Add a job that runs diagnostics #144

jsf9k · 2023-08-29T21:17:24Z

🗣 Description

This pull request adds a diagnostics job that runs these GitHub Actions:

💭 Motivation and context

The GitHub Actions listed above are added in a separate diagnostics job. As configured the actions should never fail, but they will print out information that may be useful in diagnosing workflow failures.

🧪 Testing

All automated tests pass. I verified that the expected outputs appear in the GitHub Actions log (also here).

✅ Pre-approval checklist

This PR has an informative and human-readable title.
Changes are limited to a single goal - eschew scope creep!
All relevant type-of-change labels have been added.
I have read the CONTRIBUTING document.
These code changes follow cisagov code standards.
All new and existing tests pass.

mcdonnnj

Thanks for setting up this PR! I'm on board but I have two thoughts for consideration. First, would you please add this to the list of commented out dependencies in the Dependabot configuration:

skeleton-generic/.github/dependabot.yml

Lines 15 to 21 in bd762fe

    
           #   # Managed by cisagov/skeleton-generic 
        
           #   - dependency-name: actions/cache 
        
           #   - dependency-name: actions/checkout 
        
           #   - dependency-name: actions/setup-go 
        
           #   - dependency-name: actions/setup-python 
        
           #   - dependency-name: hashicorp/setup-terraform 
        
           #   - dependency-name: mxschmitt/action-tmate

Second, and this one is more a thought, what do you think about adding a needs block to the lint job and requiring the diagnostics job? Even if the diagnostics job does not currently leverage the ability for the Action to fail depending on the GitHub status, if the job has a problem while running that will generally not be a good sign for the lint job to run.

jsf9k · 2023-08-30T13:53:04Z

Thanks for setting up this PR! I'm on board but I have two thoughts for consideration. First, would you please add this to the list of commented out dependencies in the Dependabot configuration:

skeleton-generic/.github/dependabot.yml

Lines 15 to 21 in bd762fe

# # Managed by cisagov/skeleton-generic

# - dependency-name: actions/cache

# - dependency-name: actions/checkout

# - dependency-name: actions/setup-go

# - dependency-name: actions/setup-python

# - dependency-name: hashicorp/setup-terraform

# - dependency-name: mxschmitt/action-tmate

Second, and this one is more a thought, what do you think about adding a needs block to the lint job and requiring the diagnostics job? Even if the diagnostics job does not currently leverage the ability for the Action to fail depending on the GitHub status, if the job has a problem while running that will generally not be a good sign for the lint job to run.

@mcdonnnj - Please see commits 3e51119 and f88b9d2.

dav3r

Thanks @jsf9k (and also crazy-max) - this is a useful addition!

dav3r

👍 👍 👍

mcdonnnj · 2023-08-30T16:32:46Z

@jsf9k Would you please update the PR description to include the addition of the step-security/harden-runner Action?

jsf9k · 2023-08-30T16:35:14Z

@jsf9k Would you please update the PR description to include the addition of the step-security/harden-runner Action?

I just did it while you were writing your comment. Synchronicity!

jsf9k · 2023-08-30T16:40:49Z

I'm don't think that the step-security/harden-runner Action is covering the lint job when it is inserted only in the diagnostics job. I think that Action may need to be duplicated in each workflow job to actually provide the desired coverage. Am I right, @cisagov/team-ois?

I created commit 2bddec4 to test this hypothesis.

mcdonnnj · 2023-08-30T17:08:47Z

I'm don't think that the step-security/harden-runner Action is covering the lint job when it is inserted only in the diagnostics job. I think that Action may need to be duplicated in each workflow job to actually provide the desired coverage. Am I right, @cisagov/team-ois?

I created commit 2bddec4 to test this hypothesis.

Oh, right. Each job is its own runner so it would need to be used in every job you want hardened.

dav3r

🤖

jsf9k · 2023-08-30T17:57:27Z

I created commit 2bddec4 to test this hypothesis.

Looks like I was correct, so I'll leave the commit in place.

mcdonnnj · 2023-08-30T18:44:54Z

I created commit 2bddec4 to test this hypothesis.

