From 44471d802c96cd55c5439cc3d62dcae9f6ca5131 Mon Sep 17 00:00:00 2001 From: Jeffrey Aven Date: Tue, 13 Oct 2026 16:01:02 +1100 Subject: [PATCH 1/2] doc updates --- CONTRIBUTING.md | 69 +++++++++++++++++++++++++++++++++++++++++++++++++ LICENSE | 2 +- README.md | 20 ++++++++++++-- SECURITY.md | 12 +++++++++ 4 files changed, 100 insertions(+), 3 deletions(-) create mode 100644 CONTRIBUTING.md create mode 100644 SECURITY.md diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..10999a6 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,69 @@ +# Contributing + +Read [README.md](./README.md) for usage and supported platforms. This repository +contains a Bash composite GitHub Action that installs and runs the prebuilt +`stackql-deploy` CLI. + +## Repository layout + +- [action.yml](./action.yml): inputs, outputs, installation, and command execution. +- [tests/test_install.py](./tests/test_install.py): installer regression tests. +- [.github/workflows](./.github/workflows): installation and AWS integration checks. +- [examples/aws-ssm-parameter](./examples/aws-ssm-parameter): the AWS integration stack. +- [docs/OUTPUTS.md](./docs/OUTPUTS.md): deployment output examples. + +## Local setup and tests + +Use Python 3.12, matching CI, with virtual environment support. Run the commands +below in Bash on Linux, macOS, or WSL from the repository root. The tests require +`bash`, `tar`, `unzip`, `chmod`, and `file` on the shell's `PATH`. + +```bash +python3 -m venv .venv +source .venv/bin/activate +python -m pip install PyYAML==6.0.3 +python -m unittest discover -s tests -v +``` + +The tests execute the installation script from `action.yml` with mocked downloads +and platform detection. They cover architecture selection, existing installations, +unsupported platforms, and failure handling. They need no cloud credentials or +real `stackql-deploy` binary. + +## CI checks + +[Install Test](./.github/workflows/install-test.yml) runs the Python tests and +checks real binary installation, architecture, and reuse on Linux, macOS, and +Windows for x86_64 and ARM64. It runs on pull requests and pushes to `main`, and +can also be started manually. It needs no cloud credentials. + +[AWS SSM integration tests](./.github/workflows/stackql-deploy-actions-test.yml) +deploy, test, update, and tear down an SSM parameter across the same platforms. +They also check multiline `env_vars` on Ubuntu. These tests create real AWS +resources and require: + +- Repository secrets `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`, plus + `AWS_SESSION_TOKEN` when using temporary credentials. +- Repository variable `AWS_REGION`. +- AWS permissions to deploy, read, update, and delete the example stack's resources. + +GitHub does not pass repository secrets to workflows triggered by +[pull requests from forks](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#workflows-in-forked-repositories). +These contributions need a maintainer to arrange credentialed integration testing. + +## Pull requests + +- Create a branch for one coherent change and open the pull request against `main`. +- Explain the problem, the resulting behavior, and which checks you ran. +- Add or update tests for functional changes, including affected platforms. +- Update usage and output documentation when changing action inputs or outputs. +- Keep credentials, virtual environments, downloaded binaries, and generated + deployment outputs out of commits. + +## Issues and security + +For bugs, include the action version, runner OS and architecture, a minimal +workflow, and relevant logs with secrets removed. Use the repository's issue +templates for bugs, feature requests, and questions. + +Report suspected vulnerabilities privately as described in [SECURITY.md](./SECURITY.md). diff --git a/LICENSE b/LICENSE index c8f47a9..aa75be6 100644 --- a/LICENSE +++ b/LICENSE @@ -1,6 +1,6 @@ MIT License -Copyright (c) 2024 StackQL Studios +Copyright (c) 2026 StackQL Studios Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal diff --git a/README.md b/README.md index f58c080..bf6a4fc 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,21 @@ -[![StackQL Deploy Actions Test](https://github.com/stackql/stackql-deploy-action/actions/workflows/stackql-deploy-actions-test.yml/badge.svg?event=pull_request)](https://github.com/stackql/stackql-deploy-action/actions/workflows/stackql-deploy-actions-test.yml) -[![StackQL](https://stackql.io/img/stackql-logo-bold.png)](https://github.com/stackql/stackql) +[stars]: https://img.shields.io/github/stars/stackql/stackql?style=flat-square "GitHub Stars" +[logo]: https://stackql.io/img/stackql-logo-bold.png "stackql logo" +[stackql]: https://github.com/stackql/stackql +[homepage]: https://stackql.io/ +[downloads]: https://img.shields.io/github/downloads/stackql/stackql/total?label=github%20downloads + +
