Skip to content

Commit 792fcca

Browse files
alessfgalessfg
authored
Merge branch 'main' into agent-updates
2 parents cad42f0 + 8d41705 commit 792fcca

File tree

24 files changed

+203
-126
lines changed

24 files changed

+203
-126
lines changed

‎.github/workflows/f5-cla.yml

Lines changed: 39 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,40 @@
11
---
2-
name: F5 CLA
3-
on:
4-
issue_comment:
5-
types: [created]
6-
pull_request_target:
7-
types: [opened, closed, synchronize]
8-
permissions: read-all
9-
jobs:
10-
f5-cla:
11-
name: F5 CLA
12-
runs-on: ubuntu-24.04
13-
permissions:
14-
actions: write
15-
pull-requests: write
16-
statuses: write
17-
steps:
18-
- name: Run F5 Contributor License Agreement (CLA) assistant
19-
if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have hereby read the F5 CLA and agree to its terms') || github.event_name == 'pull_request_target'
20-
uses: contributor-assistant/github-action@9340315624c6e16cef1f2c63bdeb0f0c49c6f474 # v2.4.0
21-
with:
22-
# Any pull request targeting the following branch will trigger a CLA check.
23-
branch: main
24-
# Path to the CLA document.
25-
path-to-document: https://github.com/f5/.github/blob/main/CLA/cla-markdown.md
26-
# Custom CLA messages.
27-
custom-notsigned-prcomment: '🎉 Thank you for your contribution! It appears you have not yet signed the F5 Contributor License Agreement (CLA), which is required for your changes to be incorporated into an F5 Open Source Software (OSS) project. Please kindly read the [F5 CLA](https://github.com/f5/.github/blob/main/CLA/cla-markdown.md) and reply on a new comment with the following text to agree:'
28-
custom-pr-sign-comment: 'I have hereby read the F5 CLA and agree to its terms'
29-
custom-allsigned-prcomment: '✅ All required contributors have signed the F5 CLA for this PR. Thank you!'
30-
# Remote repository storing CLA signatures.
31-
remote-organization-name: f5
32-
remote-repository-name: f5-cla-data
33-
path-to-signatures: signatures/signatures.json
34-
# Comma separated list of usernames for maintainers or any other individuals who should not be prompted for a CLA.
35-
allowlist: alessfg, oxpa, bot*
36-
# Do not lock PRs after a merge.
37-
lock-pullrequest-aftermerge: false
38-
env:
39-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
40-
PERSONAL_ACCESS_TOKEN: ${{ secrets.F5_CLA_TOKEN }}
2+
name: F5 CLA
3+
on:
4+
issue_comment:
5+
types: [created]
6+
pull_request_target:
7+
types: [opened, closed, synchronize]
8+
permissions: read-all
9+
jobs:
10+
f5-cla:
11+
name: F5 CLA
12+
runs-on: ubuntu-24.04
13+
permissions:
14+
actions: write
15+
pull-requests: write
16+
statuses: write
17+
steps:
18+
- name: Run F5 Contributor License Agreement (CLA) assistant
19+
if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have hereby read the F5 CLA and agree to its terms') || github.event_name == 'pull_request_target'
20+
uses: contributor-assistant/github-action@9340315624c6e16cef1f2c63bdeb0f0c49c6f474 # v2.4.0
21+
with:
22+
# Any pull request targeting the following branch will trigger a CLA check.
23+
branch: main
24+
# Path to the CLA document.
25+
path-to-document: https://github.com/f5/.github/blob/main/CLA/cla-markdown.md
26+
# Custom CLA messages.
27+
custom-notsigned-prcomment: '🎉 Thank you for your contribution! It appears you have not yet signed the F5 Contributor License Agreement (CLA), which is required for your changes to be incorporated into an F5 Open Source Software (OSS) project. Please kindly read the [F5 CLA](https://github.com/f5/.github/blob/main/CLA/cla-markdown.md) and reply on a new comment with the following text to agree:'
28+
custom-pr-sign-comment: 'I have hereby read the F5 CLA and agree to its terms'
29+
custom-allsigned-prcomment: '✅ All required contributors have signed the F5 CLA for this PR. Thank you!'
30+
# Remote repository storing CLA signatures.
31+
remote-organization-name: f5
32+
remote-repository-name: f5-cla-data
33+
path-to-signatures: signatures/signatures.json
34+
# Comma separated list of usernames for maintainers or any other individuals who should not be prompted for a CLA.
35+
allowlist: alessfg, oxpa, bot*
36+
# Do not lock PRs after a merge.
37+
lock-pullrequest-aftermerge: false
38+
env:
39+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
40+
PERSONAL_ACCESS_TOKEN: ${{ secrets.F5_CLA_TOKEN }}

