Repository navigation
ci: fix ansible-lint, scorecard and markdownlint failures on main - #125
Merged
Merged
Conversation
Every PR fails three checks that come from main, not from the PR: - Ansible lint: ansible-lint 24.9.2 crashes on the ansible-core 2.19 it now installs (no module ansible.parsing.yaml.constructor). Move to v26.10.1; the playbooks pass it with no findings. - Scorecards: scorecard-action v2.3.1 pulls its image from gcr.io, which now fails with a billing error. Use a local copy of the shared workflow on v2.5.0 (ghcr.io image) with current checkout, upload-artifact and codeql actions. Fork PRs only run the analysis; publishing and the SARIF upload happen on main. - markdown-lint: align the bom.md and ips.md tables (MD060) and replace "here" link texts with descriptive ones (MD059). Also point the OTEL links in hardware/mgmt/README.md at otel.md, which is where the page lives. Signed-off-by: Mircea Dan Gheorghe <mircea-dan.gheorghe@keysight.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: ansible/ansible-lint@v24.9.2 | ||
| - uses: ansible/ansible-lint@v26.10.1 |
The ToR config carried the sha512-crypt hashes of the enable, admin and arista passwords. Salted hashes can still be guessed offline at GPU speed with no lockout, so keep them out of a public repo. The A100G config already had a dummy value; use the same <hash> placeholder there. Nothing applies these files to the switches yet (the upload task in switches.yml is a TODO), so fill in the real hashes before using them. Signed-off-by: Mircea Dan Gheorghe <mircea-dan.gheorghe@keysight.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every open PR (#106, #114, #115, #116, #117, #124) fails the same three checks. None of these failures comes from the PRs themselves; they all come from main. Merging this first should turn the other PRs green once they are rebased.
ansible/ansible-lint@v24.9.2installs ansible-core 2.19, which removedansible.parsing.yaml.constructor, so the lint crashesv26.10.1; the playbooks pass it in theproductionprofile with no findingsossf/scorecard-actionv2.3.1, whose image comes from gcr.io and now fails with a billing errorscorecard.ymlon v2.5.0 (ghcr.io image), with SHA-pinned checkout, upload-artifact and codeql actions; fork PRs only run the analysis, and publishing and the SARIF upload run on mainbom.mdandips.md) and 14 MD059 ("here" link text)hardware/mgmt/README.mdnow point atotel.md, where the page actually livesChecked locally with the same tools CI uses: markdownlint-cli 0.49.1 (
--ignore=minutes --disable=MD013) reports 0 findings, and ansible-lint 26.10.1 with ansible-core 2.21 reports 0 failures and 0 warnings.After this merges, #114, #115 and #124 will need a rebase: they touch some of the same lines in
ips.md,server-setup.mdandhardware/mgmt/README.md.Also in this PR:
hardware/ToR/arista.configcarried the sha512-crypt hashes of the enable, admin and arista passwords. Salted hashes can still be guessed offline with no lockout, so they are nowsha512 <hash>placeholders. The A100G config already had a dummy value and now uses the same placeholder. Nothing applies these files to the switches yet (the upload task inansible/switches.ymlis a TODO). Removing the lines does not remove them from git history, so the passwords behind them should be treated as exposed.