Skip to content

Commit 0ec16b5

Browse files
MerciMaxMerciMax
authored
SEPA KING - Repository Security Hardening (#3)
1 parent 3a28271 commit 0ec16b5

50 files changed

Lines changed: 1369 additions & 868 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/CODEOWNERS‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
1-
* @pennylane-hq/advanced-expenses
1+
* @pennylane-hq/advanced-expenses
2+
/doc/dependency_decisions.yml @pennylane-hq/appsec

‎.github/workflows/main.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
strategy:
1414
fail-fast: false
1515
matrix:
16-
ruby: ['3.2', '3.3', '3.4']
16+
ruby: ["3.2", "3.3", "3.4"]
1717

1818
name: Ruby ${{ matrix.ruby }}
1919

‎.github/workflows/pre-commit.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: Pre-commits
2+
3+
on: [push]
4+
5+
jobs:
6+
checks:
7+
name: Run pre-commit
8+
runs-on: ubuntu-latest
9+
10+
steps:
11+
- uses: actions/checkout@v4
12+
13+
- name: Setup Environment
14+
run: |
15+
echo "NODE_VERSION=18.18.0" >> $GITHUB_ENV
16+
echo "PYTHON_VERSION=$(cat .tool-versions | grep -Po '(?<=python ).*')" >> $GITHUB_ENV
17+
echo "RUBY_VERSION=$(cat .tool-versions | grep -Po '(?<=ruby ).*')" >> $GITHUB_ENV
18+
if [ $GITHUB_REF == 'refs/heads/master' ]; then echo "ENV=prod"; else echo "ENV=staging"; fi >> $GITHUB_ENV
19+
echo "REPOSITORY_NAME=${GITHUB_REPOSITORY#*\/}" >> $GITHUB_ENV
20+
21+
- name: Install Ruby
22+
uses: ruby/setup-ruby@v1
23+
with:
24+
ruby-version: ${{ env.RUBY_VERSION }}
25+
26+
- name: Install Ruby dependencies
27+
run: bundle install
28+
29+
- name: Install Python
30+
uses: actions/setup-python@v4
31+
with:
32+
python-version: ${{ env.PYTHON_VERSION }}
33+
34+
- name: Store python version details for cache
35+
run: echo "PY=$(python -VV | sha256sum | cut -d' ' -f1)" >> "$GITHUB_ENV"
36+
37+
- name: Pre-commit installation cache
38+
uses: actions/cache@v3
39+
with:
40+
path: ~/.cache/pre-commit
41+
key: pre-commit|${{ env.PY }}|${{ hashFiles('.pre-commit-config.yaml') }}
42+
restore-keys: |
43+
pre-commit|${{ env.PY }}|
44+
45+
- name: Install pre-commit
46+
run: |
47+
python -m pip install pre-commit
48+
pre-commit install --install-hooks
49+
50+
- name: Run pre-commit checks
51+
run: |
52+
pre-commit run --all-files
53+
54+
- name: Run license checks
55+
run: |
56+
pre-commit run license_checks --files doc/dependency_decisions.yml

