ci: harden CI workflows with environment-based protection

.github/CODEOWNERS

@@ -0,0 +1,5 @@
+# CODEOWNERS file for falcon-scripts repository
+# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+# Default owners for everything in the repo
+* @CrowdStrike/falcon-scripts-cs-maintainers

.github/workflows/bash_install.yml

@@ -9,150 +9,47 @@ on:
       - 'bash/install/**'
       - '.github/workflows/bash_install.yml'
 
-  pull_request_target:
-    types: [ labeled ]
+  pull_request:
     paths:
       - 'molecule/bash_install/**'
       - 'bash/install/**'
       - '.github/workflows/bash_install.yml'
 
+permissions:
+  contents: read
+
 jobs:
-  molecule:
-    if: |
-      github.event_name == 'push' ||
-      github.event_name == 'schedule' ||
-      (github.event_name == 'pull_request_target' &&
-      github.event.label.name == 'ok-to-test')
-    name: ${{ matrix.molecule.distro }}-${{ matrix.collection_role }}
+  validate:
+    name: Validate
     runs-on: ubuntu-latest
-    env:
-      PY_COLORS: 1
-      ANSIBLE_FORCE_COLOR: 1
-      FALCON_CLIENT_ID: ${{ secrets.FALCON_CLIENT_ID }}
-      FALCON_CLIENT_SECRET: ${{ secrets.FALCON_CLIENT_SECRET }}
-      AWS_REGION: "us-west-1"
-      MOLECULE_VPC_SUBNET_ID: ${{ secrets.MOLECULE_VPC_SUBNET_ID }}
-    permissions:
-      contents: read
-      id-token: write
-    strategy:
-      fail-fast: false
-      matrix:
-        molecule:
-          - distro: ubuntu-20.04
-            image_owner: '099720109477'
-            image_arch: x86_64
-            image_name: ubuntu/images/hvm-ssd/ubuntu-focal-20.04*
-            instance_type: t2.micro
-          - distro: ubuntu-22.04
-            image_owner: '099720109477'
-            image_arch: x86_64
-            image_name: ubuntu/images/hvm-ssd/ubuntu-jammy-22.04*
-            instance_type: t2.micro
-          - distro: amazon-2023
-            image_owner: '137112412989'
-            image_arch: x86_64
-            image_name: al2023-ami-2023*
-            instance_type: t2.micro
-          - distro: amazon-2
-            image_owner: '137112412989'
-            image_arch: x86_64
-            image_name: amzn2-ami-hvm-2.0*gp2
-            instance_type: t2.micro
-          - distro: sles-15-sp5
-            image_owner: '013907871322'
-            image_arch: x86_64
-            image_name: suse-sles-15-sp5-v????????-hvm*
-            instance_type: t2.micro
-          - distro: almalinux-8
-            image_owner: '679593333241'
-            image_arch: x86_64
-            image_name: AlmaLinux OS 8*
-            instance_type: t2.micro
-          - distro: rhel-9
-            image_owner: '309956199498'
-            image_arch: x86_64
-            image_name: RHEL-9.?.?_HVM-*
-            instance_type: t2.micro
-          - distro: rhel-9-arm
-            image_owner: '309956199498'
-            image_arch: arm64
-            image_name: RHEL-9.?.?_HVM-*
-            instance_type: t4g.micro
-        collection_role:
-          - bash_install
-
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
-        if: github.event_name != 'pull_request_target'
-
-      - name: Check out code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{github.event.pull_request.head.sha}}
-        if: github.event_name == 'pull_request_target'
-
-      - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: ${{ secrets.AWS_OIDC_ROLE }}
-          role-session-name: github-actions-molecule-ansible
-          aws-region: ${{ env.AWS_REGION }}
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
-          python-version: '3.11'
-          cache: 'pip'
-          cache-dependency-path: '.github/workflows/bash_install.yml'
+          persist-credentials: false
 
