https://github.com/HariSekhon/GitHub-Actions
GitHub Actions Reusable Workflows and Master Template
https://github.com/HariSekhon/GitHub-Actions
checkov ci-cd ci-cd-pipeline cicd github github-actions github-actions-ci hacktoberfest jenkins jenkinsfile library semgrep tfsec tfsec-checks validation validation-library validations
Last synced: 3 months ago
JSON representation
GitHub Actions Reusable Workflows and Master Template
- Host: GitHub
- URL: https://github.com/HariSekhon/GitHub-Actions
- Owner: HariSekhon
- License: mit
- Created: 2022-01-17T12:27:41.000Z (over 3 years ago)
- Default Branch: master
- Last Pushed: 2024-09-04T15:18:10.000Z (10 months ago)
- Last Synced: 2024-09-05T21:23:21.483Z (10 months ago)
- Topics: checkov, ci-cd, ci-cd-pipeline, cicd, github, github-actions, github-actions-ci, hacktoberfest, jenkins, jenkinsfile, library, semgrep, tfsec, tfsec-checks, validation, validation-library, validations
- Language: Shell
- Homepage: https://www.linkedin.com/in/HariSekhon
- Size: 944 KB
- Stars: 38
- Watchers: 3
- Forks: 12
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
- Codeowners: .github/CODEOWNERS
Awesome Lists containing this project
README
# GitHub Actions
[](https://github.com/HariSekhon/GitHub-Actions/stargazers)
[](https://github.com/HariSekhon/GitHub-Actions/network)
[](https://github.com/HariSekhon/GitHub-Actions)
[](https://github.com/HariSekhon/GitHub-Actions/blob/master/LICENSE)
[](https://www.linkedin.com/in/HariSekhon/)
[](https://github.com/HariSekhon/GitHub-Actions/commits/master)
[](https://harisekhon.github.io/CI-CD/)
[](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/yaml.yaml)
[](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/markdown.yaml)
[](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/validate.yaml)
[](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/grype.yaml)
[](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/kics.yaml)
[](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/semgrep.yaml)
[](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/semgrep-cloud.yaml)
[](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/url_links.yaml)
[](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/trivy.yaml)
[](https://github.com/HariSekhon/GitHub-Actions)
[](https://gitlab.com/HariSekhon/GitHub-Actions)
[](https://dev.azure.com/harisekhon/GitHub/_git/GitHub-Actions)
[](https://bitbucket.org/HariSekhon/GitHub-Actions)
GitHub Actions master template & GitHub Actions Reusable Workflows library.
- [main.yaml](https://github.com/HariSekhon/GitHub-Actions/blob/master/main.yaml) - GitHub Actions master workflow template
- [.github/workflows/](https://github.com/HariSekhon/GitHub-Actions/tree/master/.github/workflows) - GitHub Actions Reusable Workflows Library
See [Documentation](https://docs.github.com/en/actions/using-workflows/reusing-workflows#calling-a-reusable-workflow) for how to call these workflows directly from your own GitHub Actions workflow.
Fork this repo to have full control over all updates via Pull Requests. Create environment branches to stage updates across dev/staging/production.
Forked from [HariSekhon/Templates](https://github.com/HariSekhon/Templates), for which this is now a submodule.
To see GitHub Contexts available, including undocumented fields, see [HariSekhon/GitHub-Actions-Contexts](https://github.com/HariSekhon/GitHub-Actions-Contexts).
## Examples
In your GitHub repo, import these workflows by adding small yaml files to the `.github/workflows/` directory.
## Scan for Secrets and Security issues
[](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/semgrep.yaml)
Alerts appear under the GitHub repo's Security tab -> Code scanning alerts.
[](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/semgrep-cloud.yaml) Alerts appear in the dashboard
Create `.github/workflows/semgrep.yaml` for local repo alerts:
```yaml
on: [push]
jobs:
semgrep:
uses: HariSekhon/GitHub-Actions/.github/workflows/semgrep.yaml@master
```
or `.github/workflows/semgrep-cloud.yaml` for alerts:
```yaml
on: [push]
jobs:
semgrep:
uses: HariSekhon/GitHub-Actions/.github/workflows/semgrep-cloud.yaml@master
secrets:
SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
```
## Analyze your Terraform code security & best practices
[](https://github.com/HariSekhon/Terraform/actions/workflows/tfsec.yaml)
Alerts appear under Security -> Code scanning alerts.
Create `.github/workflows/tfsec.yaml`:
```yaml
on: [push]
jobs:
tfsec:
uses: HariSekhon/GitHub-Actions/.github/workflows/tfsec.yaml@master
```
## Terraform Plan & Apply
Plans - updates Pull Requests with the results of validation, format check and full Change Plan outputs
Apply - applies when merged to default branch, eg. `master` or `main`
```yaml
on: [push, pull_request]
jobs:
terraform:
uses: HariSekhon/GitHub-Actions/.github/workflows/terraform.yaml@master
with:
dir: path/to/terraform/code
secrets:
...
