Skip to content

Commit d8f7839

Browse files
jgadsdenjgadsden
authored
Merge pull request #85 : add governance pipelines
2 parents b877a74 + 9170c0e commit d8f7839

File tree

5 files changed

+265
-0
lines changed

5 files changed

+265
-0
lines changed

‎.github/workflows/housekeeping.yaml

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
name: Housekeeping
2+
# checks are on all directories
3+
4+
on:
5+
# Run daily at 7:00
6+
schedule:
7+
- cron: '0 7 * * *'
8+
workflow_dispatch:
9+
10+
# for security reasons the github actions are pinned to specific release versions
11+
jobs:
12+
chores:
13+
name: Tidy workflows
14+
runs-on: ubuntu-24.04
15+
permissions:
16+
actions: write
17+
18+
steps:
19+
- name: Delete stale workflow runs
20+
uses: Mattraks/delete-workflow-runs@v2.0.6
21+
with:
22+
token: ${{ github.token }}
23+
repository: ${{ github.repository }}
24+
retain_days: 28
25+
keep_minimum_runs: 10
26+
27+
- name: Delete unused workflows
28+
uses: otto-de/purge-deprecated-workflow-runs@v3.0.1
29+
with:
30+
token: ${{ github.token }}
31+
32+
link_checker:
33+
name: Link checker
34+
runs-on: ubuntu-24.04
35+
steps:
36+
- name: Checkout markdown
37+
uses: actions/checkout@v4.2.0
38+
39+
- name: Link Checker
40+
uses: lycheeverse/lychee-action@v2.4.0
41+
with:
42+
# skip the jekyll files under '_includes' directory, check all other directories
43+
args: >-
44+
--no-progress
45+
--max-retries 2
46+
--exclude-path './_includes/*.html'
47+
'**/*.md'
48+
'*.md'
49+
fail: true
50+
env:
51+
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
52+
53+
stale:
54+
name: Tidy pull requests
55+
runs-on: ubuntu-24.04
56+
permissions:
57+
pull-requests: write
58+
issues: write
59+
60+
steps:
61+
- name: Tidy stale PRs and issues
62+
uses: actions/stale@v9
63+
with:
64+
days-before-issue-stale: 182
65+
days-before-issue-close: -1
66+
stale-issue-message: 'This issue is stale because it has been open for 6 months with no activity.'
67+
stale-issue-label: stale
68+
remove-issue-stale-when-updated: true
69+
days-before-pr-stale: 42
70+
days-before-pr-close: 7
71+
stale-pr-message: 'This PR is stale because it has been open 42 days with no activity. Remove stale label, or add a comment, otherwise it will be closed in 7 days.'
72+
close-pr-message: 'This PR was closed because it has been stalled for 7 weeks with no activity.'

‎.github/workflows/pr.yaml

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
name: Pull request pipeline
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
workflow_dispatch:
8+
9+
# for security reasons the github actions are pinned to specific release versions
10+
jobs:
11+
link_checker:
12+
name: Link checker
13+
runs-on: ubuntu-24.04
14+
steps:
15+
- name: Checkout markdown
16+
uses: actions/checkout@v4.2.0
17+
18+
- name: Link Checker
19+
uses: lycheeverse/lychee-action@v2.3.0
20+
with:
21+
args: >-
22+
--no-progress
23+
--max-retries 2
24+
'./docs/**/*.md'
25+
fail: true
26+
env:
27+
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
28+
29+
md_linter:
30+
name: Lint markdown
31+
runs-on: ubuntu-24.04
32+
steps:
33+
- name: Checkout markdown
34+
uses: actions/checkout@v4.2.0
35+
36+
- name: Lint markdown
37+
uses: DavidAnson/markdownlint-cli2-action@v19.1.0
38+
with:
39+
config: '.markdownlint.yaml'
40+
globs: 'docs/**/*.md'
41+
42+
spell_checker:
43+
name: Check spelling
44+
runs-on: ubuntu-24.04
45+
steps:
46+
- name: Checkout markdown
47+
uses: actions/checkout@v4.2.0
48+
49+
- name: Spell check EN language
50+
uses: rojopolis/spellcheck-github-actions@0.47.0
51+
with:
52+
config_path: .spellcheck-en.yaml
53+
54+
export_pdf:
55+
name: Export PDF
56+
runs-on: ubuntu-24.04
57+
needs: [link_checker, md_linter, spell_checker]
58+
steps:
59+
- name: Checkout markdown
60+
uses: actions/checkout@v4.2.0
61+
62+
- name: Install python
63+
uses: actions/setup-python@v5.5.0
64+
with:
65+
python-version: 3.x
66+
67+
- name: Install python packages
68+
run: |
69+
python -m pip install --upgrade pip setuptools wheel
70+
pip install mkdocs
71+
pip install mkdocs-material
72+
pip install mkdocs-open-in-new-tab
73+
pip install mkdocs-with-pdf
74+
75+
- name: Build
76+
run: mkdocs build
77+
78+
- name: Upload PDF
79+
uses: actions/upload-artifact@v4.6.0
80+
with:
81+
name: pdf-export
82+
path: site/OWASP_Developer_Guide.pdf

