From 1b0576695eb166fcf6708f13ef3de982599c630e Mon Sep 17 00:00:00 2001 From: Moritz <15136847+Nemental@users.noreply.github.com> Date: Wed, 25 Oct 2023 15:10:02 +0200 Subject: [PATCH] feat: workflow for roles readme (#705) * chore: added aar_doc config Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * feat: added initial state of roles readme workflow Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * fix: runs on Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * fix: install poetry Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * feat: loop over all roles and install peotry with pip Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * fix: working dir for poetry run Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * fix: cli path Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * chore: scale down matrix loop for testing Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * fix: poetry run for py execution command Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * fix: work dir for poetry run Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * fix: cli.py path Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * fix: roles path Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * feat: push readme Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * fix: on push branch master Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * fix: uncomment other roles Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * chore: limit trigger to master and arguments Co-authored-by: Sebastian Gumprich Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * fix: push branch name Co-authored-by: Sebastian Gumprich Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * refactor: simplify steps Co-authored-by: Sebastian Gumprich Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * style: linting and styling Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * chore: trigger for pull request Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * fix: push only if ref is master Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * chore: output diff of generated README Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * fix: push readme in pull request Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * docs: role var description text Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * fix: aar_doc roles path Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * fix: git diff Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * fix: fetch all history and changed diff branch Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * fix: run diff only for pr Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * fix: remove fetch-depth and switch to normal diff Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * fix: remove diff and set push-branch Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> * fix: head_ref with default ref_name for push-branch Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> --------- Signed-off-by: Nemental <15136847+Nemental@users.noreply.github.com> Co-authored-by: Sebastian Gumprich --- .aar_doc.yml | 44 +++++++++++++++++++ .github/workflows/roles-readme.yml | 47 +++++++++++++++++++++ roles/ssh_hardening/meta/argument_specs.yml | 4 +- 3 files changed, 93 insertions(+), 2 deletions(-) create mode 100644 .aar_doc.yml create mode 100644 .github/workflows/roles-readme.yml diff --git a/.aar_doc.yml b/.aar_doc.yml new file mode 100644 index 00000000..492f023c --- /dev/null +++ b/.aar_doc.yml @@ -0,0 +1,44 @@ +output_template: | + + + ## Supported Operating Systems + + {%- for platform in metadata.galaxy_info.platforms %} + - {{ platform.name }} + {%- if "versions" in platform %} + - {{ platform.versions | default([]) | join(', ') }} + {%- endif %} + {%- endfor %} + + ## Role Variables + {% for entrypoint in argument_specs.keys() %} + {%- set path, options=entrypoint_options[entrypoint][0] -%} + {%- for name, details in options.items() |sort() %} + - `{{ name }}` + - Default: `{{ details.display_default }}` + - Description: {{ details.display_description }} + - Type: {{ details.display_type }} + - Required: {{ details.display_required }} + {%- endfor %} + {%- endfor %} + + ## Dependencies + + {%- if ("dependencies" in metadata) and (metadata.dependencies | length > 0) %} + {%- for dependency in metadata.dependencies %} + - {{ dependency }} + {%- endfor %} + {%- else %} + + None. + {%- endif %} + + ## Example Playbook + + ``` + - hosts: all + roles: + - name: {{ role }} + ``` + + diff --git a/.github/workflows/roles-readme.yml b/.github/workflows/roles-readme.yml new file mode 100644 index 00000000..4651b1d6 --- /dev/null +++ b/.github/workflows/roles-readme.yml @@ -0,0 +1,47 @@ +--- +name: create roles readme + +on: # yamllint disable-line rule:truthy + push: + branches: [master] + paths: + - 'roles/**/meta/argument_specs.yml' + pull_request: + branches: [master] + paths: + - 'roles/**/meta/argument_specs.yml' + +jobs: + readme: + name: create roles readme + runs-on: ubuntu-latest + strategy: + matrix: + roles: + - mysql_hardening + - nginx_hardening + - os_hardening + - ssh_hardening + steps: + - name: Check out code + uses: actions/checkout@v4 + + - name: Set up Python + uses: actions/setup-python@v4 + with: + python-version: 3.11 + + - name: Install aar_doc + run: pip3 install aar_doc + + - name: Run aar_doc + run: aar_doc roles/${{ matrix.roles }} markdown + + - name: Push README + uses: github-actions-x/commit@v2.9 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + push-branch: ${{ github.head_ref ?? github.ref_name }} + commit-message: 'update ${{ matrix.roles }} readme' + files: roles/${{ matrix.roles }}/README.md + rebase: true diff --git a/roles/ssh_hardening/meta/argument_specs.yml b/roles/ssh_hardening/meta/argument_specs.yml index da60c1b6..44b39891 100644 --- a/roles/ssh_hardening/meta/argument_specs.yml +++ b/roles/ssh_hardening/meta/argument_specs.yml @@ -221,7 +221,7 @@ argument_specs: ssh_client_hardening: default: true type: bool - description: '`false` to stop harden the client.' + description: Set to `false` to stop harden the client. ssh_client_compression: default: false type: bool @@ -256,7 +256,7 @@ argument_specs: ssh_server_hardening: default: true type: bool - description: '`false` to stop harden the server.' + description: Set to `false` to stop harden the server. ssh_server_match_address: default: '' description: Introduces a conditional block. If all of the criteria on the