‎.github/workflows/ossf-scorecard.yml

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
---
2+
# This workflow uses actions that are not certified by GitHub. They are provided by a third-party and are governed by separate terms of service, privacy policy, and support documentation.
3+
name: OSSF Scorecard
4+
on:
5+
# For Branch-Protection check. Only the default branch is supported. See https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection.
6+
branch_protection_rule:
7+
push:
8+
branches: [main]
9+
# To guarantee Maintained check is occasionally updated. See https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained.
10+
schedule:
11+
- cron: "0 0 * * 1"
12+
workflow_dispatch:
13+
# Declare default permissions as read only.
14+
permissions: read-all
15+
jobs:
16+
analysis:
17+
name: Scorecard analysis
18+
runs-on: ubuntu-24.04
19+
permissions:
20+
# Needed if using Code Scanning alerts
21+
security-events: write
22+
# Needed for GitHub OIDC token if publish_results is true
23+
id-token: write
24+
# Uncomment the permissions below if installing on a private repository.
25+
# contents: read
26+
# actions: read
27+
# issues: read # To allow GraphQL ListCommits to work
28+
# pull-requests: read # To allow GraphQL ListCommits to work
29+
# checks: read # To detect SAST tools
30+
steps:
31+
- name: Check out the codebase
32+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
33+
with:
34+
persist-credentials: false
35+
36+
- name: Run analysis
37+
uses: ossf/scorecard-action@dc50aa9510b46c811795eb24b2f1ba02a914e534 # v2.3.3
38+
with:
39+
results_file: results.sarif
40+
results_format: sarif
41+
# (Optional) fine-grained personal access token. Uncomment the `repo_token` line below if:
42+
# - You want to enable the Branch-Protection check on a *public* repository.
43+
# - You are installing the OSSF Scorecard on a *private* repository.
44+
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-fine-grained-pat-optional.
45+
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
46+
47+
# Publish the results for public repositories to enable scorecard badges. For more details, see https://github.com/ossf/scorecard-action#publishing-results.
48+
# For private repositories, `publish_results` will automatically be set to `false`, regardless of the value entered here.
49+
publish_results: true
50+
51+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF format to the repository Actions tab.
52+
- name: Upload artifact
53+
uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
54+
with:
55+
name: SARIF file
56+
path: results.sarif
57+
retention-days: 5
58+
59+
# Upload the results to GitHub's code scanning dashboard.
60+
- name: Upload SARIF results to code scanning
61+
uses: github/codeql-action/upload-sarif@2d790406f505036ef40ecba973cc774a50395aac # v3.25.13
62+
with:
63+
sarif_file: results.sarif

