style(megalinter): address linting errors

Author: TotalDwarf03

concourse/ci.yml

@@ -1,3 +1,7 @@
+---
+# Kics linting thinks that the "password" and "github_access_token" keys are secrets, but they are not.
+# These instances are ignored appropriately.
+
 resource_types:
   - name: key-value
     type: registry-image
@@ -11,13 +15,15 @@ resources:
     source:
       uri: https://github.com/ONS-Innovation/github-repository-archive-script
       username: ((github_access_token))
+      # kics-scan ignore-line
       password: x-oauth-basic # checkov:skip=CKV_SECRET_6:Checkov thinks this is a secret, but it is not
       branch: ((branch))
   - name: github-release
     type: github-release
     source:
       owner: ONS-Innovation
       repository: github-repository-archive-script
+      # kics-scan ignore-line
       access_token: ((github_access_token))
   - name: github-release-tag
     type: key-value
@@ -49,6 +55,7 @@ terraform-task: &terraform-task
       - name: github-release-tag
     params:
       secrets: ((sdp_((env))_repository_archive_script_secrets))
+      # kics-scan ignore-line
       github_access_token: ((github_access_token))
       env: ((env))
       branch: ((branch))
@@ -236,6 +243,7 @@ jobs:
           #       additional_tags: release-tag-output/tag
           - <<: *terraform-task
             params:
+              # kics-scan ignore-line
               github_access_token: ((github_access_token))
               env: dev
               secrets: ((sdp_dev_repository_archive_script_secrets))
@@ -297,6 +305,7 @@ jobs:
             timeout: 10m
           - <<: *terraform-task
             params:
+              # kics-scan ignore-line
               github_access_token: ((github_access_token))
               env: prod
               secrets: ((sdp_dev_repository_archive_script_secrets))

concourse/scripts/assume_role.sh

@@ -7,10 +7,10 @@ set -euo pipefail
 apk add --no-cache aws-cli podman jq iptables
 
 aws sts assume-role --output text \
-	--role-arn "${aws_role_arn}" \
-	--role-session-name concourse-pipeline-run \
-	--query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" |
-	awk -F '\t' '{print $1 > ("AccessKeyId")}{print $2 > ("SecretAccessKey")}{print $3 > ("SessionToken")}'
+    --role-arn "${aws_role_arn}" \
+    --role-session-name concourse-pipeline-run \
+    --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" |
+    awk -F '\t' '{print $1 > ("AccessKeyId")}{print $2 > ("SecretAccessKey")}{print $3 > ("SessionToken")}'
 
 AWS_ACCESS_KEY_ID="$(cat AccessKeyId)"
 AWS_SECRET_ACCESS_KEY="$(cat SecretAccessKey)"

concourse/scripts/set_pipeline.sh

@@ -10,22 +10,22 @@ repo_name="repository-archive-script"
 
 # Always use the current branch
 branch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || {
-	echo "Failed to get branch name"
-	exit 1
+    echo "Failed to get branch name"
+    exit 1
 })
 
 if ! git rev-parse --verify "${branch}" >/dev/null 2>&1; then
-	echo "Branch \"${branch}\" does not exist. Cannot set a pipeline without a valid branch."
-	exit 1
+    echo "Branch \"${branch}\" does not exist. Cannot set a pipeline without a valid branch."
+    exit 1
 fi
 
 # Name the pipeline based on the branch
 if [[ ${branch} == "main" || ${branch} == "master" ]]; then
-	pipeline_name=${repo_name}
+    pipeline_name=${repo_name}
 else
-	# Remove non-alphanumeric characters and take the first 7 characters
-	sanitized_branch=$(echo "${branch}" | tr -cd '[:alnum:]' | cut -c1-7)
-	pipeline_name="${repo_name}"-"${sanitized_branch}"
+    # Remove non-alphanumeric characters and take the first 7 characters
+    sanitized_branch=$(echo "${branch}" | tr -cd '[:alnum:]' | cut -c1-7)
+    pipeline_name="${repo_name}"-"${sanitized_branch}"
 fi
 
 fly -t aws-sdp set-pipeline -c concourse/ci.yml -p "${pipeline_name}" -v branch="${branch}" -v repo_name="${repo_name}" -v env=dev

concourse/scripts/terraform_infra.sh

@@ -25,7 +25,7 @@ export AWS_SECRET_ACCESS_KEY="$aws_secret_access_key"
 git config --global url."https://x-access-token:$github_access_token@github.com/".insteadOf "https://github.com/"
 
 if [ "${env}" != "prod" ]; then
-	env="dev"
+    env="dev"
 fi
 
 echo "${env}"
@@ -37,14 +37,14 @@ terraform init -backend-config=env/"${env}"/backend-"${env}".tfbackend -reconfig
 # The following terraform-apply may need to change if the environment variables change
 
 terraform apply \
-	-var "aws_account_id=$aws_account_id" \
-	-var "aws_access_key_id=$aws_access_key_id" \
-	-var "aws_secret_access_key=$aws_secret_access_key" \
-	-var "env_name=$env_name" \
-	-var "lambda_name=${lambda_name}" \
-	-var "github_app_client_id=$github_app_client_id" \
-	-var "aws_secret_name=$aws_secret_name" \
-	-var "github_org=$github_org" \
-	-var "aws_bucket_name=${aws_bucket_name}" \
-	-var "lambda_version=${tag}" \
-	-auto-approve
+    -var "aws_account_id=$aws_account_id" \
+    -var "aws_access_key_id=$aws_access_key_id" \
+    -var "aws_secret_access_key=$aws_secret_access_key" \
+    -var "env_name=$env_name" \
+    -var "lambda_name=${lambda_name}" \
+    -var "github_app_client_id=$github_app_client_id" \
+    -var "aws_secret_name=$aws_secret_name" \
+    -var "github_org=$github_org" \
+    -var "aws_bucket_name=${aws_bucket_name}" \
+    -var "lambda_version=${tag}" \
+    -auto-approve