‎.pre-commit-config.yaml‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
repos:
2+
- repo: https://github.com/pre-commit/pre-commit-hooks
3+
rev: v4.0.1
4+
hooks:
5+
- id: check-added-large-files
6+
- id: fix-byte-order-marker
7+
- id: check-merge-conflict
8+
- id: trailing-whitespace
9+
exclude: (?x)(
10+
\.yarn/|
11+
spec/files/)
12+
13+
- repo: https://github.com/tdeo/pre-commit-hooks
14+
rev: v4.0.1
15+
hooks:
16+
- id: end-of-file-fixer
17+
exclude: spec/files/
18+
- repo: https://github.com/shellcheck-py/shellcheck-py
19+
rev: v0.8.0.1
20+
hooks:
21+
- id: shellcheck
22+
23+
- repo: local
24+
hooks:
25+
- id: do_not_commit
26+
name: Break on DO NOT COMMIT comment
27+
language: pygrep
28+
entry: (?i)(NOT.{,3}COMMIT)
29+
exclude: (?x)(
30+
.pre-commit-config.yaml|
31+
README.md)
32+
- id: rubocop
33+
name: Rubocop
34+
language: system
35+
entry: bash -c 'bundle exec rubocop ${RUBOCOP_OPTIONS:---autocorrect} "$@"' --
36+
require_serial: true # for proper cache behavior
37+
files: (?x)(
38+
\.(rb|rake|jbuilder|gemspec)$|
39+
Gemfile$|
40+
Rakefile|
41+
.irbrc$)
42+
args:
43+
- --color
44+
- --server
45+
- --config=.rubocop.yml
46+
- --fail-level=convention
47+
- id: ruboclean
48+
name: Ruboclean
49+
language: system
50+
entry: bundle exec ruboclean
51+
files: ^\.rubocop.*\.yml$
52+
args:
53+
- --silent
54+
- --preserve-comments
55+
- id: ruby
56+
name: Valid ruby syntax
57+
language: system
58+
entry: ruby -c
59+
files: \.rb$
60+
exclude: lib/templates/rspec/
61+
- id: prettier-json
62+
name: Prettier JSON
63+
language: system
64+
entry: npx prettier --parser json --write
65+
files: \.json$
66+
- id: prettier-yaml
67+
name: Prettier YAML
68+
language: system
69+
entry: npx prettier --parser yaml --write
70+
files: \.ya?ml$
71+
exclude: ^\.rubocop\.yml
72+
- id: prettier-mdx
73+
name: Prettier MDX
74+
language: system
75+
entry: npx prettier --parser mdx --write
76+
files: \.mdx?$
77+
- id: whitespaces
78+
name: No non-breaking spaces
79+
language: pygrep
80+
entry: \\u00A0 # Non-breaking space
81+
exclude: (?x)^(
82+
\.yarn/releases/|
83+
\.pre-commit-config\.yaml)
84+
- id: license_checks
85+
name: License checks
86+
language: system
87+
entry: .pre-commit/check_license.sh
88+
files: ^doc/dependency_decisions\.yml$
89+
pass_filenames: false

‎.pre-commit/check_license.sh‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
#!/bin/bash
2+
3+
set -euo pipefail
4+
5+
[ -z "${CI+1}" ] || exit 0
6+
7+
RESULT=$(bundle exec license_finder)
8+
9+
ERROR=$(cat <<-END
10+
11+
Some licenses are not approved! You need to run "bundle exec license_finder" to determine the missing licenses.
12+
13+
It appears the issues were the following:
14+
15+
"$RESULT"
16+
17+
Please check the licenses and especially commercial use terms, loop back to AppSec/Legal if needed.
18+
19+
Different way to approve a license, you can either accept a license kind:
20+
bundle exec license_finder permitted_licenses add "Zlib"
21+
22+
Or specific packages:
23+
bundle exec license_finder approvals add pako
24+
25+
Finally, please add the proper documentation and explanation in doc/dependency_decisions.yml
26+
27+
END
28+
)
29+
30+
if echo "$RESULT" | grep "All dependencies are approved for use"
31+
then
32+
exit 0
33+
else
34+
echo "$ERROR"
35+
exit 1
36+
fi

