Skip to content

Commit b5eff64

Browse files
authored
fix: mark outputs as sensitive (#118)
1 parent 9aaf88b commit b5eff64

File tree

21 files changed

+157
-86
lines changed

21 files changed

+157
-86
lines changed

.github/CODEOWNERS

+4-3
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,10 @@
1515

1616
# Cloud Posse must review any changes to standard context definition,
1717
# but some changes can be rubber-stamped.
18-
**/context.tf @cloudposse/engineering @cloudposse/approvers
19-
README.md @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers
20-
docs/*.md @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers
18+
**/*.tf @cloudposse/engineering @cloudposse/approvers
19+
README.yaml @cloudposse/engineering @cloudposse/approvers
20+
README.md @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers
21+
docs/*.md @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers
2122

2223
# Cloud Posse Admins must review all changes to CODEOWNERS or the mergify configuration
2324
.github/mergify.yml @cloudposse/admins

.github/auto-release.yml

+8
Original file line numberDiff line numberDiff line change
@@ -43,3 +43,11 @@ change-template: |
4343
4444
template: |
4545
$CHANGES
46+
47+
replacers:
48+
# Remove irrelevant information from Renovate bot
49+
- search: '/---\s+^#.*Renovate configuration(?:.|\n)*?This PR has been generated .*/gm'
50+
replace: ''
51+
# Remove Renovate bot banner image
52+
- search: '/\[!\[[^\]]*Renovate\][^\]]*\](\([^)]*\))?\s*\n+/gm'
53+
replace: ''

.github/mergify.yml

+17-11
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,16 @@
1+
# https://docs.mergify.io/conditions.html
2+
# https://docs.mergify.io/actions.html
13
pull_request_rules:
24
- name: "approve automated PRs that have passed checks"
35
conditions:
4-
- "check-success~=test/bats"
5-
- "check-success~=test/readme"
6-
- "check-success~=test/terratest"
6+
- "author~=^(cloudpossebot|renovate\\[bot\\])$"
77
- "base=master"
8-
- "author=cloudpossebot"
9-
- "head~=auto-update/.*"
8+
- "-closed"
9+
- "head~=^(auto-update|renovate)/.*"
10+
- "check-success=test/bats"
11+
- "check-success=test/readme"
12+
- "check-success=test/terratest"
13+
- "check-success=validate-codeowners"
1014
actions:
1115
review:
1216
type: "APPROVE"
@@ -15,16 +19,17 @@ pull_request_rules:
1519

1620
- name: "merge automated PRs when approved and tests pass"
1721
conditions:
18-
- "check-success~=test/bats"
19-
- "check-success~=test/readme"
20-
- "check-success~=test/terratest"
22+
- "author~=^(cloudpossebot|renovate\\[bot\\])$"
2123
- "base=master"
22-
- "head~=auto-update/.*"
24+
- "-closed"
25+
- "head~=^(auto-update|renovate)/.*"
26+
- "check-success=test/bats"
27+
- "check-success=test/readme"
28+
- "check-success=test/terratest"
29+
- "check-success=validate-codeowners"
2330
- "#approved-reviews-by>=1"
2431
- "#changes-requested-reviews-by=0"
2532
- "#commented-reviews-by=0"
26-
- "base=master"
27-
- "author=cloudpossebot"
2833
actions:
2934
merge:
3035
method: "squash"
@@ -38,6 +43,7 @@ pull_request_rules:
3843
- name: "ask to resolve conflict"
3944
conditions:
4045
- "conflict"
46+
- "-closed"
4147
actions:
4248
comment:
4349
message: "This pull request is now in conflict. Could you fix it @{{author}}? 🙏"

.github/renovate.json

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"extends": [
3+
"config:base",
4+
":preserveSemverRanges"
5+
],
6+
"labels": ["auto-update"],
7+
"enabledManagers": ["terraform"],
8+
"terraform": {
9+
"ignorePaths": ["**/context.tf", "examples/**"]
10+
}
11+
}
12+

.github/workflows/auto-context.yml

-55
This file was deleted.

