diff --git a/.github/actions/templates/avm-validateModulePSRule/action.yml b/.github/actions/templates/avm-validateModulePSRule/action.yml index ad44068a7e..6cc60d4b67 100644 --- a/.github/actions/templates/avm-validateModulePSRule/action.yml +++ b/.github/actions/templates/avm-validateModulePSRule/action.yml @@ -37,6 +37,10 @@ inputs: psrulePath: description: "The path to PSRule configurations" required: false + psruleBaseline: + description: "The PSRule baseline to be used" + required: true + default: "Azure.Default" runs: using: "composite" @@ -109,11 +113,27 @@ runs: # [PSRule validation] task(s) #----------------------------- - - name: Run PSRule analysis + - name: Run PSRule analysis - All Pillars (Azure.Default) + uses: microsoft/ps-rule@v2.9.0 + if: ${{ inputs.psruleBaseline == 'Azure.Default' }} + continue-on-error: true + with: + modules: "PSRule.Rules.Azure" + baseline: "${{ inputs.psruleBaseline }}" + inputPath: "${{ inputs.templateFilePath}}" + outputFormat: Csv + outputPath: "${{ inputs.templateFilePath}}-PSRule-output.csv" + option: "${{ github.workspace }}/${{ inputs.psrulePath}}/ps-rule.yaml" # Path to PSRule configuration options file + source: "${{ inputs.psrulePath}}/.ps-rule/" # Path to folder containing suppression rules to use for analysis. + summary: false # Disabling as taken care in customized task + + - name: Run PSRule analysis - Reliability Pillar Only (Azure.Pillar.Reliability) uses: microsoft/ps-rule@v2.9.0 - continue-on-error: true # Setting this whilst PSRule gets bedded in, in this project + if: ${{ inputs.psruleBaseline == 'Azure.Pillar.Reliability' }} with: modules: "PSRule.Rules.Azure" + prerelease: true + baseline: "${{ inputs.psruleBaseline }}" inputPath: "${{ inputs.templateFilePath}}" outputFormat: Csv outputPath: "${{ inputs.templateFilePath}}-PSRule-output.csv" diff --git a/.github/workflows/avm.template.module.yml b/.github/workflows/avm.template.module.yml index 48fe6ab9f6..a87e0c1596 100644 --- a/.github/workflows/avm.template.module.yml +++ b/.github/workflows/avm.template.module.yml @@ -69,6 +69,29 @@ jobs: subscriptionId: "${{ secrets.ARM_SUBSCRIPTION_ID }}" managementGroupId: "${{ secrets.ARM_MGMTGROUP_ID }}" psrulePath: "avm/utilities/pipelines/staticValidation/psrule" #'${{ github.workspace }}/avm' + psruleBaseline: "Azure.Default" + + job_psrule_test_waf_reliability: # Note: Please don't change this job name. It is used by the setEnvironment action to define which PS modules to install on runners. + name: "PSRule - WAF Reliability [${{ matrix.testCases.name }}]" + runs-on: ubuntu-latest + if: (fromJson(inputs.workflowInput)).staticValidation == 'true' + strategy: + fail-fast: false + matrix: + testCases: ${{ fromJson(inputs.psRuleModuleTestFilePaths) }} + steps: + - name: Checkout + uses: actions/checkout@v4 + - name: Set environment + uses: ./.github/actions/templates/avm-setEnvironment + - name: "Run PSRule validation with [${{ matrix.testCases.path }}]" + uses: ./.github/actions/templates/avm-validateModulePSRule + with: + templateFilePath: "${{ inputs.modulePath }}/${{ matrix.testCases.path }}" + subscriptionId: "${{ secrets.ARM_SUBSCRIPTION_ID }}" + managementGroupId: "${{ secrets.ARM_MGMTGROUP_ID }}" + psrulePath: "avm/utilities/pipelines/staticValidation/psrule" #'${{ github.workspace }}/avm' + psruleBaseline: "Azure.Pillar.Reliability" ############################# # Deployment validation # @@ -78,9 +101,10 @@ jobs: runs-on: ubuntu-latest if: | !cancelled() && - (fromJson(inputs.workflowInput)).deploymentValidation == 'true' && needs.job_module_static_validation.result != 'failure' + (fromJson(inputs.workflowInput)).deploymentValidation == 'true' && needs.job_module_static_validation.result != 'failure' && needs.job_psrule_test_waf_reliability != 'failure' needs: - job_module_static_validation + - job_psrule_test_waf_reliability strategy: fail-fast: false matrix: diff --git a/avm/utilities/pipelines/staticValidation/psrule/ps-rule.yaml b/avm/utilities/pipelines/staticValidation/psrule/ps-rule.yaml index a0664f4949..d6ced73afb 100644 --- a/avm/utilities/pipelines/staticValidation/psrule/ps-rule.yaml +++ b/avm/utilities/pipelines/staticValidation/psrule/ps-rule.yaml @@ -16,7 +16,7 @@ binding: # Require minimum versions of modules. requires: PSRule: "@pre >=2.9.0" - PSRule.Rules.Azure: ">=1.29.0" + PSRule.Rules.Azure: "@pre >=1.29.0" # Use PSRule for Azure. include: @@ -68,7 +68,7 @@ configuration: "tokenname", "ssoClientSecretKeyVaultPath", "ssoSecretType", - "tokenValidityLength" + "tokenValidityLength", ] rule: