Merge branch 'main' into wasteful-macaw

Author: max-ostapenko

.github/dependabot.yml

@@ -13,14 +13,20 @@ updates:
       - "/infra/dataform-service"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "terraform"
     directories:
       - "/infra/tf/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7

.github/linters/.flake8

@@ -0,0 +1,2 @@
+[flake8]
+extend-ignore = E501

.github/linters/.sqlfluff

@@ -0,0 +1,24 @@
+[sqlfluff]
+dialect = bigquery
+max_line_length = 200
+
+[sqlfluff:indentation]
+indent_unit = space
+tab_space_size = 2
+indented_using_on = False
+allow_implicit_indents = True
+
+[sqlfluff:layout:type:binary_operator]
+line_position = trailing
+
+[sqlfluff:rules:capitalisation.keywords]
+capitalisation_policy = upper
+
+[sqlfluff:rules:capitalisation.types]
+extended_capitalisation_policy = upper
+
+[sqlfluff:rules:convention.count_rows]
+prefer_count_0 = True
+
+[sqlfluff:rules:convention.quoted_literals]
+preferred_quoted_literal_style = single_quotes

.github/linters/.trivyignore

@@ -0,0 +1,2 @@
+# Ignore the dataplexAdmin role issue
+AVD-GCP-0007

.github/linters/eslint.config.mjs

@@ -0,0 +1,35 @@
+import js from '@eslint/js'
+import globals from 'globals'
+
+export default [
+  {
+    ignores: ['node_modules/**', 'package-lock.json', '*.log', 'dist/**', 'build/**']
+  },
+  js.configs.recommended,
+  {
+    languageOptions: {
+      ecmaVersion: 2022,
+      sourceType: 'module',
+      globals: {
+        ...globals.node,
+
+        // Dataform-specific globals
+        dataform: 'readonly',
+        declare: 'readonly',
+        assert: 'readonly',
+        publish: 'readonly',
+        operate: 'readonly',
+        ctx: 'readonly',
+        constants: 'readonly',
+        reports: 'readonly',
+        reservations: 'readonly'
+      }
+    },
+    rules: {
+      // Basic formatting rules
+      'indent': ['error', 2],
+      'quotes': ['error', 'single'],
+      'semi': ['error', 'never']
+    }
+  }
+]

.github/linters/trivy.yaml

@@ -0,0 +1 @@
+ignorefile: ".github/linters/.trivyignore"

.github/linters/zizmor.yaml

@@ -0,0 +1,4 @@
+rules:
+  unpinned-uses:
+    ignore:
+      - ci.yaml

.github/workflows/ci.yaml

@@ -0,0 +1,64 @@
+---
+name: CI
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  packages: read
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+
+    permissions:
+      statuses: write # To report GitHub Actions status checks
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Lint Code Base
+        uses: super-linter/super-linter/slim@v8.3.0
+        env:
+          DEFAULT_BRANCH: main
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VALIDATE_JSCPD: false
+          VALIDATE_JAVASCRIPT_PRETTIER: false
+          VALIDATE_MARKDOWN_PRETTIER: false
+          VALIDATE_CHECKOV: false
+          VALIDATE_GIT_COMMITLINT: false
+          VALIDATE_BIOME_FORMAT: false
+          VALIDATE_BIOME_LINT: false
+
+  dependabot:
+    name: Dependabot auto-merge
+    runs-on: ubuntu-latest
+    needs: lint
+    if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'HTTPArchive/dataform'
+
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - name: Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v2
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+
+      - name: Enable auto-merge for Dependabot PRs
+        if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}