chore: security audit remediations

.ansible-lint

@@ -9,7 +9,6 @@ exclude_paths:
   - 'roles/master_role_example/'
   - 'changelogs/'
   - '*.py'
-parseable: true
 use_default_rules: true
 # https://github.com/ansible/ansible-lint/issues/808
 # with verbosity set to 1, its dumping 'unknown file type messages'

.github/dependabot.yml

@@ -0,0 +1,8 @@
+---
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10

.github/workflows/ci_standalone.yml

@@ -2,8 +2,19 @@
 name: Test roles and modules
 on: [push, pull_request_target]
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
+  approve_run:
+    environment: requires-approval
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "Approval granted. Proceeding to reusable workflow."
+
   ci_standalone:
+    needs: approve_run
     strategy:
       fail-fast: false
       matrix:

.github/workflows/ci_standalone_versioned.yml

@@ -17,23 +17,26 @@
 env:
   EDA_IMAGE: quay.io/ansible/eda-server:sha-${{ inputs.eda_server_version }}  # If we transfer back to branches/tags then this needs updating to match the branch
 
+permissions:
+  contents: read
+
 jobs:
 
   integration:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
         with:
           ref: ${{ inputs.gh_ref }}
 
       - name: "Checkout eda-server"
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
         with:
           repository: ansible/eda-server
           path: eda-server
           ref: ${{ inputs.eda_server_version }}
 
-      - uses: actions/setup-python@v2
+      - uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e # v2
         with:
           python-version: "3.8"
 
@@ -68,7 +71,7 @@
 
       - name: Build and install the collection
         id: build
-        uses: redhat-cop/ansible_collections_tooling/actions/build_ansible_collection@main
+        uses: redhat-cop/ansible_collections_tooling/actions/build_ansible_collection@634342818b5d5fa2fa92b2c68c78a2bbe8aa4f10 # main
         with:
           collection_namespace: infra
           collection_name: eda_configuration

.github/workflows/pre-commit.yml

@@ -10,9 +10,13 @@ on:
   schedule:
     - cron: "0 6 * * *"
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   pre-commit_and_sanity:
-    uses: "redhat-cop/ansible_collections_tooling/.github/workflows/pre_commit_and_sanity.yml@main"
+    uses: "redhat-cop/ansible_collections_tooling/.github/workflows/pre_commit_and_sanity.yml@634342818b5d5fa2fa92b2c68c78a2bbe8aa4f10"
     with:
       collection_namespace: infra
       collection_name: eda_configuration

.github/workflows/release.yml

@@ -8,9 +8,12 @@ on:
     types:
       - published
 
+permissions:
+  contents: write
+
 jobs:
   release:
-    uses: "redhat-cop/ansible_collections_tooling/.github/workflows/release_pipeline_single.yml@main"
+    uses: "redhat-cop/ansible_collections_tooling/.github/workflows/release_pipeline_single.yml@634342818b5d5fa2fa92b2c68c78a2bbe8aa4f10"
     with:
       collection_namespace: infra
       collection_name: eda_configuration

.github/workflows/update_pre_commit.yml

@@ -8,9 +8,13 @@ on:
   schedule:
     - cron: "0 5 * * *"
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   pre-commit:
-    uses: "redhat-cop/ansible_collections_tooling/.github/workflows/update_precommit.yml@main"
+    uses: "redhat-cop/ansible_collections_tooling/.github/workflows/update_precommit.yml@634342818b5d5fa2fa92b2c68c78a2bbe8aa4f10"
     with:
       github_actor: ${{ github.actor }}
     secrets:

.gitignore

@@ -1,3 +1,7 @@
+.env
+*.key
+*.pem
+
 collections/*
 !collections/requirements.yml
 /*.tar.gz

plugins/module_utils/eda_module.py

@@ -8,7 +8,9 @@
     SSLValidationError,
     ConnectionError,
 )
-from ansible.module_utils.six import PY2
+import sys
+
+PY2 = sys.version_info[0] == 2
 from ansible.module_utils.six.moves.urllib.parse import urlparse, urlencode
 from ansible.module_utils.six.moves.urllib.error import HTTPError
 from ansible.module_utils.six.moves.http_cookiejar import CookieJar
@@ -392,15 +394,15 @@ def delete_if_needed(self, existing_item, on_delete=None, auto_exit=True, key="u
         #   2. The response from EDA Controller from calling the delete on the endpont. It's up to you to process the response and exit from the module
         # Note: common error codes from the EDA Controller API can cause the module to fail
         if existing_item:
+            item_type = existing_item.get("type", "unknown")
+            item_name = self.get_item_name(existing_item, allow_unknown=True)
+            item_id = existing_item.get("id")
             if existing_item["type"] == "token":
                 response = self.delete_endpoint(existing_item["endpoint"])
             else:
                 # If we have an item, we can try to delete it
                 try:
                     item_url = existing_item[key]
-                    item_type = existing_item["type"]
-                    item_id = existing_item["id"]
-                    item_name = self.get_item_name(existing_item, allow_unknown=True)
                 except KeyError as ke:
                     self.fail_json(msg="Unable to process delete of item due to missing data {0}".format(ke))
                 response = self.delete_endpoint(item_url)