.github/workflows/auto-format.yml

+86
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
name: Auto Format
2+
on:
3+
pull_request_target:
4+
types: [opened, synchronize]
5+
6+
jobs:
7+
auto-format:
8+
runs-on: ubuntu-latest
9+
container: cloudposse/build-harness:slim-latest
10+
steps:
11+
# Checkout the pull request branch
12+
# "An action in a workflow run can’t trigger a new workflow run. For example, if an action pushes code using
13+
# the repository’s GITHUB_TOKEN, a new workflow will not run even when the repository contains
14+
# a workflow configured to run when push events occur."
15+
# However, using a personal access token will cause events to be triggered.
16+
# We need that to ensure a status gets posted after the auto-format commit.
17+
# We also want to trigger tests if the auto-format made no changes.
18+
- uses: actions/checkout@v2
19+
if: github.event.pull_request.state == 'open'
20+
name: Privileged Checkout
21+
with:
22+
token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
23+
repository: ${{ github.event.pull_request.head.repo.full_name }}
24+
# Check out the PR commit, not the merge commit
25+
# Use `ref` instead of `sha` to enable pushing back to `ref`
26+
ref: ${{ github.event.pull_request.head.ref }}
27+
28+
# Do all the formatting stuff
29+
- name: Auto Format
30+
if: github.event.pull_request.state == 'open'
31+
shell: bash
32+
run: make BUILD_HARNESS_PATH=/build-harness PACKAGES_PREFER_HOST=true -f /build-harness/templates/Makefile.build-harness pr/auto-format/host
33+
34+
# Commit changes (if any) to the PR branch
35+
- name: Commit changes to the PR branch
36+
if: github.event.pull_request.state == 'open'
37+
shell: bash
38+
id: commit
39+
env:
40+
SENDER: ${{ github.event.sender.login }}
41+
run: |
42+
set -x
43+
output=$(git diff --name-only)
44+
45+
if [ -n "$output" ]; then
46+
echo "Changes detected. Pushing to the PR branch"
47+
git config --global user.name 'cloudpossebot'
48+
git config --global user.email '[email protected]'
49+
git add -A
50+
git commit -m "Auto Format"
51+
# Prevent looping by not pushing changes in response to changes from cloudpossebot
52+
[[ $SENDER == "cloudpossebot" ]] || git push
53+
# Set status to fail, because the push should trigger another status check,
54+
# and we use success to indicate the checks are finished.
55+
printf "::set-output name=%s::%s\n" "changed" "true"
56+
exit 1
57+
else
58+
printf "::set-output name=%s::%s\n" "changed" "false"
59+
echo "No changes detected"
60+
fi
61+
62+
- name: Auto Test
63+
uses: cloudposse/actions/github/[email protected]
64+
# match users by ID because logins (user names) are inconsistent,
65+
# for example in the REST API Renovate Bot is `renovate[bot]` but
66+
# in GraphQL it is just `renovate`, plus there is a non-bot
67+
# user `renovate` with ID 1832810.
68+
# Mergify bot: 37929162
69+
# Renovate bot: 29139614
70+
# Cloudpossebot: 11232728
71+
# Need to use space separators to prevent "21" from matching "112144"
72+
if: >
73+
contains(' 37929162 29139614 11232728 ', format(' {0} ', github.event.pull_request.user.id))
74+
&& steps.commit.outputs.changed == 'false' && github.event.pull_request.state == 'open'
75+
with:
76+
token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
77+
repository: cloudposse/actions
78+
event-type: test-command
79+
client-payload: |-
80+
{ "slash_command":{"args": {"unnamed": {"all": "all", "arg1": "all"}}},
81+
"pull_request": ${{ toJSON(github.event.pull_request) }},
82+
"github":{"payload":{"repository": ${{ toJSON(github.event.repository) }},
83+
"comment": {"id": ""}
84+
}
85+
}
86+
}

.github/workflows/auto-release.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ on:
66
- master
77

88
jobs:
9-
semver:
9+
publish:
1010
runs-on: ubuntu-latest
1111
steps:
1212
# Drafts your next Release notes as Pull Requests are merged into "master"

.github/workflows/validate-codeowners.yml

+8-1
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,18 @@ jobs:
88
steps:
99
- name: "Checkout source code at current commit"
1010
uses: actions/checkout@v2
11-
- uses: mszostok/[email protected]
11+
- uses: mszostok/[email protected]
12+
if: github.event.pull_request.head.repo.full_name == github.repository
13+
name: "Full check of CODEOWNERS"
1214
with:
1315
# For now, remove "files" check to allow CODEOWNERS to specify non-existent
1416
# files so we can use the same CODEOWNERS file for Terraform and non-Terraform repos
1517
# checks: "files,syntax,owners,duppatterns"
1618
checks: "syntax,owners,duppatterns"
1719
# GitHub access token is required only if the `owners` check is enabled
1820
github_access_token: "${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}"
21+
- uses: mszostok/[email protected]
22+
if: github.event.pull_request.head.repo.full_name != github.repository
23+
name: "Syntax check of CODEOWNERS"
24+
with:
25+
checks: "syntax,duppatterns"

