Skip to content

Commit 1bc8550

Browse files
bradeglerverbanicm
bradegler
authored and
verbanicm
committed
Implemented GitHub composite action and linters to meet the requirements
of the lightweight secure terraform project.
1 parent 1eb2bd5 commit 1bc8550

File tree

29 files changed

+1004
-291
lines changed

29 files changed

+1004
-291
lines changed

‎.github/actions/secure-setup-terraform/action.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# Copyright 2022 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
name: 'secure-setup-terraform action'
16+
description: 'Verify that the installed terraform binary matches a pre-computed hash. Ensure that there is a checked in provider lock file and that it is read only so that terraform cannot update it.'
17+
inputs:
18+
terraform_version:
19+
description: 'The terraform version to install'
20+
default: '1.3.2'
21+
required: false
22+
terraform_checksum:
23+
description: 'The pinned terraform checksum for the specified version'
24+
required: true
25+
26+
runs:
27+
using: 'composite'
28+
steps:
29+
- name: 'checkout'
30+
uses: 'actions/checkout@v3'
31+
- name: 'download-linters'
32+
shell: 'bash'
33+
env:
34+
release_version: '0.0.10'
35+
release_location: 'https://github.com/bradegler/secure-setup-terraform/releases/tag'
36+
run: |-
37+
curl -H "Authorization: token ${{ github.token }}" -O "${{env.release_location}}/v${{env.release_version}}/secure-setup-terraform_${{env.release_version}}_linux_amd64.tar.gz"
38+
tar xf secure-setup-terraform_${{env.release_version}}_linux_amd64.tar.gz
39+
40+
# Recursively search for terraform files in the current repo and run a linter that fails when it finds calls to 'local-exec'
41+
- name: 'lint-local-exec'
42+
shell: 'bash'
43+
run: ./lint-local-exec ./
44+
45+
# Search the .github/workflows for this project and run a linter that fails if it finds a direct call to the 'hashicorp/setup-terraform' action
46+
- name: 'lint-setup-terraform'
47+
shell: 'bash'
48+
run: ./lint-setup-terraform ./.github/workflows
49+
50+
- name: 'setup-terraform'
51+
uses: 'hashicorp/setup-terraform@v2'
52+
with:
53+
terraform_version: '${{ inputs.terraform_version }}'
54+
-
55+
name: 'verify-binary-checksum'
56+
shell: 'bash'
57+
run: |-
58+
echo "${{ inputs.terraform_checksum }} $(which terraform)" > terraform.sha256
59+
shasum --algorithm 256 --check terraform.sha256
60+
61+

