Merge branch 'main' into busy-lobster

Author: max-ostapenko

.github/dependabot.yml

@@ -13,14 +13,20 @@ updates:
       - "/infra/dataform-service"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "terraform"
     directories:
       - "/infra/tf/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7

.github/linters/.flake8

@@ -0,0 +1,2 @@
+[flake8]
+extend-ignore = E501

.github/linters/.sqlfluff

@@ -0,0 +1,24 @@
+[sqlfluff]
+dialect = bigquery
+max_line_length = 200
+
+[sqlfluff:indentation]
+indent_unit = space
+tab_space_size = 2
+indented_using_on = False
+allow_implicit_indents = True
+
+[sqlfluff:layout:type:binary_operator]
+line_position = trailing
+
+[sqlfluff:rules:capitalisation.keywords]
+capitalisation_policy = upper
+
+[sqlfluff:rules:capitalisation.types]
+extended_capitalisation_policy = upper
+
+[sqlfluff:rules:convention.count_rows]
+prefer_count_0 = True
+
+[sqlfluff:rules:convention.quoted_literals]
+preferred_quoted_literal_style = single_quotes

.github/linters/eslint.config.mjs

@@ -22,7 +22,8 @@ export default [
         ctx: 'readonly',
         constants: 'readonly',
         reports: 'readonly',
-        reservations: 'readonly'
+        reservations: 'readonly',
+        descriptions: 'readonly'
       }
     },
     rules: {

.github/linters/zizmor.yaml

@@ -2,3 +2,4 @@ rules:
   unpinned-uses:
     ignore:
       - ci.yaml
+      - infra.yaml

.github/workflows/ci.yaml

@@ -21,13 +21,13 @@ jobs:
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Lint Code Base
-        uses: super-linter/super-linter/slim@v8.1.0
+        uses: super-linter/super-linter/slim@v8.3.2
         env:
           DEFAULT_BRANCH: main
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -36,6 +36,8 @@ jobs:
           VALIDATE_MARKDOWN_PRETTIER: false
           VALIDATE_CHECKOV: false
           VALIDATE_GIT_COMMITLINT: false
+          VALIDATE_BIOME_FORMAT: false
+          VALIDATE_BIOME_LINT: false
 
   dependabot:
     name: Dependabot auto-merge

.github/workflows/infra.yaml

@@ -0,0 +1,56 @@
+name: Terraform Apply on Changes
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "infra/**"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  terraform:
+    name: Terraform
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Authenticate with Google Cloud
+        uses: google-github-actions/auth@v3
+        with:
+          project_id: "httparchive"
+          credentials_json: "${{ secrets.GCP_SA_KEY }}"
+
+      - name: Set up Terraform
+        uses: hashicorp/setup-terraform@v3.1.2
+
+      - name: Terraform Format Check
+        working-directory: ./infra
+        run: terraform fmt -check
+
+      - name: Initialize Terraform
+        working-directory: ./infra
+        run: terraform init
+
+      - name: Validate Terraform
+        working-directory: ./infra
+        run: terraform validate
+
+      - name: Plan Terraform
+        working-directory: ./infra
+        run: terraform plan -out=tfplan
+
+      - name: Apply Terraform
+        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+        working-directory: ./infra
+        run: terraform apply -auto-approve tfplan

.gitignore

@@ -1,4 +1,5 @@
-node_modules/
 .DS_Store
-infra/tf/.terraform/
+.vscode/
+**/node_modules/
+**/.terraform/
 .env

Makefile

@@ -1,13 +1,9 @@
-.PHONY: *
-
 clean:
-	rm -rf ./infra/dataform-trigger/node_modules
-	rm -rf ./infra/dataform-export/node_modules
 	rm -rf ./infra/bigquery-export/node_modules
-	rm -rf infra/tf/tmp/*
+	rm -rf ./infra/dataform-service/node_modules
 
 tf_plan:
-	terraform -chdir=infra/tf init -upgrade && terraform -chdir=infra/tf plan
+	cd infra && terraform init -upgrade && terraform plan
 
 tf_apply:
-	terraform -chdir=infra/tf init && terraform -chdir=infra/tf apply -auto-approve
+	cd infra && terraform init && terraform apply -auto-approve

SECURITY.md

@@ -0,0 +1,5 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please report any suspected security issues to `team@httparchive.org`. We currently to not participate in a bug bounty programme.