Skip to content

Commit cd517c1

Browse files
adrian207adrian207
authored
Merge pull request #8 from adrian207/main
New merge
2 parents e40b118 + f3b8962 commit cd517c1

File tree

7 files changed

+480
-0
lines changed

7 files changed

+480
-0
lines changed

‎EJBCA---Automated-Lab-Docker/.github/CODEOWNERS‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Global owners - all files require review from these users
2+
* @adrian207
3+
4+
# Terraform files require additional review
5+
/terraform/ @adrian207
6+
7+
# Security-sensitive files require extra scrutiny
8+
**/*secret* @adrian207
9+
**/*key* @adrian207
10+
**/*password* @adrian207
11+
**/*credential* @adrian207
12+
**/*token* @adrian207
13+
**/*auth* @adrian207
14+
15+
# Infrastructure configuration files
16+
/kubernetes/ @adrian207
17+
/helm/ @adrian207
18+
/argocd/ @adrian207
19+
20+
# CI/CD configuration
21+
/.github/workflows/ @adrian207
22+
/.github/ @adrian207
23+
24+
# Documentation
25+
/docs/ @adrian207
26+
*.md @adrian207
27+
28+
# Configuration files
29+
/configs/ @adrian207
30+
/ansible/ @adrian207
31+
32+
# Scripts
33+
/scripts/ @adrian207

‎EJBCA---Automated-Lab-Docker/.github/workflows/branch-protection.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
name: Branch Protection Check
2+
3+
on:
4+
push:
5+
branches: [ main, develop ]
6+
pull_request:
7+
branches: [ main, develop ]
8+
9+
jobs:
10+
branch-protection-check:
11+
name: Branch Protection Validation
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- name: Checkout code
16+
uses: actions/checkout@v4
17+
with:
18+
fetch-depth: 0
19+
20+
- name: Validate commit messages
21+
run: |
22+
if [ "${{ github.event_name }}" = "push" ]; then
23+
echo "Checking commit messages..."
24+
git log --oneline -1 | grep -E "^(feat|fix|docs|style|refactor|test|chore|ci|build|perf|revert)(\(.+\))?: .{1,50}" || {
25+
echo "❌ Commit message doesn't follow conventional format"
26+
echo "Expected format: type(scope): description"
27+
echo "Types: feat, fix, docs, style, refactor, test, chore, ci, build, perf, revert"
28+
exit 1
29+
}
30+
echo "✅ Commit message format is valid"
31+
fi
32+
33+
- name: Check for secrets
34+
run: |
35+
echo "Checking for potential secrets..."
36+
if command -v detect-secrets &> /dev/null; then
37+
detect-secrets scan --baseline .secrets.baseline
38+
else
39+
echo "⚠️ detect-secrets not available, skipping secret check"
40+
fi
41+
42+
- name: Validate file permissions
43+
run: |
44+
echo "Checking file permissions..."
45+
find . -name "*.sh" -not -perm -111 | while read file; do
46+
echo "❌ Shell script $file is not executable"
47+
exit 1
48+
done
49+
echo "✅ All shell scripts have proper permissions"
50+
51+
- name: Check for large files
52+
run: |
53+
echo "Checking for large files..."
54+
find . -type f -size +10M -not -path "./.git/*" | while read file; do
55+
echo "❌ Large file detected: $file"
56+
echo "Consider using Git LFS for files larger than 10MB"
57+
exit 1
58+
done
59+
echo "✅ No large files detected"

‎EJBCA---Automated-Lab-Docker/BRANCH-PROTECTION-SETUP.md‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
# GitHub Branch Protection Setup Guide
2+
3+
## 🛡️ Manual Branch Protection Setup
4+
5+
Since GitHub repository rulesets are not available for your repository, follow these steps to manually configure branch protection:
6+
7+
### Step 1: Navigate to Branch Protection Settings
8+
1. Go to: `https://github.com/adrian207/EJBCA---Automated-Lab/settings/branches`
9+
2. Click **"Add rule"**
10+
11+
### Step 2: Configure Main Branch Protection
12+
**Branch name pattern:** `main`
13+
14+
**Enable these options:**
15+
- ✅ **Require a pull request before merging**
16+
- ✅ **Require approvals:** `2`
17+
- ✅ **Dismiss stale PR approvals when new commits are pushed**
18+
- ✅ **Require review from code owners**
19+
20+
- ✅ **Require status checks to pass before merging**
21+
- ✅ **Require branches to be up to date before merging**
22+
- **Status checks to require:**
23+
- `branch-protection-check`
24+
- `terraform-validate`
25+
- `security-scanning`
26+
- `kubernetes-deploy`
27+
- `ansible-lint`
28+
29+
- ✅ **Require conversation resolution before merging**
30+
- ✅ **Require signed commits**
31+
- ✅ **Require linear history**
32+
- ✅ **Do not allow force pushes**
33+
- ✅ **Do not allow deletions**
34+
35+
### Step 3: Create CODEOWNERS File
36+
Create a `.github/CODEOWNERS` file to define who can approve changes:
37+
38+
```
39+
# Global owners
40+
* @adrian207
41+
42+
# Terraform files require additional review
43+
/terraform/ @adrian207
44+
45+
# Security-sensitive files
46+
**/*secret* @adrian207
47+
**/*key* @adrian207
48+
**/*password* @adrian207
49+
**/*credential* @adrian207
50+
51+
# Documentation
52+
/docs/ @adrian207
53+
*.md @adrian207
54+
```
55+
56+
### Step 4: Test the Protection
57+
After enabling branch protection:
58+
1. Try to push directly to main - it should be blocked
59+
2. Create a pull request instead
60+
3. Verify that status checks are required
61+
62+
## 🔧 Alternative: Use GitHub CLI
63+
64+
If you have GitHub CLI installed, you can use this command:
65+
66+
```bash
67+
gh api repos/adrian207/EJBCA---Automated-Lab/branches/main/protection \
68+
--method PUT \
69+
--field required_status_checks='{"strict":true,"contexts":["branch-protection-check","terraform-validate","security-scanning","kubernetes-deploy","ansible-lint"]}' \
70+
--field enforce_admins=true \
71+
--field required_pull_request_reviews='{"required_approving_review_count":2,"dismiss_stale_reviews":true,"require_code_owner_reviews":true}' \
72+
--field restrictions=null
73+
```
74+
75+
## 📋 Status Check Requirements
76+
77+
Make sure these GitHub Actions workflows are enabled:
78+
- `branch-protection-check` ✅ (Already created)
79+
- `terraform-validate` ✅ (Already exists)
80+
- `security-scanning` ✅ (Already exists)
81+
- `kubernetes-deploy` ✅ (Already exists)
82+
- `ansible-lint` ✅ (Already exists)
83+
84+
## 🚨 Troubleshooting
85+
86+
**If status checks don't appear:**
87+
1. Make sure the GitHub Actions workflows are enabled
88+
2. Run the workflows manually to generate status check names
89+
3. Check that workflows are in `.github/workflows/` directory
90+
91+
**If CODEOWNERS doesn't work:**
92+
1. Make sure the file is in `.github/CODEOWNERS`
93+
2. Verify the usernames are correct
94+
3. Check that users have write access to the repository

‎EJBCA---Automated-Lab-Docker/github-branch-protection.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"name": "EJBCA Automated Lab Repository Rules",
3+
"target": "branch",
4+
"enforcement": "active",
5+
"conditions": {
6+
"ref_name": {
7+
"include": ["main", "develop"]
8+
}
9+
},
10+
"parameters": {
11+
"required_status_checks": {
12+
"strict": true,
13+
"contexts": [
14+
"branch-protection-check",
15+
"terraform-validate",
16+
"security-scanning",
17+
"kubernetes-deploy",
18+
"ansible-lint"
19+
]
20+
},
21+
"dismiss_stale_reviews_on_push": true,
22+
"require_code_owner_reviews": true,
23+
"required_approving_review_count": 2,
24+
"require_last_push_approval": true,
25+
"required_linear_history": true,
26+
"allow_force_pushes": false,
27+
"allow_deletions": false,
28+
"block_creations": false,
29+
"required_conversation_resolution": true,
30+
"require_signed_commits": true,
31+
"lock_branch": false,
32+
"allow_fork_syncing": true
33+
}
34+
}

