rails_template_18f 0.1.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (99) hide show
  1. checksums.yaml +7 -0
  2. data/.rspec +3 -0
  3. data/.standard.yml +2 -0
  4. data/CHANGELOG.md +6 -0
  5. data/CODE_OF_CONDUCT.md +84 -0
  6. data/Gemfile +10 -0
  7. data/Gemfile.lock +132 -0
  8. data/LICENSE.md +21 -0
  9. data/README.md +140 -0
  10. data/Rakefile +10 -0
  11. data/bin/console +16 -0
  12. data/bin/setup +8 -0
  13. data/lib/generators/rails_template18f/circleci/circleci_generator.rb +116 -0
  14. data/lib/generators/rails_template18f/circleci/templates/Dockerfile.tt +13 -0
  15. data/lib/generators/rails_template18f/circleci/templates/bin/ci-server-start +8 -0
  16. data/lib/generators/rails_template18f/circleci/templates/circleci/config.yml.tt +413 -0
  17. data/lib/generators/rails_template18f/circleci/templates/docker-compose.ci.yml +26 -0
  18. data/lib/generators/rails_template18f/github_actions/github_actions_generator.rb +137 -0
  19. data/lib/generators/rails_template18f/github_actions/templates/github/actions/run-server/action.yml +28 -0
  20. data/lib/generators/rails_template18f/github_actions/templates/github/actions/setup-languages/action.yml.tt +20 -0
  21. data/lib/generators/rails_template18f/github_actions/templates/github/actions/setup-project/action.yml.tt +33 -0
  22. data/lib/generators/rails_template18f/github_actions/templates/github/workflows/brakeman-analysis.yml +44 -0
  23. data/lib/generators/rails_template18f/github_actions/templates/github/workflows/dependency-scans.yml +39 -0
  24. data/lib/generators/rails_template18f/github_actions/templates/github/workflows/deploy-production.yml.tt +53 -0
  25. data/lib/generators/rails_template18f/github_actions/templates/github/workflows/deploy-staging.yml.tt +53 -0
  26. data/lib/generators/rails_template18f/github_actions/templates/github/workflows/owasp-daily-scan.yml.tt +44 -0
  27. data/lib/generators/rails_template18f/github_actions/templates/github/workflows/owasp-scan.yml.tt +47 -0
  28. data/lib/generators/rails_template18f/github_actions/templates/github/workflows/pa11y.yml.tt +65 -0
  29. data/lib/generators/rails_template18f/github_actions/templates/github/workflows/rspec.yml.tt +34 -0
  30. data/lib/generators/rails_template18f/github_actions/templates/github/workflows/terraform-production.yml +79 -0
  31. data/lib/generators/rails_template18f/github_actions/templates/github/workflows/terraform-staging.yml +79 -0
  32. data/lib/rails_template18f/terraform_options.rb +68 -0
  33. data/lib/rails_template18f/version.rb +5 -0
  34. data/lib/rails_template_18f.rb +13 -0
  35. data/rails-template-18f.gemspec +40 -0
  36. data/railsrc +10 -0
  37. data/railsrc-hotwire +8 -0
  38. data/template.rb +506 -0
  39. data/templates/README.md.tt +213 -0
  40. data/templates/app/assets/images/uswds.js +5 -0
  41. data/templates/app/assets/stylesheets/uswds-settings.scss +7 -0
  42. data/templates/app/views/application/_banner_lock_icon.html.erb +19 -0
  43. data/templates/app/views/application/_demo_site_banner.html.erb +3 -0
  44. data/templates/app/views/application/_header.html.erb +26 -0
  45. data/templates/app/views/application/_usa_banner.html.erb +51 -0
  46. data/templates/bin/owasp-scan +49 -0
  47. data/templates/bin/pa11y-scan +10 -0
  48. data/templates/bin/with-server +35 -0
  49. data/templates/browserslistrc +5 -0
  50. data/templates/config/deployment/production.yml +3 -0
  51. data/templates/config/deployment/staging.yml +3 -0
  52. data/templates/config/environments/ci.rb +10 -0
  53. data/templates/config/environments/staging.rb +6 -0
  54. data/templates/config/locales/en.yml.tt +25 -0