‎.rubocop.yml‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
---
2+
3+
plugins: rubocop-rspec
4+
5+
AllCops:
6+
NewCops: enable
7+
SuggestExtensions: false
8+
9+
Gemspec/DevelopmentDependencies:
10+
Enabled: false
11+
12+
Layout/LineLength:
13+
Enabled: false
14+
15+
Lint/ConstantDefinitionInBlock:
16+
Enabled: false
17+
18+
Lint/SuppressedException:
19+
Enabled: false
20+
21+
Lint/SuppressedExceptionInNumberConversion:
22+
Enabled: false
23+
24+
Metrics/AbcSize:
25+
Enabled: false
26+
27+
Metrics/BlockLength:
28+
Enabled: false
29+
30+
Metrics/ClassLength:
31+
Enabled: false
32+
33+
Metrics/CyclomaticComplexity:
34+
Enabled: false
35+
36+
Metrics/MethodLength:
37+
Enabled: false
38+
39+
Metrics/PerceivedComplexity:
40+
Enabled: false
41+
42+
RSpec/BeEq:
43+
Enabled: false
44+
45+
RSpec/DescribeClass:
46+
Enabled: false
47+
48+
RSpec/DescribeSymbol:
49+
Enabled: false
50+
51+
RSpec/DescribedClass:
52+
Enabled: false
53+
54+
RSpec/ExampleLength:
55+
Enabled: false
56+
57+
RSpec/ExpectActual:
58+
Enabled: false
59+
60+
RSpec/LeakyConstantDeclaration:
61+
Enabled: false
62+
63+
RSpec/MultipleDescribes:
64+
Enabled: false
65+
66+
RSpec/MultipleExpectations:
67+
Enabled: false
68+
69+
RSpec/MultipleMemoizedHelpers:
70+
Enabled: false
71+
72+
RSpec/NamedSubject:
73+
Enabled: false
74+
75+
RSpec/NestedGroups:
76+
Max: 9
77+
78+
RSpec/RepeatedDescription:
79+
Enabled: false
80+
81+
RSpec/SpecFilePathFormat:
82+
Enabled: false
83+
84+
Style/Documentation:
85+
Enabled: false
86+
87+
Style/FormatStringToken:
88+
Enabled: false
89+
90+
Style/RaiseArgs:
91+
EnforcedStyle: compact
92+
93+
Style/SpecialGlobalVars:
94+
Enabled: false

‎.tool-versions‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
ruby 3.2.2
2+
nodejs 24.10.0
3+
python 3.9.12

‎CONTRIBUTING.md‎

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -3,36 +3,35 @@ We love pull requests. Here's a quick guide:
33
1. Fork the repo.
44

55
2. Run the tests. We only take pull requests with passing tests, and it's great
6-
to know that you have a clean slate: `bundle && rake`
6+
to know that you have a clean slate: `bundle && rake`
77

88
3. Add a test for your change. Only refactoring and documentation changes
9-
require no new tests. If you are adding functionality or fixing a bug, we need
10-
a test!
9+
require no new tests. If you are adding functionality or fixing a bug, we need
10+
a test!
1111

1212
4. Make the test pass.
1313

1414
5. Push to your fork and submit a pull request.
1515

16-
1716
At this point you're waiting on us. We like to at least comment on, if not
1817
accept, pull requests within three business days (and, typically, one business
1918
day). We may suggest some changes or improvements or alternatives.
2019

2120
Some things that will increase the chance that your pull request is accepted,
2221
taken straight from the Ruby on Rails guide:
2322

24-
* Use Rails idioms and helpers
25-
* Include tests that fail without your code, and pass with it
26-
* Update the documentation, the surrounding one, examples elsewhere, guides,
23+
- Use Rails idioms and helpers
24+
- Include tests that fail without your code, and pass with it
25+
- Update the documentation, the surrounding one, examples elsewhere, guides,
2726
whatever is affected by your contribution
2827

2928
Syntax:
3029

31-
* Two spaces, no tabs.
32-
* No trailing whitespace. Blank lines should not have any space.
33-
* Prefer &&/|| over and/or.
34-
* MyClass.my_method(my_arg) not my_method( my_arg ) or my_method my_arg.
35-
* a = b and not a=b.
36-
* Follow the conventions you see used in the source already.
30+
- Two spaces, no tabs.
31+
- No trailing whitespace. Blank lines should not have any space.
32+
- Prefer &&/|| over and/or.
33+
- MyClass.my_method(my_arg) not my_method( my_arg ) or my_method my_arg.
34+
- a = b and not a=b.
35+
- Follow the conventions you see used in the source already.
3736

3837
And in case we didn't emphasize it enough: we love tests!

‎Gemfile‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,21 @@
1+
# frozen_string_literal: true
2+
13
source 'https://rubygems.org'
24
gemspec
5+
6+
group :development do
7+
gem 'coveralls_reborn', require: false
8+
9+
# License
10+
gem 'license_finder', require: false
11+
12+
# Testing
13+
gem 'rspec'
14+
15+
# Linting
16+
gem 'ruboclean', require: false
17+
gem 'rubocop', require: false
18+
gem 'rubocop-rspec', require: false
19+
20+
gem 'simplecov', require: false
21+
end

0 commit comments

Comments
 (0)