Merge pull request #3 from ansible-lockdown/devel

2023 September Devel to Main

.ansible-lint

@@ -0,0 +1,23 @@
+---
+
+parseable: true
+quiet: true
+skip_list:
+    - 'schema'
+    - 'no-changed-when'
+    - 'experimental'
+    - 'name[casing]'
+    - 'name[template]'
+    - 'jinja[spacing]'
+    - 'yaml[line-length]'
+    - 'key-order[task]'
+    - 'var-naming'  # Older playbook no new release
+    - '204'
+    - '208'
+    - '305'
+    - '303'
+    - '403'
+    - '306'
+    - '602'
+use_default_rules: true
+verbosity: 0

.gitattributes

@@ -0,0 +1,6 @@
+# adding github settings to show correct language
+*.sh linguist-detectable=true
+*.yml linguist-detectable=true
+*.ps1 linguist-detectable=true
+*.j2 linguist-detectable=true
+*.md linguist-documentation

.github/workflows/devel_pipeline_validation.yml

@@ -0,0 +1,143 @@
+---
+
+# This is a basic workflow to help you get started with Actions
+
+name: Devel Pipeline Validation
+
+# Controls when the action will run.
+# Triggers the workflow on push or pull request
+# events but only for the devel branch
+on:  # yamllint disable-line rule:truthy
+    pull_request_target:
+        types: [opened, reopened, synchronize]
+        branches:
+            - devel
+        paths:
+            - '**.yml'
+            - '**.sh'
+            - '**.j2'
+            - '**.ps1'
+            - '**.cfg'
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+# This setion contains all the jobs below that are running in the workflow.
+jobs:
+    # This will create messages for first time contributers and direct them to the Discord server
+    welcome:
+        # The type of runner that the job will run on.
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/first-interaction@main
+              with:
+                  repo-token: ${{ secrets.GITHUB_TOKEN }}
+                  pr-message: |-
+                    Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
+                    Please join in the conversation happening on the [Discord Server](https://discord.io/ansible-lockdown) as well.
+
+    # This workflow will run terraform to load a instance in azure to test the playbook against a live cloud based instance.
+    playbook-test:
+        # The type of runner that the job will run on.
+        runs-on: ubuntu-latest
+
+        env:
+            ENABLE_DEBUG: false
+            # Imported as a variable by terraform.
+            TF_VAR_repository: ${{ github.event.repository.name }}
+            ARM_CLIENT_ID: ${{ secrets.AZURE_AD_CLIENT_ID }}
+            ARM_CLIENT_SECRET: ${{ secrets.AZURE_AD_CLIENT_SECRET }}
+            ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+            ARM_TENANT_ID: ${{ secrets.AZURE_AD_TENANT_ID }}
+            WIN_USERNAME: ${{ secrets.WIN_USERNAME }}
+            WIN_PASSWORD: ${{ secrets.WIN_PASSWORD }}
+
+        defaults:
+            run:
+                shell: bash
+                working-directory: .github/workflows/github_windows_IaC
+
+        # Steps represent a sequence of tasks that will be executed as part of the job.
+        steps:
+          # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it.
+            - name: Clone ${{ github.event.repository.name }}
+              uses: actions/checkout@v3
+              with:
+                  ref: ${{ github.event.pull_request.head.sha }}
+
+          # Pull In Terraform Code For Windows Azure
+            - name: Clone github IaC plan
+              uses: actions/checkout@v3
+              with:
+                  repository: ansible-lockdown/github_windows_IaC
+                  path: .github/workflows/github_windows_IaC
+
+          # Sensitive Data Stored And Passed To Terraform
+          # Default Working Dir Defined In Defaults Above.
+            - name: user details
+              run: echo "{\"username\":\"${WIN_USERNAME}\",\"password\":\"${WIN_PASSWORD}\"}" >> sensitive_info.json
+
+          # Show the Os Var and Benchmark Type And Load
+            - name: DEBUG - Show IaC files
+              if: env.ENABLE_DEBUG == 'true'
+              run: |
+                echo "OSVAR = $OSVAR"
+                echo "benchmark_type = $benchmark_type"
+                pwd
+                ls
+              env:
+                  # Imported from github variables this is used to load the relvent OS.tfvars file
+                  OSVAR: ${{ vars.OSVAR }}
+                  TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+
+          # Initialize The Terraform Working Directory
+            - name: Terraform_Init
+              id: init
+              run: terraform init
+              env:
+                # Imported from github variables this is used to load the relvent OS.tfvars file
+                  OSVAR: ${{ vars.OSVAR }}
+                  TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+
+          # Validate The Syntax Of Terraform Files
+            - name: Terraform_Validate
+              id: validate
+              run: terraform validate
+              env:
+                # Imported from github variables this is used to load the relvent OS.tfvars file
+                  OSVAR: ${{ vars.OSVAR }}
+                  TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+
+          # Execute The Actions And Build Azure Server
+            - name: Terraform_Apply
+              id: apply
+              env:
+                # Imported from github variables this is used to load the relvent OS.tfvars file
+                  WIN_USERNAME: ${{ secrets.WIN_USERNAME }}
+                  WIN_PASSWORD: ${{ secrets.WIN_PASSWORD }}
+                  OSVAR: ${{ vars.OSVAR }}
+                  TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+              run: terraform apply -var-file "${OSVAR}.tfvars" --auto-approve
+
+          # Debug Section
+            - name: DEBUG - Show Ansible Hostfile
+              if: env.ENABLE_DEBUG == 'true'
+              run: cat hosts.yml
+
+          # Run the Ansible Playbook
+            - name: Run_Ansible_Playbook
+              uses: arillso/action.playbook@master
+              with:
+                  playbook: site.yml
+                  inventory: .github/workflows/github_windows_IaC/hosts.yml
+                  galaxy_file: collections/requirements.yml
+          # verbose: 3
+              env:
+                  ANSIBLE_HOST_KEY_CHECKING: "false"
+                  ANSIBLE_DEPRECATION_WARNINGS: "false"
+
+          # Destroy The Azure Test System
+            - name: Terraform_Destroy
+              if: always() && env.ENABLE_DEBUG == 'false'
+              env:
+                  OSVAR: ${{ vars.OSVAR }}
+                  TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+              run: terraform destroy -var-file "${OSVAR}.tfvars" --auto-approve