‎.github/workflows/generate-terraform-checksum.yml‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
# Copyright 2022 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
name: 'generate terraform checksum'
16+
17+
on:
18+
workflow_dispatch:
19+
inputs:
20+
terraform_version:
21+
type: string
22+
description: Terraform version (e.g 1.3.2)
23+
required: false
24+
default: '1.3.2'
25+
26+
jobs:
27+
get_and_verify_checksum:
28+
runs-on: 'ubuntu-latest'
29+
env:
30+
VERSION: ${{ inputs.terraform_version }}
31+
outputs:
32+
binary_checksum: '${{ steps.verify-checksum.outputs.binary_checksum }}'
33+
archive_checksum: '${{ steps.verify-checksum.outputs.archive_checksum }}'
34+
steps:
35+
-
36+
name: 'verify-checksum'
37+
run: |-
38+
# Set a local gnupg home so as not to pollute the environment
39+
export GNUPGHOME=./.gnupg
40+
41+
# Terraform variables
42+
export ARCH=darwin_amd64
43+
export RELEASE_URL=https://releases.hashicorp.com/terraform/${VERSION}
44+
export BIN_FILE=terraform_${VERSION}_${ARCH}.zip
45+
export SHA_FILE=terraform_${VERSION}_SHA256SUMS
46+
export SIG_FILE=terraform_${VERSION}_SHA256SUMS.sig
47+
48+
# Generate a temporary key to use for verification
49+
gpg --batch --quick-generate-key --batch --passphrase "" [email protected]
50+
51+
# Retrieve the hashicorp key
52+
curl --remote-name https://keybase.io/hashicorp/pgp_keys.asc
53+
54+
# Import the key from hashicorp
55+
echo "importing key"
56+
gpg --batch --import pgp_keys.asc
57+
58+
# Sign the hashicorp key with our key
59+
echo "signing key"
60+
gpg --batch --yes --trust-model always --sign-key 34365D9472D7468F
61+
62+
# Download the archive, sha file and signature
63+
curl --remote-name ${RELEASE_URL}/${BIN_FILE}
64+
curl --remote-name ${RELEASE_URL}/${SHA_FILE}
65+
curl --remote-name ${RELEASE_URL}/${SIG_FILE}
66+
67+
# Verify the signature against the sha file
68+
echo "verifying shas"
69+
gpg --batch --verify ${SIG_FILE} ${SHA_FILE}
70+
71+
# Verify the archive's checksum
72+
shasum --algorithm 256 --check --ignore-missing ${SHA_FILE}
73+
74+
# Extract the binary from the archive
75+
unzip -o ${BIN_FILE}
76+
77+
# Extract only the shasum for the archive we care about
78+
ARCH_SUM=$(grep ${BIN_FILE} ${SHA_FILE} | cut -d' ' -f1)
79+
80+
# Produce a checksum of the binary
81+
BIN_SUM=$(shasum -a 256 terraform | cut -d' ' -f1)
82+
83+
# Store the binary and the archive checksums as outputs
84+
echo "archive_checksum=${ARCH_SUM}"
85+
echo "binary_checksum=${BIN_SUM}"
86+
87+
unset GNUPGHOME

‎.github/workflows/release.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# Copyright 2022 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
name: 'release'
16+
on:
17+
push:
18+
tags:
19+
- 'v*'
20+
21+
jobs:
22+
release:
23+
permissions:
24+
contents: 'write'
25+
packages: 'write'
26+
runs-on: 'ubuntu-latest'
27+
steps:
28+
- uses: 'actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8' # ratchet:actions/checkout@v3
29+
with:
30+
fetch-depth: 0
31+
- uses: 'actions/setup-go@c4a742cab115ed795e34d4513e2cf7d472deb55f' # ratchet:actions/setup-go@v3
32+
with:
33+
go-version: '1.19'
34+
- uses: 'docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a' # ratchet:docker/login-action@v2
35+
with:
36+
registry: 'ghcr.io'
37+
username: '${{ github.actor }}'
38+
password: '${{ secrets.GITHUB_TOKEN }}'
39+
- uses: 'goreleaser/goreleaser-action@b508e2e3ef3b19d4e4146d4f8fb3ba9db644a757' # ratchet:goreleaser/goreleaser-action@v3
40+
with:
41+
version: 'latest'
42+
args: 'release --rm-dist'
43+
env:
44+
GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'

‎.github/workflows/test.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Copyright 2022 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
name: 'test'
16+
on:
17+
push:
18+
branches:
19+
- 'main'
20+
pull_request:
21+
branches:
22+
- 'main'
23+
workflow_dispatch:
24+
concurrency:
25+
group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
26+
cancel-in-progress: true
27+
jobs:
28+
test:
29+
runs-on: 'ubuntu-latest'
30+
steps:
31+
- uses: 'actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8' # ratchet:actions/checkout@v3
32+
- uses: 'actions/setup-go@c4a742cab115ed795e34d4513e2cf7d472deb55f' # ratchet:actions/setup-go@v3
33+
with:
34+
go-version: '1.18'
35+
- run: |-
36+
go test -count=1 -shuffle=on -timeout=10m -race ./...