  55. data/templates/config/locales/es.yml +19 -0
  56. data/templates/config/locales/fr.yml +22 -0
  57. data/templates/config/locales/zh.yml +16 -0
  58. data/templates/config/newrelic.yml +65 -0
  59. data/templates/doc/adr/0001-record-architecture-decisions.md.tt +21 -0
  60. data/templates/doc/adr/0002-initial-architecture-decisions.md.tt +24 -0
  61. data/templates/doc/adr/0003-security-scans.md.tt +44 -0
  62. data/templates/doc/adr/0004-rails-csp-compliant-script-tag-helpers.md.tt +53 -0
  63. data/templates/doc/compliance/README.md +37 -0
  64. data/templates/doc/compliance/apps/application.boundary.md.tt +80 -0
  65. data/templates/doc/compliance/apps/data.logical.md +21 -0
  66. data/templates/doc/compliance/rendered/apps/.keep +0 -0
  67. data/templates/editorconfig +5 -0
  68. data/templates/env +10 -0
  69. data/templates/githooks/pre-commit.tt +35 -0
  70. data/templates/lib/tasks/cf.rake +9 -0
  71. data/templates/lib/tasks/scanning.rake +63 -0
  72. data/templates/manifest.yml.tt +19 -0
  73. data/templates/pa11yci +9 -0
  74. data/templates/terraform/README.md.tt +148 -0
  75. data/templates/terraform/bootstrap/import.sh +12 -0
  76. data/templates/terraform/bootstrap/main.tf.tt +25 -0
  77. data/templates/terraform/bootstrap/providers.tf +16 -0
  78. data/templates/terraform/bootstrap/run.sh.tt +12 -0
  79. data/templates/terraform/bootstrap/teardown_creds.sh.tt +5 -0
  80. data/templates/terraform/bootstrap/variables.tf +2 -0
  81. data/templates/terraform/create_space_deployer.sh +33 -0
  82. data/templates/terraform/destroy_space_deployer.sh +19 -0
  83. data/templates/terraform/production/main.tf.tt +50 -0
  84. data/templates/terraform/production/providers.tf.tt +17 -0
  85. data/templates/terraform/production/variables.tf +2 -0
  86. data/templates/terraform/shared/database/main.tf.tt +23 -0
  87. data/templates/terraform/shared/database/providers.tf +16 -0
  88. data/templates/terraform/shared/database/variables.tf +42 -0
  89. data/templates/terraform/shared/domain/main.tf.tt +46 -0
  90. data/templates/terraform/shared/domain/providers.tf +16 -0
  91. data/templates/terraform/shared/domain/variables.tf +47 -0
  92. data/templates/terraform/shared/s3/main.tf +27 -0
  93. data/templates/terraform/shared/s3/providers.tf +16 -0
  94. data/templates/terraform/shared/s3/variables.tf +43 -0
  95. data/templates/terraform/staging/main.tf.tt +30 -0
  96. data/templates/terraform/staging/providers.tf.tt +17 -0
  97. data/templates/terraform/staging/variables.tf +2 -0
  98. data/templates/zap.conf +121 -0
  99. metadata +213 -0
checksums.yaml ADDED
@@ -0,0 +1,7 @@
1
+ ---
2
+ SHA256:
3
+ metadata.gz: daa50caac6d934e7a1d6611ac427068601ad836f81fab7b088aed2b47de3724b
4
+ data.tar.gz: 7dd5b479db57b51ce6eadbe53134605a346db5de2e4c490510a59c3ec56f644b
5
+ SHA512:
6
+ metadata.gz: '08bba6304087afcfda8ac54101628312329963338a36ed488768bdfdc2a296a9b54140df951108eaa8cbc563d29cd35a461379e6039d17a4f910a50b60313890'
7
+ data.tar.gz: ad54e4be93ee88883503ed96f6a7ace02f00509d584b02e122b7fb66117a2baf6cd19f444f3f74f26c3209280be0204926e3ab2e8c217a1a59d600572b7f9abe
data/.rspec ADDED
@@ -0,0 +1,3 @@
1
+ --format documentation
2
+ --color
3
+ --require spec_helper
data/.standard.yml ADDED
@@ -0,0 +1,2 @@
1
+ # For available configuration options, see:
2
+ # https://github.com/testdouble/standard
data/CHANGELOG.md ADDED
@@ -0,0 +1,6 @@
1
+ ## [Unreleased]
2
+
3
+ ## [0.1.0] - 2022-02-14
4
+
5
+ - Initial release
6
+ - circleci and github_actions generators for adding CI/CD pipeline to your project
@@ -0,0 +1,84 @@
1
+ # Contributor Covenant Code of Conduct
2
+
3
+ ## Our Pledge
4
+
5
+ We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.