.github/workflows/main_pipeline_validation.yml

@@ -0,0 +1,131 @@
+---
+
+# This is a basic workflow to help you get started with Actions
+
+name: Main Pipeline Validation
+
+# Controls when the action will run.
+# Triggers the workflow on push or pull request
+# events but only for the devel branch
+on:  # yamllint disable-line rule:truthy
+    pull_request_target:
+        types: [opened, reopened, synchronize]
+        branches:
+            - main
+        paths:
+            - '**.yml'
+            - '**.sh'
+            - '**.j2'
+            - '**.ps1'
+            - '**.cfg'
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+# This setion contains all the jobs below that are running in the workflow.
+jobs:
+    # This workflow will run terraform to load a instance in azure to test the playbook against a live cloud based instance.
+    playbook-test:
+        # The type of runner that the job will run on.
+        runs-on: ubuntu-latest
+
+        env:
+            ENABLE_DEBUG: false
+            # Imported as a variable by terraform.
+            TF_VAR_repository: ${{ github.event.repository.name }}
+            ARM_CLIENT_ID: ${{ secrets.AZURE_AD_CLIENT_ID }}
+            ARM_CLIENT_SECRET: ${{ secrets.AZURE_AD_CLIENT_SECRET }}
+            ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+            ARM_TENANT_ID: ${{ secrets.AZURE_AD_TENANT_ID }}
+            WIN_USERNAME: ${{ secrets.WIN_USERNAME }}
+            WIN_PASSWORD: ${{ secrets.WIN_PASSWORD }}
+
+        defaults:
+            run:
+                shell: bash
+                working-directory: .github/workflows/github_windows_IaC
+
+        # Steps represent a sequence of tasks that will be executed as part of the job.
+        steps:
+          # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it.
+            - name: Clone ${{ github.event.repository.name }}
+              uses: actions/checkout@v3
+              with:
+                  ref: ${{ github.event.pull_request.head.sha }}
+
+          # Pull In Terraform Code For Windows Azure
+            - name: Clone github IaC plan
+              uses: actions/checkout@v3
+              with:
+                  repository: ansible-lockdown/github_windows_IaC
+                  path: .github/workflows/github_windows_IaC
+
+          # Sensitive Data Stored And Passed To Terraform
+          # Default Working Dir Defined In Defaults Above.
+            - name: user details
+              run: echo "{\"username\":\"${WIN_USERNAME}\",\"password\":\"${WIN_PASSWORD}\"}" >> sensitive_info.json
+
+          # Show the Os Var and Benchmark Type And Load
+            - name: DEBUG - Show IaC files
+              if: env.ENABLE_DEBUG == 'true'
+              run: |
+                echo "OSVAR = $OSVAR"
+                echo "benchmark_type = $benchmark_type"
+                pwd
+                ls
+              env:
+                  # Imported from github variables this is used to load the relvent OS.tfvars file
+                  OSVAR: ${{ vars.OSVAR }}
+                  TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+
+          # Initialize The Terraform Working Directory
+            - name: Terraform_Init
+              id: init
+              run: terraform init
+              env:
+                # Imported from github variables this is used to load the relvent OS.tfvars file