‎EJBCA---Automated-Lab-Docker/github-repository-rules.json‎

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
{
2+
"rules": [
3+
{
4+
"name": "Main Branch Protection",
5+
"target": "branch",
6+
"enforcement": "active",
7+
"conditions": {
8+
"ref_name": {
9+
"include": ["main"]
10+
}
11+
},
12+
"parameters": {
13+
"required_status_checks": {
14+
"strict": true,
15+
"contexts": [
16+
"branch-protection-check",
17+
"terraform-validate",
18+
"security-scanning",
19+
"kubernetes-deploy",
20+
"ansible-lint"
21+
]
22+
},
23+
"dismiss_stale_reviews_on_push": true,
24+
"require_code_owner_reviews": true,
25+
"required_approving_review_count": 2,
26+
"require_last_push_approval": true,
27+
"required_linear_history": true,
28+
"allow_force_pushes": false,
29+
"allow_deletions": false,
30+
"block_creations": false,
31+
"required_conversation_resolution": true,
32+
"require_signed_commits": true,
33+
"lock_branch": false,
34+
"allow_fork_syncing": true
35+
}
36+
},
37+
{
38+
"name": "Develop Branch Protection",
39+
"target": "branch",
40+
"enforcement": "active",
41+
"conditions": {
42+
"ref_name": {
43+
"include": ["develop"]
44+
}
45+
},
46+
"parameters": {
47+
"required_status_checks": {
48+
"strict": true,
49+
"contexts": [
50+
"branch-protection-check",
51+
"terraform-validate",
52+
"security-scanning"
53+
]
54+
},
55+
"dismiss_stale_reviews_on_push": true,
56+
"require_code_owner_reviews": false,
57+
"required_approving_review_count": 1,
58+
"require_last_push_approval": false,
59+
"required_linear_history": false,
60+
"allow_force_pushes": false,
61+
"allow_deletions": true,
62+
"block_creations": false,
63+
"required_conversation_resolution": true,
64+
"require_signed_commits": false,
65+
"lock_branch": false,
66+
"allow_fork_syncing": true
67+
}
68+
},
69+
{
70+
"name": "Feature Branch Rules",
71+
"target": "branch",
72+
"enforcement": "active",
73+
"conditions": {
74+
"ref_name": {
75+
"include": ["feat/*", "feature/*", "bugfix/*", "hotfix/*"]
76+
}
77+
},
78+
"parameters": {
79+
"required_status_checks": {
80+
"strict": true,
81+
"contexts": [
82+
"branch-protection-check",
83+
"terraform-validate"
84+
]
85+
},
86+
"dismiss_stale_reviews_on_push": true,
87+
"require_code_owner_reviews": false,
88+
"required_approving_review_count": 1,
89+
"require_last_push_approval": false,
90+
"required_linear_history": false,
91+
"allow_force_pushes": false,
92+
"allow_deletions": true,
93+
"block_creations": false,
94+
"required_conversation_resolution": true,
95+
"require_signed_commits": false,
96+
"lock_branch": false,
97+
"allow_fork_syncing": true
98+
}
99+
},
100+
{
101+
"name": "Pull Request Rules",
102+
"target": "pull_request",
103+
"enforcement": "active",
104+
"conditions": {
105+
"ref_name": {
106+
"include": ["main", "develop"]
107+
}
108+
},
109+
"parameters": {
110+
"required_approving_review_count": 2,
111+
"dismiss_stale_reviews_on_push": true,
112+
"require_code_owner_reviews": true,
113+
"require_last_push_approval": true,
114+
"required_linear_history": true,
115+
"required_conversation_resolution": true
116+
}
117+
},
118+
{
119+
"name": "Commit Message Rules",
120+
"target": "tag",
121+
"enforcement": "active",
122+
"conditions": {},
123+
"parameters": {
124+
"pattern": "^(feat|fix|docs|style|refactor|test|chore|ci|build|perf|revert)(\\(.+\\))?: .{1,50}",
125+
"operator": "regex"
126+
}
127+
},
128+
{
129+
"name": "Terraform Files Protection",
130+
"target": "path",
131+
"enforcement": "active",
132+
"conditions": {
133+
"ref_name": {
134+
"include": ["main", "develop"]
135+
}
136+
},
137+
"parameters": {
138+
"rules": [
139+
{
140+
"name": "Terraform files require review",
141+
"paths": {
142+
"include": ["terraform/**"]
143+
},
144+
"required_approving_review_count": 2,
145+
"require_code_owner_reviews": true
146+
},
147+
{
148+
"name": "Security-sensitive files",
149+
"paths": {
150+
"include": [
151+
"**/*secret*",
152+
"**/*key*",
153+
"**/*password*",
154+
"**/*credential*",
155+
"**/*token*"
156+
]
157+
},
158+
"required_approving_review_count": 2,
159+
"require_code_owner_reviews": true
160+
},
161+
{
162+
"name": "Documentation changes",
163+
"paths": {
164+
"include": ["docs/**", "*.md"]
165+
},
166+
"required_approving_review_count": 1,
167+
"require_code_owner_reviews": false
168+
}
169+
]
170+
}
171+
}
172+
]
173+
}

0 commit comments

Comments
 (0)