‎.github/workflows/release.yaml

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
name: Release docs
2+
# checks are only on the draft directory because the release directory will be overwritten
3+
4+
on:
5+
push:
6+
# tagged x.x.x releases as well as release candidates
7+
tags:
8+
- ?.?.?*
9+
workflow_dispatch:
10+
11+
# for security reasons the github actions are pinned to specific release versions
12+
jobs:
13+
export_pdf:
14+
name: Export PDF
15+
runs-on: ubuntu-24.04
16+
steps:
17+
- name: Checkout markdown
18+
uses: actions/checkout@v4.2.0
19+
20+
- name: Install python
21+
uses: actions/setup-python@v5.5.0
22+
with:
23+
python-version: 3.x
24+
25+
- name: Install python packages
26+
run: |
27+
python -m pip install --upgrade pip setuptools wheel
28+
pip install mkdocs
29+
pip install mkdocs-material
30+
pip install mkdocs-open-in-new-tab
31+
pip install mkdocs-with-pdf
32+
33+
- name: Build
34+
run: mkdocs build
35+
36+
- name: Upload PDF
37+
uses: actions/upload-artifact@v4.6.0
38+
with:
39+
name: 'pdf-export'
40+
path: 'site/OWASP_Developer_Guide.pdf'
41+
42+
draft_release:
43+
name: Create draft release
44+
runs-on: ubuntu-24.04
45+
needs: [export_pdf]
46+
steps:
47+
- name: Check out
48+
uses: actions/checkout@v4.2.0
49+
50+
- name: Fetch prepared SBOM artifacts
51+
uses: actions/download-artifact@v4.2.1
52+
with:
53+
name: 'pdf-export'
54+
path: 'site/OWASP_Developer_Guide.pdf'
55+
56+
- name: Prepare release notes
57+
run: |
58+
releaseVersion=${{ github.ref_name }}
59+
sed -e s/x.x.x/${releaseVersion:1}/g .release-note-template.md > ./release-notes.txt
60+
61+
- name: Create release notes
62+
uses: softprops/action-gh-release@v2.2.0
63+
with:
64+
draft: true
65+
name: "${releaseVersion:1}"
66+
append_body: true
67+
body_path: ./release-notes.txt
68+
generate_release_notes: true
69+
files: |
70+
site/OWASP_Developer_Guide.pdf

‎.lycheeignore

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# ignore these false positives from the link checker housekeeper
2+
3+
# some sites that are examples only, no intention of being real
4+
myfriend.site.com/
5+
6+
# Lockheed Martin has trouble with SSL certificates, temporarily ignore
7+
https://www.lockheedmartin.com
8+
9+
# github gets upset if too many requests are made to create new issues
10+
https://github.com/OWASP/DevGuide/issues/new
11+
https://github.com/OWASP/DevGuide/pulls
12+
13+
# at times github gets upset full stop
14+
https://github.com/OWASP/DevGuide
15+
16+
# ignore LINDDUN site because it occasionally times out
17+
https://www.linddun.org/
18+
19+
# automated access to esapi is forbidden
20+
https://mvnrepository.com/artifact/org.owasp.esapi/esapi
21+
22+
# do not harass dockerhub
23+
https://hub.docker.com/r/bkimminich/juice-shop
24+
https://hub.docker.com/r/pygoat/pygoat
25+
https://hub.docker.com/r/owasp/threat-dragon/tags
26+
https://hub.docker.com/r/securityrat/securityrat
27+
https://hub.docker.com/r/webgoat/webgoat
28+
29+
# Google drive tends to need permissions that the link checker does not have
30+
https://drive.google.com/
31+
32+
# SAMM training site blocks automated access
33+
https://owaspsamm.thinkific.com/courses/samm

‎.release-note-template.md

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
### What's Changed
2+
3+
### PDF version
4+
5+
The [PDF][pdf] version of the [web document][devguide] can be downloaded for version x.x.x .
6+
7+
[devguide]: devguide.owasp.org
8+
[pdf]: https://github.com/OWASP/threat-dragon/releases/download/vx.x.x/OWASP_Developer_Guide.pdf

0 commit comments

Comments
 (0)