Skip to content

Commit 01be30a

Browse files
SMillerDevissyl0
SMillerDev
and
issyl0
committed
initial commit
Co-authored-by: Issy Long <issy@brew.sh>
0 parents  commit 01be30a

23 files changed

+687
-0
lines changed

‎.github/dependabot.yml

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
version: 2
3+
4+
updates:
5+
- package-ecosystem: "terraform"
6+
directory: "/"
7+
schedule:
8+
interval: "daily"

‎.github/workflows/ci.yml

+84
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
name: Check
2+
on:
3+
push:
4+
branches:
5+
- main
6+
pull_request:
7+
8+
concurrency:
9+
group: ${{ github.workflow }}-${{ github.ref }}
10+
cancel-in-progress: true
11+
12+
jobs:
13+
opentofu:
14+
name: OpenTofu
15+
runs-on: ubuntu-latest
16+
permissions:
17+
contents: read
18+
id-token: write
19+
env:
20+
TFC_AWS_RUN_ROLE_ARN: ${{ secrets.amazon_role }}
21+
steps:
22+
- uses: actions/checkout@v4
23+
24+
- uses: opentofu/setup-opentofu@v1
25+
26+
- name: OpenTofu fmt
27+
id: fmt
28+
run: tofu fmt -check
29+
30+
- name: Configure AWS Credentials
31+
uses: aws-actions/configure-aws-credentials@v4
32+
with:
33+
aws-region: us-east-1
34+
role-to-assume: ${{ secrets.amazon_role }}
35+
36+
- name: OpenTofu Init
37+
id: init
38+
run: tofu init
39+
40+
- name: OpenTofu Validate
41+
id: validate
42+
run: tofu validate -no-color
43+
44+
- name: OpenTofu Plan
45+
env:
46+
GITHUB_TOKEN: ${{ secrets.TF_GH_TOKEN }}
47+
run: tofu plan -no-color -var-file .tfvars -detailed-exitcode
48+
49+
trivy:
50+
name: Trivy
51+
runs-on: ubuntu-latest
52+
permissions:
53+
contents: read
54+
actions: read
55+
pull-requests: write
56+
steps:
57+
- name: Checkout code
58+
uses: actions/checkout@v4
59+
60+
- name: Run Trivy vulnerability scanner in IaC mode
61+
uses: aquasecurity/trivy-action@master
62+
with:
63+
scan-type: config
64+
format: table
65+
hide-progress: true
66+
ignore-unfixed: true
67+
severity: 'CRITICAL,HIGH'
68+
output: trivy.txt
69+
exit-code: '1'
70+
71+
- name: Publish Trivy Output to Summary
72+
if: always()
73+
run: |
74+
if [[ -s trivy.txt ]]; then
75+
{
76+
echo "### Security Output"
77+
echo "<details><summary>Click to expand</summary>"
78+
echo ""
79+
echo '```terraform'
80+
cat trivy.txt
81+
echo '```'
82+
echo "</details>"
83+
} >> $GITHUB_STEP_SUMMARY
84+
fi

‎.gitignore

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Local .terraform directories
2+
**/.terraform/*
3+
4+
# .tfstate files
5+
*.tfstate
6+
*.tfstate.*
7+
8+
# Crash log files
9+
crash.log
10+
crash.*.log
11+
12+
# Ignore override files as they are usually used to override resources locally and so
13+
# are not checked in
14+
override.tf
15+
override.tf.json
16+
*_override.tf
17+
*_override.tf.json
18+
19+
# Include override files you do wish to add to version control using negated pattern
20+
# !example_override.tf
21+
22+
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
23+
# example: *tfplan*
24+
25+
# Ignore CLI configuration files
26+
.terraformrc
27+
terraform.rc