6
+
7
+ We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.
8
+
9
+ ## Our Standards
10
+
11
+ Examples of behavior that contributes to a positive environment for our community include:
12
+
13
+ * Demonstrating empathy and kindness toward other people
14
+ * Being respectful of differing opinions, viewpoints, and experiences
15
+ * Giving and gracefully accepting constructive feedback
16
+ * Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience
17
+ * Focusing on what is best not just for us as individuals, but for the overall community
18
+
19
+ Examples of unacceptable behavior include:
20
+
21
+ * The use of sexualized language or imagery, and sexual attention or
22
+ advances of any kind
23
+ * Trolling, insulting or derogatory comments, and personal or political attacks
24
+ * Public or private harassment
25
+ * Publishing others' private information, such as a physical or email
26
+ address, without their explicit permission
27
+ * Other conduct which could reasonably be considered inappropriate in a
28
+ professional setting
29
+
30
+ ## Enforcement Responsibilities
31
+
32
+ Community leaders are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful.
33
+
34
+ Community leaders have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, and will communicate reasons for moderation decisions when appropriate.
35
+
36
+ ## Scope
37
+
38
+ This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public spaces. Examples of representing our community include using an official e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event.
39
+
40
+ ## Enforcement
41
+
42
+ Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at ryan.ahearn@gsa.gov. All complaints will be reviewed and investigated promptly and fairly.
43
+
44
+ All community leaders are obligated to respect the privacy and security of the reporter of any incident.
45
+
46
+ ## Enforcement Guidelines
47
+
48
+ Community leaders will follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct:
49
+
50
+ ### 1. Correction
51
+
52
+ **Community Impact**: Use of inappropriate language or other behavior deemed unprofessional or unwelcome in the community.
53
+
54
+ **Consequence**: A private, written warning from community leaders, providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. A public apology may be requested.
55
+
56
+ ### 2. Warning
57
+
58
+ **Community Impact**: A violation through a single incident or series of actions.
59
+
60
+ **Consequence**: A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period of time. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban.
61
+
62
+ ### 3. Temporary Ban
63
+
64
+ **Community Impact**: A serious violation of community standards, including sustained inappropriate behavior.
65
+
66
+ **Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period of time. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban.
67
+
68
+ ### 4. Permanent Ban
69
+
70
+ **Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behavior, harassment of an individual, or aggression toward or disparagement of classes of individuals.
71
+
72
+ **Consequence**: A permanent ban from any sort of public interaction within the community.
73
+
74
+ ## Attribution
75
+
76
+ This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 2.0,
77
+ available at https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
78
+
79
+ Community Impact Guidelines were inspired by [Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/diversity).
80
+
81
+ [homepage]: https://www.contributor-covenant.org
82
+
83
+ For answers to common questions about this code of conduct, see the FAQ at
84
+ https://www.contributor-covenant.org/faq. Translations are available at https://www.contributor-covenant.org/translations.
data/Gemfile ADDED
@@ -0,0 +1,10 @@
1
+ # frozen_string_literal: true
2
+
3
+ source "https://rubygems.org"
4
+
5
+ # Specify your gem's dependencies in rails-template-18f.gemspec
6
+ gemspec
7
+
8
+ gem "rake", "~> 13.0"
9
+
10
+ gem "colorize", "~> 0.8"
data/Gemfile.lock ADDED
@@ -0,0 +1,132 @@
1
+ PATH
2
+ remote: .
3
+ specs:
4
+ rails_template_18f (0.1.0)
5
+ activesupport (~> 7.0.0)
6
+ railties (~> 7.0.0)
7
+
8
+ GEM
9
+ remote: https://rubygems.org/
10
+ specs:
11
+ actionpack (7.0.2.2)
12
+ actionview (= 7.0.2.2)
13
+ activesupport (= 7.0.2.2)
14
+ rack (~> 2.0, >= 2.2.0)
15
+ rack-test (>= 0.6.3)
16
+ rails-dom-testing (~> 2.0)
17
+ rails-html-sanitizer (~> 1.0, >= 1.2.0)
18
+ actionview (7.0.2.2)
19
+ activesupport (= 7.0.2.2)
20
+ builder (~> 3.1)
21
+ erubi (~> 1.4)
22
+ rails-dom-testing (~> 2.0)
23
+ rails-html-sanitizer (~> 1.1, >= 1.2.0)
24
+ activesupport (7.0.2.2)
25
+ concurrent-ruby (~> 1.0, >= 1.0.2)
26
+ i18n (>= 1.6, < 2)
27
+ minitest (>= 5.1)
28
+ tzinfo (~> 2.0)
29
+ ammeter (1.1.5)
30
+ activesupport (>= 3.0)
31
+ railties (>= 3.0)
32
+ rspec-rails (>= 2.2)
33
+ ast (2.4.2)
34
+ builder (3.2.4)
35
+ colorize (0.8.1)
36
+ concurrent-ruby (1.1.9)
37
+ crass (1.0.6)
38
+ diff-lcs (1.5.0)
39
+ erubi (1.10.0)
40
+ i18n (1.9.1)
41
+ concurrent-ruby (~> 1.0)
42
+ loofah (2.14.0)
43
+ crass (~> 1.0.2)
44
+ nokogiri (>= 1.5.9)
45
+ method_source (1.0.0)
46
+ minitest (5.15.0)
47
+ nokogiri (1.13.1-x86_64-darwin)
48
+ racc (~> 1.4)
49
+ nokogiri (1.13.1-x86_64-linux)
50
+ racc (~> 1.4)
51
+ parallel (1.21.0)
52
+ parser (3.1.0.0)
53
+ ast (~> 2.4.1)
54
+ racc (1.6.0)
55
+ rack (2.2.3)
56
+ rack-test (1.1.0)
57
+ rack (>= 1.0, < 3)
58
+ rails-dom-testing (2.0.3)
59
+ activesupport (>= 4.2.0)
60
+ nokogiri (>= 1.6)
61
+ rails-html-sanitizer (1.4.2)
62
+ loofah (~> 2.3)
63
+ railties (7.0.2.2)
64
+ actionpack (= 7.0.2.2)
65
+ activesupport (= 7.0.2.2)
66
+ method_source
67
+ rake (>= 12.2)
68
+ thor (~> 1.0)
69
+ zeitwerk (~> 2.5)
70
+ rainbow (3.1.1)
71
+ rake (13.0.6)
72
+ regexp_parser (2.2.0)
73
+ rexml (3.2.5)
74
+ rspec (3.11.0)
75
+ rspec-core (~> 3.11.0)
76
+ rspec-expectations (~> 3.11.0)
77
+ rspec-mocks (~> 3.11.0)
78
+ rspec-core (3.11.0)
79
+ rspec-support (~> 3.11.0)
80
+ rspec-expectations (3.11.0)
81
+ diff-lcs (>= 1.2.0, < 2.0)
82
+ rspec-support (~> 3.11.0)
83
+ rspec-mocks (3.11.0)
84
+ diff-lcs (>= 1.2.0, < 2.0)
85
+ rspec-support (~> 3.11.0)
86
+ rspec-rails (5.1.0)
87
+ actionpack (>= 5.2)
88
+ activesupport (>= 5.2)
89
+ railties (>= 5.2)
90
+ rspec-core (~> 3.10)
91
+ rspec-expectations (~> 3.10)
92
+ rspec-mocks (~> 3.10)
93
+ rspec-support (~> 3.10)
94
+ rspec-support (3.11.0)
95
+ rubocop (1.25.1)
96
+ parallel (~> 1.10)
97
+ parser (>= 3.1.0.0)
98
+ rainbow (>= 2.2.2, < 4.0)
99
+ regexp_parser (>= 1.8, < 3.0)
100
+ rexml
101
+ rubocop-ast (>= 1.15.1, < 2.0)
102
+ ruby-progressbar (~> 1.7)
103
+ unicode-display_width (>= 1.4.0, < 3.0)
104
+ rubocop-ast (1.15.1)
105
+ parser (>= 3.0.1.1)
106
+ rubocop-performance (1.13.2)
107
+ rubocop (>= 1.7.0, < 2.0)
108
+ rubocop-ast (>= 0.4.0)
109
+ ruby-progressbar (1.11.0)
110
+ standard (1.7.1)
111
+ rubocop (= 1.25.1)
112
+ rubocop-performance (= 1.13.2)
113
+ thor (1.2.1)
114
+ tzinfo (2.0.4)
115
+ concurrent-ruby (~> 1.0)
116
+ unicode-display_width (2.1.0)
117
+ zeitwerk (2.5.4)
118
+
119
+ PLATFORMS
120
+ x86_64-darwin-20
121
+ x86_64-linux
122
+
123
+ DEPENDENCIES
124
+ ammeter (~> 1.1)
125
+ colorize (~> 0.8)
126
+ rails_template_18f!