-      - name: Install dependencies
+      - name: Shellcheck
         run: |
-          sudo apt install apt-transport-https ca-certificates curl software-properties-common libssl-dev
-          python -m pip install --upgrade pip
-          pip install molecule "molecule-plugins[ec2]" ansible ansible-core==2.16.7 ansible-lint boto3 botocore
-
-      - name: Run role tests
-        id: molecule-role-test
-        uses: nick-fields/retry@v3
-        env:
-          MOLECULE_INSTANCE_NAME: ${{ matrix.molecule.distro }}-${{ matrix.collection_role }}
-          MOLECULE_IMAGE_OWNER: ${{ matrix.molecule.image_owner }}
-          MOLECULE_IMAGE_ARCH: ${{ matrix.molecule.image_arch }}
-          MOLECULE_IMAGE_NAME: '${{ matrix.molecule.image_name }}'
-          MOLECULE_INSTANCE_TYPE: ${{ matrix.molecule.instance_type }}
-          MOLECULE_REGION: ${{ env.AWS_REGION}}
-        with:
-          timeout_minutes: 30
-          max_attempts: 3
-          retry_on: error
-          command: >-
-            molecule --version &&
-            ansible --version &&
-            molecule --debug test --destroy never -s ${{ matrix.collection_role }}
-        continue-on-error: true
-
-      - name: Ensure instances are destroyed
-        uses: nick-fields/retry@v3
-        env:
-          MOLECULE_INSTANCE_NAME: ${{ matrix.molecule.distro }}-${{ matrix.collection_role }}
-          MOLECULE_IMAGE_OWNER: ${{ matrix.molecule.image_owner }}
-          MOLECULE_IMAGE_ARCH: ${{ matrix.molecule.image_arch }}
-          MOLECULE_IMAGE_NAME: '${{ matrix.molecule.image_name }}'
-          MOLECULE_INSTANCE_TYPE: ${{ matrix.molecule.instance_type }}
-          MOLECULE_REGION: ${{ env.AWS_REGION}}
-        with:
-          timeout_minutes: 10
-          max_attempts: 3
-          retry_on: error
-          command: >-
-            molecule --version &&
-            ansible --version &&
-            molecule --debug destroy -s ${{ matrix.collection_role }}
-
-      - name: Assert molecule tests passed
-        uses: nick-fields/assert-action@v2
-        with:
-          expected: success
-          actual: ${{ steps.molecule-role-test.outcome }}
+          shellcheck --version
+          shellcheck bash/install/falcon-linux-install.sh
+
+  molecule-test:
+    name: Molecule Test
+    needs: validate
+    uses: ./.github/workflows/reusable-molecule-test-linux.yml
+    with:
+      distros: |
+        [
+          {"name": "ubuntu-20.04", "image_owner": "099720109477", "image_arch": "x86_64", "image_name": "ubuntu/images/hvm-ssd/ubuntu-focal-20.04*", "instance_type": "t2.micro"},
+          {"name": "ubuntu-22.04", "image_owner": "099720109477", "image_arch": "x86_64", "image_name": "ubuntu/images/hvm-ssd/ubuntu-jammy-22.04*", "instance_type": "t2.micro"},
+          {"name": "amazon-2023", "image_owner": "137112412989", "image_arch": "x86_64", "image_name": "al2023-ami-2023*", "instance_type": "t2.micro"},
+          {"name": "amazon-2", "image_owner": "137112412989", "image_arch": "x86_64", "image_name": "amzn2-ami-hvm-2.0*gp2", "instance_type": "t2.micro"},
+          {"name": "sles-15-sp5", "image_owner": "013907871322", "image_arch": "x86_64", "image_name": "suse-sles-15-sp5-v????????-hvm*", "instance_type": "t2.micro"},
+          {"name": "almalinux-8", "image_owner": "679593333241", "image_arch": "x86_64", "image_name": "AlmaLinux OS 8*", "instance_type": "t2.micro"},
+          {"name": "rhel-9", "image_owner": "309956199498", "image_arch": "x86_64", "image_name": "RHEL-9.?.?_HVM-*", "instance_type": "t2.micro"},
+          {"name": "rhel-9-arm", "image_owner": "309956199498", "image_arch": "arm64", "image_name": "RHEL-9.?.?_HVM-*", "instance_type": "t4g.micro"}
+        ]
+      collection_role: bash_install
+      pr_sha: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || '' }}
+      pr_repo: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name || '' }}
+    secrets: inherit