Looks like I was correct, so I'll leave the commit in place.

@jsf9k Yes, please see my comment in #144 (comment). Also you may want to mention that the step-security/harden-runner Action must be added in every job (and that you added it to the lint job) in the description to better track when the kraken this change is included in is being resolved.

mcdonnnj

jsf9k · 2023-08-30T19:18:39Z

Also you may want to mention that the step-security/harden-runner Action must be added in every job (and that you added it to the lint job) in the description to better track when the kraken this change is included in is being resolved.

Please see commit 69dd196.

dav3r

⚡

This action is added in a separate "diagnostics" job. As configured it will never fail, but it will print out the status of the various GitHub components. This information will sometimes be useful when determining why builds fail after the fact. Co-authored-by: Mark Feldhousen <mark.feldhousen@gwe.cisa.dhs.gov> Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

Even though the diagnostics job is not currently configured to fail due to the GitHub status, it is still true that if the job is unable to run that does not bode well for the lint job's successful execution. Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

This can be useful when debugging why a GH Action failed. Co-authored-by: felddy <mark.feldhousen@gwe.cisa.dhs.gov>

This GH Action is being configured to run in audit mode. It should warn us if an Action is reaching out to an unexpected web address, overwriting source code, etc. Co-authored-by: felddy <mark.feldhousen@gwe.cisa.dhs.gov>

This task can only provide coverage for the job that contains it.

We need a reminder add the step-security/harden-runner action at the top of every job. Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

The CodeQL workflow already had a harden-runner task, but it's good to agree everywhere with the changes we made to the build.yml workflow in cisagov/skeleton-generic#144.

It's good to agree everywhere with the changes we made to the build.yml workflow in cisagov/skeleton-generic#144.

jsf9k added the improvement This issue or pull request will add or improve functionality, maintainability, or ease of use label Aug 29, 2023

jsf9k self-assigned this Aug 29, 2023

jsf9k marked this pull request as ready for review August 29, 2023 21:19

jsf9k requested review from dav3r, felddy, jasonodoom and mcdonnnj as code owners August 29, 2023 21:19

jsf9k requested a review from a team August 29, 2023 21:19

mcdonnnj requested changes Aug 30, 2023

View reviewed changes

jsf9k force-pushed the improvement/add-github-status-jazz branch from f708ed4 to f88b9d2 Compare August 30, 2023 13:52

jsf9k requested a review from mcdonnnj August 30, 2023 13:53

dav3r approved these changes Aug 30, 2023

View reviewed changes

jsf9k changed the title ~~Add the crazy-max/ghaction-github-status GitHub action~~ Add a job that runs diagnostics Aug 30, 2023

jsf9k force-pushed the improvement/add-github-status-jazz branch from a737e7d to e49ee95 Compare August 30, 2023 14:51

jsf9k requested a review from dav3r August 30, 2023 14:52

dav3r approved these changes Aug 30, 2023

View reviewed changes

jsf9k requested a review from dav3r August 30, 2023 17:01

dav3r approved these changes Aug 30, 2023

View reviewed changes

mcdonnnj approved these changes Aug 30, 2023

View reviewed changes

jsf9k assigned jmorrowomni and mcdonnnj and unassigned jsf9k Aug 30, 2023

mcdonnnj added the kraken 🐙 This pull request is ready to merge during the next Lineage Kraken release label Aug 30, 2023

dav3r approved these changes Aug 31, 2023

View reviewed changes

jasonodoom approved these changes Aug 31, 2023

View reviewed changes

mcdonnnj added this pull request to the merge queue Sep 13, 2023

github-merge-queue bot removed this pull request from the merge queue due to a conflict with the base branch Sep 13, 2023

jsf9k and others added 7 commits September 12, 2023 21:50

Add a GH Action to dump the context

f437066

This can be useful when debugging why a GH Action failed. Co-authored-by: felddy <mark.feldhousen@gwe.cisa.dhs.gov>

Give the diagnostics job a descriptive name

c5e56a2

Add the step-security/harden-runner GH Action

9afb516

This GH Action is being configured to run in audit mode. It should warn us if an Action is reaching out to an unexpected web address, overwriting source code, etc. Co-authored-by: felddy <mark.feldhousen@gwe.cisa.dhs.gov>

Add a harden-runner task to the lint job as well

9dc773c

This task can only provide coverage for the job that contains it.

