github.head_ref || steps.extract_branch.outputs.branch }} --terraform $(pwd)
+      env:
+        SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }}

.pre-commit-config.yaml

@@ -1,18 +1,33 @@
+# DO NOT CHANGE. This file is being managed from a central repository
+# To know more simply visit https://github.com/honestbank/.github/blob/main/docs/about.md
+
 # See https://pre-commit.com for more information
 # See https://pre-commit.com/hooks.html for more hooks
+
 repos:
-  -   repo: https://github.com/pre-commit/pre-commit-hooks
-      rev: v3.2.0
-      hooks:
-        -   id: trailing-whitespace
-        -   id: end-of-file-fixer
-        -   id: check-yaml
-        -   id: check-added-large-files
-  - repo: git://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.48.0 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.4.0 # Get the latest from: https://github.com/pre-commit/pre-commit-hooks/releases
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-added-large-files
+      - id: detect-aws-credentials
+        args: ["--allow-missing-credentials"]
+  - repo: https://github.com/antonbabenko/pre-commit-terraform
+    rev: v1.77.0 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases
     hooks:
       - id: terraform_fmt
       - id: terraform_docs
-      - id: terraform_validate # Disabled due to flakiness
-#      - id: terraform_tfsec # Temporarily disabled due to PSP warnings on GKE
-#      - id: checkov # Disabled due to crashing
+      - id: terraform_validate
+      - id: terraform_tfsec
+        exclude: "test/"
+      - id: terraform_checkov
+        exclude: "test/"
+  -   repo: https://github.com/gitguardian/ggshield
+      rev: v1.14.2
+      hooks:
+        - id: ggshield
+          language: python
+          stages: [commit]
+          args: [ 'secret', 'scan', 'pre-commit' ]