.github/workflows/bash_install_decrement.yml

@@ -9,150 +9,47 @@ on:
       - 'bash/install/**'
       - '.github/workflows/bash_install_decrement.yml'
 
-  pull_request_target:
-    types: [ labeled ]
+  pull_request:
     paths:
       - 'molecule/bash_install_decrement/**'
       - 'bash/install/**'
       - '.github/workflows/bash_install_decrement.yml'
 
+permissions:
+  contents: read
+
 jobs:
-  molecule:
-    if: |
-      github.event_name == 'push' ||
-      github.event_name == 'schedule' ||
-      (github.event_name == 'pull_request_target' &&
-      github.event.label.name == 'ok-to-test')
-    name: ${{ matrix.molecule.distro }}-${{ matrix.collection_role }}
+  validate:
+    name: Validate
     runs-on: ubuntu-latest
-    env:
-      PY_COLORS: 1
-      ANSIBLE_FORCE_COLOR: 1
-      FALCON_CLIENT_ID: ${{ secrets.FALCON_CLIENT_ID }}
-      FALCON_CLIENT_SECRET: ${{ secrets.FALCON_CLIENT_SECRET }}
-      AWS_REGION: "us-west-1"
-      MOLECULE_VPC_SUBNET_ID: ${{ secrets.MOLECULE_VPC_SUBNET_ID }}
-    permissions:
-      contents: read
-      id-token: write
-    strategy:
-      fail-fast: false
-      matrix:
-        molecule:
-          - distro: ubuntu-20.04
-            image_owner: '099720109477'
-            image_arch: x86_64
-            image_name: ubuntu/images/hvm-ssd/ubuntu-focal-20.04*
-            instance_type: t2.micro
-          - distro: ubuntu-22.04
-            image_owner: '099720109477'
-            image_arch: x86_64
-            image_name: ubuntu/images/hvm-ssd/ubuntu-jammy-22.04*
-            instance_type: t2.micro
-          - distro: amazon-2023
-            image_owner: '137112412989'
-            image_arch: x86_64
-            image_name: al2023-ami-2023*
-            instance_type: t2.micro
-          - distro: amazon-2
-            image_owner: '137112412989'
-            image_arch: x86_64
-            image_name: amzn2-ami-hvm-2.0*gp2
-            instance_type: t2.micro
-          - distro: sles-15-sp5
-            image_owner: '013907871322'
-            image_arch: x86_64
-            image_name: suse-sles-15-sp5-v????????-hvm*
-            instance_type: t2.micro
-          - distro: almalinux-8
-            image_owner: '679593333241'
-            image_arch: x86_64
-            image_name: AlmaLinux OS 8*
-            instance_type: t2.micro
-          - distro: rhel-9
-            image_owner: '309956199498'
-            image_arch: x86_64
-            image_name: RHEL-9.?.?_HVM-*
-            instance_type: t2.micro
-          - distro: rhel-9-arm
-            image_owner: '309956199498'
-            image_arch: arm64
-            image_name: RHEL-9.?.?_HVM-*
-            instance_type: t4g.micro
-        collection_role:
-          - bash_install_decrement
-
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
-        if: github.event_name != 'pull_request_target'
-
-      - name: Check out code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{github.event.pull_request.head.sha}}
-        if: github.event_name == 'pull_request_target'
-
-      - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: ${{ secrets.AWS_OIDC_ROLE }}
-          role-session-name: github-actions-molecule-ansible
-          aws-region: ${{ env.AWS_REGION }}
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
-          python-version: '3.11'
-          cache: 'pip'
-          cache-dependency-path: '.github/workflows/bash_install_decrement.yml'
+          persist-credentials: false
 