‎.github/workflows/verify-secure-terraform.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# Copyright 2022 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
name: 'verify-secure-terraform'
16+
17+
on:
18+
workflow_dispatch:
19+
inputs:
20+
terraform_version:
21+
type: string
22+
description: Terraform version (e.g 1.3.2)
23+
required: false
24+
default: '1.3.2'
25+
terraform_checksum:
26+
type: string
27+
description: Terraform version binary checksum
28+
required: false
29+
default: '5ae22d509e1f3c1644d4c8a905742e53598ec9f3cb12687bb1575f3f35c80830'
30+
31+
jobs:
32+
secure-setup-terraform:
33+
runs-on: 'ubuntu-latest'
34+
steps:
35+
- name: 'checkout'
36+
uses: 'actions/checkout@v3'
37+
-
38+
name: 'secure-setup-terraform'
39+
uses: './.github/actions/secure-setup-terraform'
40+
with:
41+
terraform_version: ${{env.terraform_version}}
42+
terraform_checksum: ${{env.terraform_checksum}}

‎.gitignore‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,5 +22,6 @@ go.work
2222

2323
.terraform
2424

25-
lint-local-exec
26-
lint-setup-terraform
25+
dist/
26+
27+
verify-terraform

‎.goreleaser.yaml‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
# Copyright 2022 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
project_name: secure-setup-terraform
16+
17+
env:
18+
# Global env vars for go build
19+
- 'CGO_ENABLED=0'
20+
- 'GO111MODULE=on'
21+
- 'GOPROXY=https://proxy.golang.org,direct'
22+
23+
before:
24+
hooks:
25+
- 'go mod tidy'
26+
- 'go mod verify'
27+
28+
builds:
29+
-
30+
id: 'lint-local-exec'
31+
main: './cmd/lint-local-exec'
32+
binary: 'lint-local-exec'
33+
mod_timestamp: '{{ .CommitTimestamp }}'
34+
flags:
35+
- '-a'
36+
- '-trimpath'
37+
ldflags:
38+
- '-s'
39+
- '-w'
40+
- '-X={{ .ModulePath }}/cmd/lint-local-exec/version.Name=lint-local-exec'
41+
- '-X={{ .ModulePath }}/cmd/lint-local-exec/version.Version={{ .Version }}'
42+
- '-X={{ .ModulePath }}/cmd/lint-local-exec/version.Commit={{ .Commit }}'
43+
- '-extldflags=-static'
44+
goos:
45+
- 'darwin'
46+
- 'linux'
47+
goarch:
48+
- 'amd64'
49+
- 'arm64'
50+
-
51+
id: 'lint-setup-terraform'
52+
main: './cmd/lint-setup-terraform'
53+
binary: 'lint-setup-terraform'
54+
mod_timestamp: '{{ .CommitTimestamp }}'
55+
flags:
56+
- '-a'
57+
- '-trimpath'
58+
ldflags:
59+
- '-s'
60+
- '-w'
61+
- '-X={{ .ModulePath }}/cmd/lint-setup-terraform/version.Name=lint-setup-terraform'
62+
- '-X={{ .ModulePath }}/cmd/lint-setup-terraform/version.Version={{ .Version }}'
63+
- '-X={{ .ModulePath }}/cmd/lint-setup-terraform/version.Commit={{ .Commit }}'
64+
- '-extldflags=-static'
65+
goos:
66+
- 'darwin'
67+
- 'linux'
68+
goarch:
69+
- 'amd64'
70+
- 'arm64'
71+
72+
archives:
73+
- format: 'tar.gz'
74+
name_template: '{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}'
75+
format_overrides:
76+
- goos: 'windows'
77+
format: 'zip'
78+
79+
checksum:
80+
name_template: '{{ .ProjectName }}_{{ .Version }}_SHA512SUMS'
81+
algorithm: 'sha512'
82+
83+
changelog:
84+
use: 'github'
85+
sort: 'asc'
86+
87+
release:
88+
draft: false
89+
mode: 'replace'

0 commit comments

Comments
 (0)