127
+ rake (~> 13.0)
128
+ rspec (~> 3.11)
129
+ standard (~> 1.3)
130
+
131
+ BUNDLED WITH
132
+ 2.2.32
data/LICENSE.md ADDED
@@ -0,0 +1,21 @@
1
+ # License
2
+
3
+ As a work of the [United States government](https://www.usa.gov/), this project is in the public domain within the United States of America.
4
+
5
+ Additionally, we waive copyright and related rights in the work worldwide through the CC0 1.0 Universal public domain dedication.
6
+
7
+ ## CC0 1.0 Universal Summary
8
+
9
+ This is a human-readable summary of the [Legal Code (read the full text)](https://creativecommons.org/publicdomain/zero/1.0/legalcode).
10
+
11
+ ### No Copyright
12
+
13
+ The person who associated a work with this deed has dedicated the work to the public domain by waiving all of their rights to the work worldwide under copyright law, including all related and neighboring rights, to the extent allowed by law.
14
+
15
+ You can copy, modify, distribute, and perform the work, even for commercial purposes, all without asking permission.
16
+
17
+ ### Other Information
18
+
19
+ In no way are the patent or trademark rights of any person affected by CC0, nor are the rights that other persons may have in the work or in how the work is used, such as publicity or privacy rights.
20
+
21
+ Unless expressly stated otherwise, the person who associated a work with this deed makes no warranties about the work, and disclaims liability for all uses of the work, to the fullest extent permitted by applicable law. When using or citing the work, you should not imply endorsement by the author or the affirmer.
data/README.md ADDED
@@ -0,0 +1,140 @@
1
+ 18F-Flavored Rails 7 Project
2
+ ============================
3
+
4
+ This template will create a new Rails 7.0.x project.
5
+
6
+ See the `rails-6` branch for Rails 6.1.x
7
+
8
+ ## Use for new Rails Project
9
+
10
+ 1. Clone this repository to your computer
11
+ 1. Change directory into the clone
12
+ 1. Run `rails new <<PATH_TO_PROJECT>> --rc=<<RC_FILE>>` with the appropriate rc file for your needs. The path should not be a subdirectory of this repository.
13
+
14
+ ### Choosing which RC file to use
15
+
16
+ You should run this template with either `railsrc` or `railsrc-hotwire` depending on your development needs.
17
+
18
+ #### Server Rendered _or_ Single Page Applications
19
+
20
+ `rails new <<PATH_TO_PROJECT>> --rc=railsrc`
21
+
22
+ The base `railsrc` file creates a Rails application that is appropriate for both server-rendered applications,
23
+ as well as a basis for installing a separate Single Page Application (SPA) library such as React.
24
+
25
+ #### A bit more JavaScript needed
26
+
27
+ `rails new <<PATH_TO_PROJECT>> --rc=railsrc-hotwire`
28
+
29
+ The `railsrc-hotwire` file creates a Rails application that includes the [Hotwire](https://hotwired.dev/) JavaScript framework.
30
+
31
+ Hotwire can be used to add [a bit of JavaScript](https://engineering.18f.gov/web-architecture/#:~:text=are%20more%20complex-,If%20your%20use%20case%20requires%20a%20bit%20of%20client%2Dside%20interactivity%2C%20use%20the%20above%20options%20with%20a%20bit%20of%20JavaScript.,-You%20might%20use)
32
+ for more interactivity than server-rendered apps, but less than a full SPA.
33
+
34
+ ### Available Options
35
+
36
+ The following options can be added after `--rc=<<RC_FILE>>` to change how the template behaves.