‎.terraform.lock.hcl

+60
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎.tfvars

+146
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
teams = {
2+
members = [
3+
"DomT4",
4+
"danielnachun",
5+
"dawidd6",
6+
"gromgit",
7+
"johndbritton",
8+
"lembacon",
9+
"maxim-belkin",
10+
"mistydemeo",
11+
"scpeters",
12+
"singingwolfboy",
13+
"sjackman",
14+
"victorpopkov",
15+
"vitorgalvao",
16+
"whoiswillma",
17+
"xu-cheng",
18+
],
19+
plc = [
20+
"MikeMcQuaid",
21+
"colindean",
22+
"issyl0",
23+
"mozzadrella",
24+
"p-linnane",
25+
],
26+
security = [
27+
"MikeMcQuaid",
28+
"p-linnane",
29+
"woodruffw",
30+
],
31+
bots = [
32+
"BrewTestBot",
33+
"BrewSponsorsBot",
34+
],
35+
maintainers = {
36+
brew = [
37+
"Bo98",
38+
"EricFromCanada",
39+
"MikeMcQuaid",
40+
"Rylan12",
41+
"SMillerDev",
42+
"ZhongRuoyu",
43+
"apainintheneck",
44+
"bayandin",
45+
"carlocab",
46+
"cho-m",
47+
"dduugg",
48+
"iMichka",
49+
"issyl0",
50+
"miccal",
51+
"nandahkrishna",
52+
"p-linnane",
53+
"reitermarkus",
54+
"samford",
55+
"woodruffw",
56+
],
57+
cask = [
58+
"Bo98",
59+
"Rylan12",
60+
"SMillerDev",
61+
"alebcay",
62+
"bevanjkay",
63+
"chenrui333",
64+
"cho-m",
65+
"khipp",
66+
"krehel",
67+
"miccal",
68+
"p-linnane",
69+
"razvanazamfirei",
70+
"reitermarkus",
71+
"samford",
72+
],
73+
ci-orchestrator = [
74+
"Bo98",
75+
"carlocab",
76+
],
77+
core = [
78+
"Bo98",
79+
"EricFromCanada",
80+
"MikeMcQuaid",
81+
"Moisan",
82+
"Rylan12",
83+
"SMillerDev",
84+
"ZhongRuoyu",
85+
"alebcay",
86+
"bayandin",
87+
"bevanjkay",
88+
"branchvincent",
89+
"carlocab",
90+
"chenrui333",
91+
"cho-m",
92+
"dtrodrigues",
93+
"fxcoudert",
94+
"iMichka",
95+
"issyl0",
96+
"krehel",
97+
"miccal",
98+
"nandahkrishna",
99+
"p-linnane",
100+
"samford",
101+
"stefanb",
102+
"timsutton",
103+
"woodruffw",
104+
],
105+
formulae-web = [
106+
"EricFromCanada",
107+
"MikeMcQuaid",
108+
"Rylan12",
109+
"SMillerDev",
110+
],
111+
ops = [
112+
"Bo98",
113+
"Rylan12",
114+
"carlocab",
115+
"fxcoudert",
116+
"nandahkrishna",
117+
"p-linnane",
118+
],
119+
tsc = [
120+
"Bo98",
121+
"MikeMcQuaid",
122+
"Rylan12",
123+
"fxcoudert",
124+
"iMichka",
125+
],
126+
},
127+
taps = {
128+
bundle = [
129+
"EricFromCanada",
130+
"jacobbednarz",
131+
"MikeMcQuaid",
132+
],
133+
linux-fonts = [
134+
"tani",
135+
],
136+
pip = [
137+
"alex",
138+
"woodruffw",
139+
],
140+
services = [
141+
"SMillerDev",
142+
],
143+
},
144+
}
145+
146+
github_admins = [ "issyl0", "p-linnane", "Bo98", "MikeMcQuaid" ]

‎LICENSE.txt

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
BSD 2-Clause License
2+
3+
Copyright (c) 2009-present, Homebrew contributors
4+
All rights reserved.
5+
6+
Redistribution and use in source and binary forms, with or without
7+
modification, are permitted provided that the following conditions are met:
8+
9+
* Redistributions of source code must retain the above copyright notice, this
10+
list of conditions and the following disclaimer.
11+
12+
* Redistributions in binary form must reproduce the above copyright notice,
13+
this list of conditions and the following disclaimer in the documentation
14+
and/or other materials provided with the distribution.
15+
16+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
17+
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18+
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
19+
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
20+
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21+
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
22+
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
23+
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24+
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
25+
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

‎README.md

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# terraform-user-management
2+
3+
User management for the Homebrew organisation using Terraform
4+
5+
## Requirements
6+
7+
- This project uses OpenTofu, not Terraform
8+
9+
## Usage
10+
11+
- Set `GITHUB_TOKEN` to a token with sufficient permissions before usage.
12+
- Use `aws configure sso` to log into the Homebrew AWS org.
13+
- Set `AWS_PROFILE` to the resulting profile.
14+
- `tofu init`
15+
- `tofu plan -var-file .tfvars`
16+
17+
## TODO
18+
19+
- Google workspace management for brew.sh
20+
- Google Cloud manangement for self-hosted workers

‎github/main_groups.tf

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
data "github_team" "main_teams" {
2+
for_each = toset([for team in keys(var.teams) : team if contains(["bots", "taps"], team) == false])
3+
slug = each.key
4+
}

0 commit comments

Comments
 (0)