+                  OSVAR: ${{ vars.OSVAR }}
+                  TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+
+          # Validate The Syntax Of Terraform Files
+            - name: Terraform_Validate
+              id: validate
+              run: terraform validate
+              env:
+                # Imported from github variables this is used to load the relvent OS.tfvars file
+                  OSVAR: ${{ vars.OSVAR }}
+                  TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+
+          # Execute The Actions And Build Azure Server
+            - name: Terraform_Apply
+              id: apply
+              env:
+                # Imported from github variables this is used to load the relvent OS.tfvars file
+                  WIN_USERNAME: ${{ secrets.WIN_USERNAME }}
+                  WIN_PASSWORD: ${{ secrets.WIN_PASSWORD }}
+                  OSVAR: ${{ vars.OSVAR }}
+                  TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+              run: terraform apply -var-file "${OSVAR}.tfvars" --auto-approve
+
+          # Debug Section
+            - name: DEBUG - Show Ansible Hostfile
+              if: env.ENABLE_DEBUG == 'true'
+              run: cat hosts.yml
+
+          # Run the Ansible Playbook
+            - name: Run_Ansible_Playbook
+              uses: arillso/action.playbook@master
+              with:
+                  playbook: site.yml
+                  inventory: .github/workflows/github_windows_IaC/hosts.yml
+                  galaxy_file: collections/requirements.yml
+          # verbose: 3
+              env:
+                  ANSIBLE_HOST_KEY_CHECKING: "false"
+                  ANSIBLE_DEPRECATION_WARNINGS: "false"
+
+          # Destroy The Azure Test System
+            - name: Terraform_Destroy
+              if: always() && env.ENABLE_DEBUG == 'false'
+              env:
+                  OSVAR: ${{ vars.OSVAR }}
+                  TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
+              run: terraform destroy -var-file "${OSVAR}.tfvars" --auto-approve

.github/workflows/update_galaxy.yml

@@ -0,0 +1,24 @@
+# This is a basic workflow to help you get started with Actions
+
+name: Update Galaxy
+
+# Controls when the action will run.
+# Triggers the workflow on push or pull request
+# events but only for the devel branch
+on: # yamllint disable-line rule:truthy
+    push:
+        branches:
+            - main
+
+jobs:
+    update_role:
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout V3
+              uses: actions/checkout@v3
+
+            - name: Update Galaxy
+              uses: robertdebock/galaxy-action@master
+              with:
+                  galaxy_api_key: ${{ secrets.GALAXY_API_KEY }}
+                  git_branch: main

.gitignore

@@ -0,0 +1,45 @@
+.env
+*.log
+*.retry
+.vagrant
+tests/*redhat-subscription
+tests/Dockerfile
+*.iso
+*.box
+packer_cache
+delete*
+ignore*
+# VSCode
+.vscode
+vagrant
+
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# DS_Store
+.DS_Store
+._*
+
+# Linux Editors
+*~
+\#*\#
+/.emacs.desktop
+/.emacs.desktop.lock
+.elc
+auto-save-list
+tramp
+.\#*
+*.swp
+*.swo
+rh-creds.env
+travis.env
+
+# Lockdown-specific
+benchparse/
+*xccdf.xml
+*.retry
+
+# GitHub Action/Workflow files
+.github/