37
+
38
+ **Important:** You must not pass `--skip-bundle` or `--skip-javascript` to `rails new` or various aspects of the template will be broken
39
+
40
+ #### `--javascript=esbuild`
41
+
42
+ Use [esbuild](https://esbuild.github.io/) instead of [webpack](https://webpack.js.org/) for JavaScript bundling. Note that
43
+ maintaining IE11 support with esbuild may be tricky.
44
+
45
+ #### `--no-skip-FRAMEWORK`
46
+
47
+ Each of the skipped frameworks in `railsrc` can be overridden on the command line. For example: `--no-skip-active-storage` will include support for `ActiveStorage` document uploads
48
+
49
+ ### What `railsrc` does
50
+
51
+ ```
52
+ --skip-active-storage # don't include ActiveStorage for document upload
53
+ --skip-action-text # don't include ActionText libraries for WYSIWYG editing
54
+ --skip-action-cable # don't include ActionCable websocket implementation
55
+ --skip-action-mailbox # don't include inbound email
56
+ --skip-hotwire # don't include Hotwire JS library
57
+ --skip-test # Skip built in test framework. (RSpec included via template.rb)
58
+ --javascript=webpack # Use webpack for JS bundling
59
+ --css=postcss # Use the postcss CSS bundling framework
60
+ --template=template.rb # add additional configuration from template.rb
61
+ --database=postgresql # default to PostgreSQL
62
+ ```
63
+
64
+ ### What `railsrc-hotwire` does
65
+
66
+ `railsrc-hotwire` is identical to `railsrc` except that [Hotwire](https://hotwired.dev/) and [ActionCable](https://guides.rubyonrails.org/action_cable_overview.html) are not skipped.
67
+
68
+ ActionCable is included to enable the [Turbo Streams](https://turbo.hotwired.dev/handbook/streams) functionality of Hotwire.
69
+
70
+
71
+ ### What `template.rb` does
72
+
73
+ 1. Create a better default `README`
74
+ 1. Copy `CONTRIBUTING.md` and `LICENSE.md` from the [18F Open Source Policy repo](https://github.com/18F/open-source-policy/)
75
+ 1. Create a "near-production" `ci` Rails environment, used for running a11y and security scans
76
+ 1. Create a "near-production" `staging` Rails environment, used for cloud.gov staging environment, with a "TEST SITE" warning banner
77
+ 1. Create a `.nvmrc` file for specifying the NodeJS version in use
78
+ 1. Set up `pa11y-ci` for a11y scanning
79
+ 1. Set up `OWASP ZAP` dynamic security scanning
80
+ 1. Include `secure_headers` gem and configure CSP header to get OWASP passing by default
81
+ 1. Install and configure [brakeman](https://rubygems.org/gems/brakeman) for static security scanning
82
+ 1. Install `bundler-audit` and set up `bundle:audit` rake task for Ruby dependency security scans
83
+ 1. Set up `yarn:audit` rake task for JavaScript dependency security scans
84
+ 1. Install [Standard Ruby](https://github.com/testdouble/standard) for Ruby linting
85
+ 1. Install [rspec](https://rubygems.org/gems/rspec-rails) for unit testing
86
+ 1. Install [dotenv](https://rubygems.org/gems/dotenv-rails) for local configuration
87
+ 1. Setup Rails credential diffing
88
+ 1. Create a separate production credentials file.
89
+ 1. Create a `pre-commit` hook that can be used to automatically run ruby linter & terraform format
90
+ 1. Setup USWDS via postcss
91
+ 1. Setup webpack with `.browserslistrc` from USWDS
92
+ 1. Update `app/views/layouts/application.html.erb` to pass the `pa11y-ci` scan and include the USWDS Banner
93
+ 1. Create a `PagesController` and root route
94
+ 1. Create boundary and logical data model compliance diagrams
95
+ 1. Create `manifest.yml` and variable files for cloud.gov deployment
96
+ 1. Optionally run the `rake db:create` and `rake db:migrate` setup steps
97
+ 1. Optionally create Github Actions workflows for testing and cloud.gov deploy
98
+ 1. Optionally create terraform modules supporting staging & production cloud.gov spaces
99
+ 1. Optionally create CircleCI workflows for testing and cloud.gov deploy
100
+ 1. Optionally create [Architecture Decision Records](https://adr.github.io/) for above setup
101
+ 1. Optionally create a New Relic config with FEDRAMP-specific host
102
+ 1. Optionally configure DAP (Digital Analytics Program)
103
+ 1. Optionally add base translation files and routes for Spanish, French, and Simplified Chinese (es.yml, fr.yml, and zh.yml)
104
+ 1. Commit the resulting project with git (unless `--skip-git` is passed)
105
+
106
+ ## Use for an existing Rails project
107
+
108
+ ### Installation
109
+
110
+ Add this line to your application's Gemfile:
111
+
112
+ ```ruby
113
+ gem "rails-template-18f"
114
+ ```
115
+
116
+ And then run:
117
+
118
+ $ bundle install
119
+
120
+ Or install it yourself as:
121
+
122
+ $ gem install rails-template-18f
123
+
124
+ ### Usage
125
+
126
+ Run `rails generate` for a list of commands this gem can run
127
+
128
+ ## Development
129
+
130
+ After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
131
+
132
+ To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and the created tag, and push the `.gem` file to [rubygems.org](https://rubygems.org).