+ +[![logo]][homepage] + +[![Marketplace](https://img.shields.io/badge/Marketplace-stackql--deploy--action-blue?logo=github)](https://github.com/marketplace/actions/stackql-deploy-action) +[![Release](https://img.shields.io/github/v/release/stackql/stackql-deploy-action)](https://github.com/stackql/stackql-deploy-action/releases) +[![CI](https://github.com/stackql/stackql-deploy-action/actions/workflows/stackql-deploy-actions-test.yml/badge.svg)](https://github.com/stackql/setup-stackql-mcp/actions/workflows/stackql-deploy-actions-test.yml) +[![License](https://img.shields.io/github/license/stackql/stackql-deploy-action)](LICENSE) +![downloads] +[![stars]][stackql] + +
# stackql-deploy Github Action to execute `stackql-deploy` to deploy or test a stack. [`stackql-deploy`](https://github.com/stackql/stackql-deploy) is a declarative, state-file-less IaC framework, based upon [`stackql`](https://github.com/stackql/stackql) queries. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..f27e902 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,12 @@ +# Security policy + +Please report security vulnerabilities privately to StackQL Studios. + +Do not open public issues for suspected vulnerabilities in this repository or in findings produced by this tool. + +Use one of the private reporting channels below: + +- Email: security@stackql.io +- GitHub private vulnerability report for this repository + +When reporting, include reproduction details, affected version, and impact. From 304d8313717b1207dce60fd06402458413df5d06 Mon Sep 17 00:00:00 2001 From: Jeffrey Aven Date: Tue, 13 Oct 2026 16:11:31 +1100 Subject: [PATCH 2/2] ci updates --- .github/workflows/install-test.yml | 18 ++++++++++++++++++ .../workflows/stackql-deploy-actions-test.yml | 9 +++++++++ CONTRIBUTING.md | 5 +++++ 3 files changed, 32 insertions(+) diff --git a/.github/workflows/install-test.yml b/.github/workflows/install-test.yml index 9d9f882..17e6562 100644 --- a/.github/workflows/install-test.yml +++ b/.github/workflows/install-test.yml @@ -3,8 +3,26 @@ name: Install Test on: pull_request: branches: [main] + paths-ignore: + - '**/*.md' + - 'docs/**' + - 'LICENSE*' + - 'NOTICE*' + - '.gitignore' + - '.github/ISSUE_TEMPLATE/**' + - '.github/PULL_REQUEST_TEMPLATE/**' + - '.github/CODEOWNERS' push: branches: [main] + paths-ignore: + - '**/*.md' + - 'docs/**' + - 'LICENSE*' + - 'NOTICE*' + - '.gitignore' + - '.github/ISSUE_TEMPLATE/**' + - '.github/PULL_REQUEST_TEMPLATE/**' + - '.github/CODEOWNERS' workflow_dispatch: permissions: diff --git a/.github/workflows/stackql-deploy-actions-test.yml b/.github/workflows/stackql-deploy-actions-test.yml index a094af3..8cbf54f 100644 --- a/.github/workflows/stackql-deploy-actions-test.yml +++ b/.github/workflows/stackql-deploy-actions-test.yml @@ -4,6 +4,15 @@ on: pull_request: branches: - main + paths-ignore: + - '**/*.md' + - 'docs/**' + - 'LICENSE*' + - 'NOTICE*' + - '.gitignore' + - '.github/ISSUE_TEMPLATE/**' + - '.github/PULL_REQUEST_TEMPLATE/**' + - '.github/CODEOWNERS' workflow_dispatch: # Each job deploys its own SSM parameter: stack_env is part of the parameter name diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 10999a6..44dd9a6 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -32,6 +32,11 @@ real `stackql-deploy` binary. ## CI checks +Automatic CI skips changes limited to Markdown files, `docs/`, `LICENSE*`, +`NOTICE*`, `.gitignore`, issue and pull request templates, or `.github/CODEOWNERS`. +Changes that also touch action code, scripts, tests, examples, or workflows still +run CI. Manual workflow runs remain available. + [Install Test](./.github/workflows/install-test.yml) runs the Python tests and checks real binary installation, architecture, and reuse on Linux, macOS, and Windows for x86_64 and ARM64. It runs on pull requests and pushes to `main`, and