nist-hardening-suite/.github/workflows/ci.yml at master · Miguel-DevOps/nist-hardening-suite · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
name: CI

on:
  push:
    branches:
      - main
      - develop
  pull_request:
    branches:
      - main

jobs:
  lint-and-validate:
    name: Lint, Validate & Security
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.14"

      - name: Set up uv
        uses: astral-sh/setup-uv@v4

      - name: Sync toolchain
        run: |
          uv sync

      - name: Install Ansible collections
        run: |
          uv run ansible-galaxy collection install -r requirements.yml

      - name: Run ansible-lint
        run: |
          uv run ansible-lint stacks.yml monitoring.yml nuke.yml

      - name: Run yamllint
        run: |
          uv run yamllint .

      - name: Validate playbook syntax
        run: |
          echo "🔍 Validating playbook syntax..."
          uv run ansible-playbook --syntax-check site.yml
          uv run ansible-playbook --syntax-check stacks.yml
          uv run ansible-playbook --syntax-check monitoring.yml
          uv run ansible-playbook --syntax-check nuke.yml
          echo "✅ All playbooks have valid syntax"

      - name: Scan for exposed secrets
        run: |
          echo "🔍 Scanning for secrets with detect-secrets..."
          uv run detect-secrets scan \
            --baseline .secrets.baseline \
            --exclude-files roles/.*/(defaults|vars)/.*\.yml \
            --exclude-files group_vars/.*\.yml \
            --exclude-files ^\.venv/ \
            --exclude-files ^\.uv/ \
            --exclude-files ^node_modules/ \
            --exclude-files ^\.git/ \
            --all-files \
            2>&1 | tee detect-secrets-output.txt

          if grep -q "\"results\": {}" detect-secrets-output.txt; then
            echo "✅ No new secrets detected"
          else
            echo "❌ Potential secrets detected"
            echo "Do not commit secrets to version control"
            echo "Use Ansible Vault or environment variables instead"
            exit 1
          fi

  validate-roles:
    name: Validate Role Structure
    runs-on: ubuntu-latest
    strategy:
      matrix:
        role: [common, security, docker, tailscale_client, crowdsec, compliance, observability, stack_ingress, stack_portainer]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.14"

      - name: Set up uv
        uses: astral-sh/setup-uv@v4

      - name: Sync toolchain
        run: |
          uv sync

      - name: Install Ansible collections
        run: |
          uv run ansible-galaxy collection install -r requirements.yml

      - name: Validate role structure
        run: |
          if [ -f "roles/${{ matrix.role }}/tasks/main.yml" ]; then
            echo "✅ Role ${{ matrix.role }}: Structure valid"
            uv run ansible-lint "roles/${{ matrix.role }}"
          else
            echo "⚠️  Role ${{ matrix.role }}: No executable tasks"
          fi

  convergence-check:
    name: Convergence & Idempotency Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.14"

      - name: Set up uv
        uses: astral-sh/setup-uv@v4

      - name: Sync toolchain
        run: |
          uv sync

      - name: Install Ansible collections
        run: |
          uv run ansible-galaxy collection install -r requirements.yml

      - name: Final playbook syntax validation
        run: |
          echo "🔍 Final convergence check..."
          uv run ansible-playbook --syntax-check \
            -i inventory/hosts.ini \
            site.yml stacks.yml monitoring.yml nuke.yml
          echo "✅ Convergence test passed"