-      - name: Install dependencies
+      - name: Shellcheck
         run: |
-          sudo apt install apt-transport-https ca-certificates curl software-properties-common libssl-dev
-          python -m pip install --upgrade pip
-          pip install molecule "molecule-plugins[ec2]" ansible ansible-core==2.16.7 ansible-lint boto3 botocore
-
-      - name: Run role tests
-        id: molecule-role-test
-        uses: nick-fields/retry@v3
-        env:
-          MOLECULE_INSTANCE_NAME: ${{ matrix.molecule.distro }}-${{ matrix.collection_role }}
-          MOLECULE_IMAGE_OWNER: ${{ matrix.molecule.image_owner }}
-          MOLECULE_IMAGE_ARCH: ${{ matrix.molecule.image_arch }}
-          MOLECULE_IMAGE_NAME: '${{ matrix.molecule.image_name }}'
-          MOLECULE_INSTANCE_TYPE: ${{ matrix.molecule.instance_type }}
-          MOLECULE_REGION: ${{ env.AWS_REGION}}
-        with:
-          timeout_minutes: 30
-          max_attempts: 3
-          retry_on: error
-          command: >-
-            molecule --version &&
-            ansible --version &&
-            molecule --debug test --destroy never -s ${{ matrix.collection_role }}
-        continue-on-error: true
-
-      - name: Ensure instances are destroyed
-        uses: nick-fields/retry@v3
-        env:
-          MOLECULE_INSTANCE_NAME: ${{ matrix.molecule.distro }}-${{ matrix.collection_role }}
-          MOLECULE_IMAGE_OWNER: ${{ matrix.molecule.image_owner }}
-          MOLECULE_IMAGE_ARCH: ${{ matrix.molecule.image_arch }}
-          MOLECULE_IMAGE_NAME: '${{ matrix.molecule.image_name }}'
-          MOLECULE_INSTANCE_TYPE: ${{ matrix.molecule.instance_type }}
-          MOLECULE_REGION: ${{ env.AWS_REGION}}
-        with:
-          timeout_minutes: 10
-          max_attempts: 3
-          retry_on: error
-          command: >-
-            molecule --version &&
-            ansible --version &&
-            molecule --debug destroy -s ${{ matrix.collection_role }}
-
-      - name: Assert molecule tests passed
-        uses: nick-fields/assert-action@v2
-        with:
-          expected: success
-          actual: ${{ steps.molecule-role-test.outcome }}
+          shellcheck --version
+          shellcheck bash/install/falcon-linux-install.sh
+
+  molecule-test:
+    name: Molecule Test
+    needs: validate
+    uses: ./.github/workflows/reusable-molecule-test-linux.yml
+    with:
+      distros: |
+        [
+          {"name": "ubuntu-20.04", "image_owner": "099720109477", "image_arch": "x86_64", "image_name": "ubuntu/images/hvm-ssd/ubuntu-focal-20.04*", "instance_type": "t2.micro"},
+          {"name": "ubuntu-22.04", "image_owner": "099720109477", "image_arch": "x86_64", "image_name": "ubuntu/images/hvm-ssd/ubuntu-jammy-22.04*", "instance_type": "t2.micro"},
+          {"name": "amazon-2023", "image_owner": "137112412989", "image_arch": "x86_64", "image_name": "al2023-ami-2023*", "instance_type": "t2.micro"},
+          {"name": "amazon-2", "image_owner": "137112412989", "image_arch": "x86_64", "image_name": "amzn2-ami-hvm-2.0*gp2", "instance_type": "t2.micro"},
+          {"name": "sles-15-sp5", "image_owner": "013907871322", "image_arch": "x86_64", "image_name": "suse-sles-15-sp5-v????????-hvm*", "instance_type": "t2.micro"},
+          {"name": "almalinux-8", "image_owner": "679593333241", "image_arch": "x86_64", "image_name": "AlmaLinux OS 8*", "instance_type": "t2.micro"},
+          {"name": "rhel-9", "image_owner": "309956199498", "image_arch": "x86_64", "image_name": "RHEL-9.?.?_HVM-*", "instance_type": "t2.micro"},
+          {"name": "rhel-9-arm", "image_owner": "309956199498", "image_arch": "arm64", "image_name": "RHEL-9.?.?_HVM-*", "instance_type": "t4g.micro"}
+        ]
+      collection_role: bash_install_decrement
+      pr_sha: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || '' }}
+      pr_repo: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name || '' }}
+    secrets: inherit