README.md

+5-1
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,10 @@ The table below correctly indicates which inputs are required.
9898

9999
This module is meant to be used as output only, meaning it will be used to create outputs which are consumed as a parameter by Terraform resources or other modules.
100100

101+
Caution: This module, unlike nearly all other Cloud Posse Terraform modules, does not use [terraform-null-label](https://github.com/cloudposse/terraform-null-label/).
102+
Furthermore, it has an input named `environment` which has a completely different meaning than the one in `terraform-null-label`.
103+
Do not call this module with the conventional `context = module.this.context`. See the documentation below for the usage of `environment`.
104+
101105
For complete examples, see
102106

103107
- [multi-port mappings](examples/multi_port_mappings)
@@ -129,7 +133,7 @@ Available targets:
129133

130134
| Name | Version |
131135
|------|---------|
132-
| terraform | >= 0.13.0 |
136+
| terraform | >= 0.12.26 |
133137
| local | >= 1.2 |
134138

135139
## Providers

README.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,10 @@ description: Terraform module to generate well-formed JSON documents that are pa
4646
usage: |-
4747
This module is meant to be used as output only, meaning it will be used to create outputs which are consumed as a parameter by Terraform resources or other modules.
4848
49+
Caution: This module, unlike nearly all other Cloud Posse Terraform modules, does not use [terraform-null-label](https://github.com/cloudposse/terraform-null-label/).
50+
Furthermore, it has an input named `environment` which has a completely different meaning than the one in `terraform-null-label`.
51+
Do not call this module with the conventional `context = module.this.context`. See the documentation below for the usage of `environment`.
52+
4953
For complete examples, see
5054
5155
- [multi-port mappings](examples/multi_port_mappings)

docs/terraform.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
| Name | Version |
55
|------|---------|
6-
| terraform | >= 0.13.0 |
6+
| terraform | >= 0.12.26 |
77
| local | >= 1.2 |
88

99
## Providers

examples/complete/versions.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
terraform {
2-
required_version = ">= 0.13.0"
2+
required_version = ">= 0.12.26"
33

44
required_providers {
55
local = {

examples/env_vars_files/versions.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
terraform {
2-
required_version = ">= 0.13.0"
2+
required_version = ">= 0.12.26"
33

44
required_providers {
55
local = {

examples/map_environment/versions.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
terraform {
2-
required_version = ">= 0.13.0"
2+
required_version = ">= 0.12.26"
33

44
required_providers {
55
local = {

examples/multi_port_mappings/versions.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
terraform {
2-
required_version = ">= 0.13.0"
2+
required_version = ">= 0.12.26"
33

44
required_providers {
55
local = {

examples/multi_type_env_vars/versions.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
terraform {
2-
required_version = ">= 0.13.0"
2+
required_version = ">= 0.12.26"
33

44
required_providers {
55
local = {

examples/multiple_definitions/versions.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
terraform {
2-
required_version = ">= 0.13.0"
2+
required_version = ">= 0.12.26"
33

44
required_providers {
55
local = {

examples/string_env_vars/versions.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
terraform {
2-
required_version = ">= 0.13.0"
2+
required_version = ">= 0.12.26"
33

44
required_providers {
55
local = {

outputs.tf

+3
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,17 @@
11
output "json_map_encoded_list" {
22
description = "JSON string encoded list of container definitions for use with other terraform resources such as aws_ecs_task_definition"
33
value = "[${local.json_map}]"
4+
sensitive = true
45
}
56

67
output "json_map_encoded" {
78
description = "JSON string encoded container definitions for use with other terraform resources such as aws_ecs_task_definition"
89
value = local.json_map
10+
sensitive = true
911
}
1012

1113
output "json_map_object" {
1214
description = "JSON map encoded container definition"
1315
value = jsondecode(local.json_map)
16+
sensitive = true
1417
}

renovate.json

-5
This file was deleted.

versions.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
terraform {
2-
required_version = ">= 0.13.0"
2+
required_version = ">= 0.12.26"
33

44
required_providers {
55
local = {

0 commit comments

Comments
 (0)