133
+
134
+ ## Contributing
135
+
136
+ Bug reports and pull requests are welcome on GitHub at https://github.com/rahearn/rails-template-18f. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [code of conduct](https://github.com/rahearn/rails-template-18f/blob/main/CODE_OF_CONDUCT.md).
137
+
138
+ ## Code of Conduct
139
+
140
+ Everyone interacting in the 18F Rails Template project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/rahearn/rails-template-18f/blob/main/CODE_OF_CONDUCT.md).
data/Rakefile ADDED
@@ -0,0 +1,10 @@
1
+ # frozen_string_literal: true
2
+
3
+ require "bundler/gem_tasks"
4
+ require "rspec/core/rake_task"
5
+
6
+ RSpec::Core::RakeTask.new(:spec)
7
+
8
+ require "standard/rake"
9
+
10
+ task default: %i[spec standard]
data/bin/console ADDED
@@ -0,0 +1,16 @@
1
+ #!/usr/bin/env ruby
2
+ # frozen_string_literal: true
3
+
4
+ require "bundler/setup"
5
+ require "rails/all"
6
+ require "rails_template_18f"
7
+
8
+ # You can add fixtures and/or initialization code here to make experimenting
9
+ # with your gem easier. You can also use a different console, if you like.
10
+
11
+ # (If you use this, don't forget to add pry to your Gemfile!)
12
+ # require "pry"
13
+ # Pry.start
14
+
15
+ require "irb"
16
+ IRB.start(__FILE__)
data/bin/setup ADDED
@@ -0,0 +1,8 @@
1
+ #!/usr/bin/env bash
2
+ set -euo pipefail
3
+ IFS=$'\n\t'
4
+ set -vx
5
+
6
+ bundle install
7
+
8
+ # Do any other automated setup that you need to do here
@@ -0,0 +1,116 @@
1
+ # frozen_string_literal: true
2
+
3
+ module RailsTemplate18f
4
+ module Generators
5
+ class CircleciGenerator < ::Rails::Generators::Base
6
+ include ::Rails::Generators::AppName
7
+ include RailsTemplate18f::TerraformOptions
8
+
9
+ desc <<~DESC
10
+ Description:
11
+ Install CircleCI pipeline files
12
+ DESC
13
+
14
+ def self.source_root
15
+ @source_root ||= File.expand_path(File.join(File.dirname(__FILE__), "templates"))
16
+ end
17
+
18
+ def install_needed_gems
19
+ gem "rspec_junit_formatter", "~> 0.5", group: :test
20
+ end
21
+
22
+ def install_pipeline
23
+ directory "circleci", ".circleci"
24
+ copy_file "docker-compose.ci.yml"
25
+ template "Dockerfile"
26
+ copy_file "bin/ci-server-start", mode: :preserve
27
+ end
28
+
29
+ def update_readme
30
+ insert_into_file "README.md", readme_cicd, after: "## CI/CD\n"
31
+ insert_into_file "README.md", readme_staging_deploy, after: "#### Staging\n"
32
+ insert_into_file "README.md", readme_prod_deploy, after: "#### Production\n"
33
+ insert_into_file "README.md", readme_credentials, after: "#### Credentials and other Secrets\n"
34
+ end
35
+
36
+ def update_boundary_diagram
37
+ boundary_filename = "doc/compliance/apps/application.boundary.md"
38
+ insert_into_file boundary_filename, <<EOB, after: "Boundary(cicd, \"CI/CD Pipeline\") {\n"
39
+ System_Ext(github, "GitHub", "GSA-controlled code repository")
40
+ System_Ext(circleci, "CircleCI", "Continuous Integration Service")
41
+ EOB
42
+ insert_into_file boundary_filename, <<~EOB, before: "@enduml"
43
+ Rel(developer, github, "Publish code", "git ssh (22)")
44
+ Rel(github, circleci, "Commit hook notifies CircleCI to run CI/CD pipeline", "https POST (443)")
45
+ Rel(circleci, cg_api, "Deploy App", "Auth: SpaceDeployer Service Account, https (443)")
46
+ EOB
47
+ end
48
+
49
+ no_tasks do
50
+ def readme_cicd
51
+ <<~EOM
52
+
53
+ CircleCI is used to run all tests and scans as part of pull requests.