```
For more sophisticated examples including approvals, secrets, branch and path selection etc. see my [Terraform repo](https://github.com/HariSekhon/Terraform)'s templates for [terraform-plan.yaml](https://github.com/HariSekhon/Terraform/blob/master/.github/workflows/terraform-plan.yaml.template) and [terraform-apply.yaml](https://github.com/HariSekhon/Terraform/blob/master/.github/workflows/terraform-apply.yaml.template)
## Docker Build and push to DockerHub
[](https://github.com/HariSekhon/Dockerfiles/actions/workflows/docker_build_devops_bash_tools_ubuntu.yaml)
Create `.github/workflows/dockerhub_build.yaml`:
```yaml
on: [push]
jobs:
docker_build:
uses: HariSekhon/GitHub-Actions/.github/workflows/dockerhub_build.yaml@master
with:
repo: user/repo # your DockerHub user/repo
tags: latest v1.1
secrets:
DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}
DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
```
## Docker Build and push to AWS ECR
Create `.github/workflows/docker_build_aws_ecr.yaml`:
```yaml
on: [push]
jobs:
docker_build:
uses: HariSekhon/GitHub-Actions/.github/workflows/docker_build_aws_ecr.yaml@master
with:
repo: MY_ECR_REPO
secrets:
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
```
Creates several useful tags, supports multi-stage build caching, see [README](https://github.com/HariSekhon/GitHub-Actions/blob/master/.github/workflows/README.md) for details.
## Check for Broken URL Links
[](https://github.com/HariSekhon/GitHub-Actions/actions/workflows/url_links.yaml)
Create `.github/workflows/url_links.yaml`:
```yaml
on: [push]
jobs:
url_links:
uses: HariSekhon/GitHub-Actions/.github/workflows/url_links.yaml@master
```
See [README](https://github.com/HariSekhon/GitHub-Actions/blob/master/.github/workflows/README.md) for details on ignoring inaccessible / partially constructed links or those containing variables
## Auto-Merge Production hotfixes back to Staging
Merges via a Pull Request for full auditing.
Create `.github/workflows/merge_production_to_staging.yaml`:
```yaml
on: [push]
jobs:
merge:
if: github.ref_name == 'production'
uses: HariSekhon/GitHub-Actions/.github/workflows/merge-branch.yaml@master
with:
head: production # from
base: staging # to
```
## Mirror Repos to GitLab for DR Backups
Mirrors all/given GitHub repos to GitLab - including all branches and tags, and GitHub repo description
```yaml
on:
schedule:
# mirror to GitLab hourly
- cron: '0 0 * * *'
jobs:
gitlab_mirror:
uses: HariSekhon/GitHub-Actions/.github/workflows/gitlab-mirror.yaml@master
with:
#organization: my-org # optional: mirror your company's repos instead of your personal repos
#repos: repo1 repo2 ... # list of repos to mirror, space separated, rather than all repos
secrets:
GH_TOKEN: ${{ secrets.GH_TOKEN }}
GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }}
```
## AWS CodeArtifact - Publish a Python Package
```yaml
on:
tags:
- v*
jobs:
aws_codeartifact_python_publish:
uses: HariSekhon/GitHub-Actions/.github/workflows/codeartifact_python_publish.yaml@master
with:
domain: mycompany # your AWS CodeArtifact service domain name
repo: mycompany-core # your CodeArtifact repo name
#command: make publish_package # default. Can be any command using CODEARTIFACT_AUTH_TOKEN and CODEARTIFACT_REPO_URL
secrets:
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
```
## Production
### Option 1 - Hashref
Import the reusable workflows from this repo as shown above, replacing `@master` with `@` to fix to an immutable version (tags are not immutable). This is [GitHub Actions Security Best Practice](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions).
### Option 2 - Public Fork (fully automated)
Fork this repo for more control and visibility over all updates.
Enable the [fork-sync](https://github.com/HariSekhon/GitHub-Actions/blob/master/.github/workflows/fork-sync.yaml) github actions workflow in your fork to keep the master branch sync'd every few hours.
You can then create tags or environment branches in your forked repo to stage updates across dev/staging/production.
If using environment branches enable the [fork-update-pr](https://github.com/HariSekhon/GitHub-Actions/blob/master/.github/workflows/fork-update-pr.yaml) github actions workflow to automatically raise GitHub Pull Requests from master to your environment branches to audit, authorize & control updates.
### Option 3 - Private Copy (manual)
Copy `.github/workflows` to a private repo. Not recommended as it's the most manual legacy approach.
You will be responsible for committing and reconciling any divergences in your local copies.
## Star History
[](https://star-history.com/#HariSekhon/GitHub-Actions&Date)
## More Core Repos
### Knowledge
[](https://github.com/HariSekhon/Knowledge-Base)
[](https://github.com/HariSekhon/Diagrams-as-Code)
### DevOps Code
[](https://github.com/HariSekhon/DevOps-Bash-tools)
[](https://github.com/HariSekhon/DevOps-Python-tools)
[](https://github.com/HariSekhon/DevOps-Perl-tools)
[](https://github.com/HariSekhon/DevOps-Golang-tools)
### Containerization
[](https://github.com/HariSekhon/Kubernetes-configs)
[](https://github.com/HariSekhon/Dockerfiles)
### CI/CD
[](https://github.com/HariSekhon/GitHub-Actions)
[](https://github.com/HariSekhon/Jenkins)
### DBA - SQL
[](https://github.com/HariSekhon/SQL-scripts)
### DevOps Reloaded
[](https://github.com/HariSekhon/Nagios-Plugins)
[](https://github.com/HariSekhon/HAProxy-configs)
[](https://github.com/HariSekhon/Terraform)
[](https://github.com/HariSekhon/Packer-templates)
[](https://github.com/HariSekhon/Nagios-Plugin-Kafka)
### Templates
[](https://github.com/HariSekhon/Templates)
[](https://github.com/HariSekhon/Template-repo)
### Misc
[](https://github.com/HariSekhon/Spotify-tools)
[](https://github.com/HariSekhon/Spotify-playlists)
The rest of my original source repos are
[here](https://github.com/HariSekhon?tab=repositories&q=&type=source&language=&sort=stargazers).
Pre-built Docker images are available on my [DockerHub](https://hub.docker.com/u/harisekhon/).