Add a reminder

bb81ec3

We need a reminder add the step-security/harden-runner action at the top of every job. Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

mcdonnnj force-pushed the improvement/add-github-status-jazz branch from 69dd196 to bb81ec3 Compare September 13, 2023 01:53

mcdonnnj added this pull request to the merge queue Sep 13, 2023

Merged via the queue into develop with commit c0eed09 Sep 13, 2023
6 checks passed

mcdonnnj deleted the improvement/add-github-status-jazz branch September 13, 2023 02:00

jsf9k mentioned this pull request Sep 13, 2023

Add a diagnostics job for the label syncing workflow #150

Merged

6 tasks

jsf9k mentioned this pull request Oct 5, 2023

Add a diagnostics job to the CodeQL workflow cisagov/skeleton-ansible-role#163

Merged

6 tasks

jsf9k added a commit to cisagov/skeleton-docker that referenced this pull request Oct 11, 2023

Add a diagnostics job to the CodeQL workflow

8c6b096

It's good to agree everywhere with the changes we made to the build.yml workflow in cisagov/skeleton-generic#144.

jsf9k mentioned this pull request Oct 11, 2023

Add a diagnostics job to the CodeQL workflow cisagov/skeleton-docker#178

Merged

6 tasks

jsf9k added a commit to cisagov/skeleton-python-library that referenced this pull request Oct 11, 2023

Add a diagnostics job to the CodeQL workflow

0541200

It's good to agree everywhere with the changes we made to the build.yml workflow in cisagov/skeleton-generic#144.

jsf9k mentioned this pull request Oct 11, 2023

Add a diagnostics job to the CodeQL workflow cisagov/skeleton-python-library#125

Merged

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add a job that runs diagnostics #144

Add a job that runs diagnostics #144

jsf9k commented Aug 29, 2023 •

edited

Loading

mcdonnnj left a comment

jsf9k commented Aug 30, 2023

dav3r left a comment

dav3r left a comment

mcdonnnj commented Aug 30, 2023

jsf9k commented Aug 30, 2023

jsf9k commented Aug 30, 2023 •

edited

Loading

mcdonnnj commented Aug 30, 2023

dav3r left a comment

jsf9k commented Aug 30, 2023

mcdonnnj commented Aug 30, 2023 •

edited

Loading

mcdonnnj left a comment

jsf9k commented Aug 30, 2023

dav3r left a comment

	# # Managed by cisagov/skeleton-generic
	# - dependency-name: actions/cache
	# - dependency-name: actions/checkout
	# - dependency-name: actions/setup-go
	# - dependency-name: actions/setup-python
	# - dependency-name: hashicorp/setup-terraform
	# - dependency-name: mxschmitt/action-tmate

Add a job that runs diagnostics #144

Add a job that runs diagnostics #144

Conversation

jsf9k commented Aug 29, 2023 • edited Loading

🗣 Description

💭 Motivation and context

🧪 Testing

✅ Pre-approval checklist

mcdonnnj left a comment

Choose a reason for hiding this comment

jsf9k commented Aug 30, 2023

dav3r left a comment

Choose a reason for hiding this comment

dav3r left a comment

Choose a reason for hiding this comment

mcdonnnj commented Aug 30, 2023

jsf9k commented Aug 30, 2023

jsf9k commented Aug 30, 2023 • edited Loading

mcdonnnj commented Aug 30, 2023

dav3r left a comment

Choose a reason for hiding this comment

jsf9k commented Aug 30, 2023

mcdonnnj commented Aug 30, 2023 • edited Loading

mcdonnnj left a comment

Choose a reason for hiding this comment

jsf9k commented Aug 30, 2023

dav3r left a comment

Choose a reason for hiding this comment

jsf9k commented Aug 29, 2023 •

edited

Loading

jsf9k commented Aug 30, 2023 •

edited

Loading

mcdonnnj commented Aug 30, 2023 •

edited

Loading