54
+
55
+ Security scans are also run on a daily schedule.
56
+ EOM
57
+ end
58
+
59
+ def readme_staging_deploy
60
+ <<~EOM
61
+
62
+ Deploys to staging#{terraform? ? ", including applying changes in terraform," : ""} happen
63
+ on every push to the `main` branch in Github.
64
+
65
+ The following secrets must be set within [CircleCI Environment Variables](https://circleci.com/docs/2.0/env-vars/)
66
+ to enable a deploy to work:
67
+
68
+ | Secret Name | Description |
69
+ | ----------- | ----------- |
70
+ | `CF_STAGING_USERNAME` | cloud.gov SpaceDeployer username |
71
+ | `CF_STAGING_PASSWORD` | cloud.gov SpaceDeployer password |
72
+ | `RAILS_MASTER_KEY` | `config/master.key` |
73
+ #{terraform_secret_values}
74
+ EOM
75
+ end
76
+
77
+ def readme_prod_deploy
78
+ <<~EOM
79
+
80
+ Deploys to production#{terraform? ? ", including applying changes in terraform," : ""} happen
81
+ on every push to the `production` branch in Github.
82
+
83
+ The following secrets must be set within [CircleCI Environment Variables](https://circleci.com/docs/2.0/env-vars/)
84
+ to enable a deploy to work:
85
+
86
+ | Secret Name | Description |
87
+ | ----------- | ----------- |
88
+ | `CF_PRODUCTION_USERNAME` | cloud.gov SpaceDeployer username |
89
+ | `CF_PRODUCTION_PASSWORD` | cloud.gov SpaceDeployer password |
90
+ | `PRODUCTION_RAILS_MASTER_KEY` | `config/credentials/production.key` |
91
+ #{terraform_secret_values}
92
+ EOM
93
+ end
94
+
95
+ def readme_credentials
96
+ <<~EOM
97
+
98
+ 1. Store variables that must be secret using [CircleCI Environment Variables](https://circleci.com/docs/2.0/env-vars/)
99
+ 1. Add the appropriate `--var` addition to the `cf push` line on the deploy job
100
+ EOM
101
+ end
102
+ end
103
+
104
+ private
105
+
106
+ def terraform_secret_values
107
+ if terraform?
108
+ <<~EOM
109
+ | `AWS_ACCESS_KEY_ID` | Access key for terraform state bucket |
110
+ | `AWS_SECRET_ACCESS_KEY` | Secret key for terraform state bucket |
111
+ EOM
112
+ end
113
+ end
114
+ end
115
+ end
116
+ end
@@ -0,0 +1,13 @@
1
+ FROM cimg/ruby:<%= ruby_version %>-node
2
+
3
+ ENV PORT=3000
4
+ EXPOSE $PORT
5
+
6
+ COPY --chown=circleci . /home/circleci/project
7
+ RUN bundle install --deployment
8
+ RUN yarn install --frozen-lockfile
9
+
10
+ ENV RAILS_ENV=ci
11
+ RUN bundle exec rake assets:precompile
12
+
13
+ CMD ["./bin/ci-server-start"]
@@ -0,0 +1,8 @@
1
+ #!/bin/bash
2
+ #
3
+ # this script is used by docker-compose and Dockerfile to start up a servrer
4
+ # for running OWASP in CircleCI
5
+
6
+ dockerize -wait tcp://db:5432 -timeout 1m
7
+ bundle exec rails db:schema:load --trace
8
+ bundle exec rails server -b 0.0.0.0