‎.github/workflows/release.yml

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,20 @@
11
---
2-
name: Release Drafter
3-
on:
4-
push:
5-
branches: [main]
6-
pull_request_target:
7-
types: [opened, reopened, synchronize]
8-
permissions: read-all
9-
jobs:
10-
release-draft:
11-
name: Update release draft
12-
runs-on: ubuntu-24.04
13-
permissions:
14-
contents: write
15-
pull-requests: write
16-
steps:
17-
- name: Run release drafter
18-
uses: release-drafter/release-drafter@3f0f87098bd6b5c5b9a36d49c41d998ea58f9348 # v6.0.0
19-
env:
20-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2+
name: Release Drafter
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request_target:
7+
types: [opened, reopened, synchronize]
8+
permissions: read-all
9+
jobs:
10+
release-draft:
11+
name: Update release draft
12+
runs-on: ubuntu-24.04
13+
permissions:
14+
contents: write
15+
pull-requests: write
16+
steps:
17+
- name: Run release drafter
18+
uses: release-drafter/release-drafter@3f0f87098bd6b5c5b9a36d49c41d998ea58f9348 # v6.0.0
19+
env:
20+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎CHANGELOG.md

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,19 +13,26 @@ FEATURES:
1313
- Add support for installing NGINX Open Source on Alpine Linux 3.20.
1414
- Add support for installing NGINX Agent on Ubuntu noble.
1515
- Add validation tasks to check the Ansible version, the Jinja2 version, and whether the required Ansible collections for this role are installed.
16+
- Bump the minimum version of Ansible supported to `2.16`, whilst clarifying that Ansible `2.18` is not supported at this stage.
1617
- Bump the Ansible `community.general` collection to `9.2.0`, `community.crypto` collection to `2.21.1` and `community.docker` collection to `3.11.0`.
1718

1819
DOCUMENTATION:
1920

2021
- Update community docs per the latest [NGINX template repository](https://github.com/nginxinc/template-repository) guidelines.
2122
- Update and tweak the README. In order to make the installation instructions easier, some file names used by the various GitHub Actions workflows have been renamed.
2223

24+
TESTS:
25+
26+
- Update RHEL UBI images to UBI 8.10 and UBI 9.4.
27+
2328
CI/CD:
2429

2530
- Update GitHub Actions to Ubuntu 24.04.
2631
- Switch GitHub Actions from using tags to release hashes.
2732
- Remove commented out Molecule platforms and GitHub Actions QEMU step for the time being. These changes will be reverted if multi-arch testing can be reinstated in GitHub Actions.
33+
- Bump the minimum version of Ansible supported on Ansible Galaxy to `2.16`.
2834
- Remove platform metadata from the Ansible Galaxy role metadata since platforms are no longer supported in Ansible Galaxy NG.
35+
- Implement OSSF Scorecard.
2936

3037
## 0.24.3 (July 11, 2024)
3138

@@ -58,7 +65,7 @@ CI/CD:
5865
- Add Molecule tests for NGINX Amplify.
5966
- Update the RHEL based tests to use the latest UBI release.
6067
- Use the local role name (`ansible-role-nginx`) instead of the fully qualified role name (`nginxinc.nginx`) in Molecule to ensure tests always work as intended in environments where the role has been already installed beforehand.
61-
- Implement F5 CLA signatures.
68+
- Implement F5 CLA.
6269
- Hardcode version of Python requests module given its propensity to break the Docker Python SDK.
6370

6471
## 0.24.2 (October 3rd, 2023)

‎CONTRIBUTING.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ Follow this project's [Installation Guide](/README.md#Installation) to install A
2121

2222
### Project Structure
2323

24-
- The NGINX Ansible role is written in `yaml` and supports NGINX Open Source, NGINX Plus, NGINX Agent and NGINX Amplify.
24+
- The NGINX Ansible role is written in [`yaml`](https://yaml.org) and supports NGINX Open Source, NGINX Plus, NGINX Agent and NGINX Amplify.
2525
- The project follows the standard [Ansible role directory structure](https://docs.ansible.com/ansible/latest/user_guide/playbooks_reuse_roles.html):
2626
- The main "codebase" is found in the [`tasks/`](/tasks/) directory.
2727
- Variables can be found in [`defaults/main/`](/defaults/main/). The filenames in this directory highlight which variables are contained in each file.

0 commit comments

Comments
 (0)