ci: add github workflows and metadata automation

.editorconfig

@@ -0,0 +1,11 @@
+root = true
+
+[*.sh]
+# like -i=4
+indent_style = space
+indent_size = 4
+
+binary_next_line   = true  # like -bn
+switch_case_indent = true  # like -ci
+space_redirects    = true  # like -sr
+keep_padding       = true  # like -kp

.github/labeler.yaml

@@ -0,0 +1,86 @@
+---
+# Area
+area/github:
+  - changed-files:
+      - any-glob-to-any-file: ".github/**/*"
+
+area/pre-commit:
+  - changed-files:
+      - any-glob-to-any-file: ".pre-commit-config.yaml"
+      - any-glob-to-any-file: ".hooks/**/*"
+
+area/license:
+  - changed-files:
+      - any-glob-to-any-file: "LICENSE"
+
+area/readme:
+  - changed-files:
+      - any-glob-to-any-file: "README.md"
+
+area/roles:
+  - changed-files:
+      - any-glob-to-any-file: "ansible/roles/**/*"
+
+area/playbooks:
+  - changed-files:
+      - any-glob-to-any-file: "ansible/playbooks/**/*"
+
+area/taskfiles:
+  - changed-files:
+      - any-glob-to-any-file: "Taskfile.yaml"
+
+area/terraform:
+  - changed-files:
+      - any-glob-to-any-file: "ad/*/providers/terraform/**/*"
+
+area/packer:
+  - changed-files:
+      - any-glob-to-any-file: "packer/**/*"
+
+area/docker:
+  - changed-files:
+      - any-glob-to-any-file: "Dockerfile"
+
+area/docs:
+  - changed-files:
+      - any-glob-to-any-file: "docs/**/*"
+
+area/scripts:
+  - changed-files:
+      - any-glob-to-any-file: "scripts/**/*"
+
+area/extensions:
+  - changed-files:
+      - any-glob-to-any-file: "extensions/**/*"
+
+area/python:
+  - changed-files:
+      - any-glob-to-any-file: "goad/**/*"
+      - any-glob-to-any-file: "goad.py"
+      - any-glob-to-any-file: "pyproject.toml"
+      - any-glob-to-any-file: "poetry.lock"
+
+area/ad-labs:
+  - changed-files:
+      - any-glob-to-any-file: "ad/**/*"
+
+# Lab variants
+lab/GOAD:
+  - changed-files:
+      - any-glob-to-any-file: "ad/GOAD/**/*"
+
+lab/GOAD-Light:
+  - changed-files:
+      - any-glob-to-any-file: "ad/GOAD-Light/**/*"
+
+lab/GOAD-Mini:
+  - changed-files:
+      - any-glob-to-any-file: "ad/GOAD-Mini/**/*"
+
+lab/NHA:
+  - changed-files:
+      - any-glob-to-any-file: "ad/NHA/**/*"
+
+lab/SCCM:
+  - changed-files:
+      - any-glob-to-any-file: "ad/SCCM/**/*"

.github/labels.yaml

@@ -0,0 +1,132 @@
+---
+# Area
+- name: area/github
+  color: "72CCF3" # Light Blue
+  description: >-
+    Changes made to github actions
+
+- name: area/pre-commit
+  color: "BC9BE3" # Lavender
+  description: >-
+    Changes made to pre-commit hooks
+
+- name: area/license
+  color: "F4D1B7" # Peach
+  description: >-
+    Changes made to license file
+
+- name: area/readme
+  color: "84B6EB" # Steel Blue
+  description: >-
+    Changes made to README.md file
+
+- name: area/roles
+  color: "FF6600" # Orange
+  description: >-
+    Changes made to Ansible roles
+
+- name: area/playbooks
+  color: "FF99CC" # Pink
+  description: >-
+    Changes made to playbooks directory
+
+- name: area/taskfiles
+  color: "66CCFF" # Sky Blue
+  description: >-
+    Changes made to taskfiles
+
+- name: area/terraform
+  color: "7B42BC" # Terraform Purple
+  description: >-
+    Changes made to Terraform/provider configs
+
+- name: area/packer
+  color: "02A8EF" # Packer Blue
+  description: >-
+    Changes made to Packer configurations
+
+- name: area/docker
+  color: "2496ED" # Docker Blue
+  description: >-
+    Changes made to Docker configurations
+
+- name: area/docs
+  color: "0075CA" # Documentation Blue
+  description: >-
+    Changes made to documentation
+
+- name: area/scripts
+  color: "A8D08D" # Sage Green
+  description: >-
+    Changes made to utility scripts
+
+- name: area/extensions
+  color: "E0C068" # Amber
+  description: >-
+    Changes made to extensions (ELK, Exchange, Wazuh, etc.)
+
+- name: area/python
+  color: "3776AB" # Python Blue
+  description: >-
+    Changes made to Python application code
+
+- name: area/ad-labs
+  color: "D4A017" # Gold
+  description: >-
+    Changes made to AD lab definitions
+
+# Lab variants
+- name: lab/GOAD
+  color: "C0392B" # Dark Red
+  description: >-
+    Changes made to GOAD lab
+
+- name: lab/GOAD-Light
+  color: "E74C3C" # Light Red
+  description: >-
+    Changes made to GOAD-Light lab
+
+- name: lab/GOAD-Mini
+  color: "F1948A" # Salmon
+  description: >-
+    Changes made to GOAD-Mini lab
+
+- name: lab/NHA
+  color: "8E44AD" # Wisteria
+  description: >-
+    Changes made to NHA lab
+
+- name: lab/SCCM
+  color: "2980B9" # Belize Blue
+  description: >-
+    Changes made to SCCM lab
+
+# Renovate
+- name: renovate/container
+  color: "FFC300" # Golden Yellow
+- name: renovate/github-action
+  color: "FFD700" # Gold
+- name: renovate/github-release
+  color: "FFE4B5" # Moccasin
+
+# Semantic Type
+- name: type/digest
+  color: "FFEC19" # Yellow
+- name: type/patch
+  color: "FF9800" # Dark Orange
+- name: type/minor
+  color: "FF6B6B" # Salmon
+- name: type/major
+  color: "F6412D" # Red Orange
+- name: type/break
+  color: "FF0000" # Bright Red
+
+# Uncategorized
+- name: bug
+  color: "D93F0B" # Dark Red
+- name: do-not-merge
+  color: "B60205" # Blood Red
+- name: docs
+  color: "0075CA" # Documentation Blue
+- name: enhancement
+  color: "A2EEEF" # Light Blue

.github/renovate.json5

@@ -0,0 +1,133 @@
+{
+  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
+  gitAuthor: 'cowdogmoo-renovate-bot <157187596+cowdogmoo-renovate-bot[bot]@users.noreply.github.com>',
+  extends: [
+    'config:recommended',
+    'docker:enableMajor',
+    ':disableRateLimiting',
+    ':dependencyDashboard',
+    ':semanticCommits',
+    ':enablePreCommit',
+    ':automergeDigest',
+    'helpers:pinGitHubActionDigests',
+  ],
+  dependencyDashboardLabels: [
+    'renovate-dashboard',
+  ],
+  dependencyDashboardTitle: 'Renovate Dashboard 🤖',
+  suppressNotifications: [
+    'prIgnoreNotification',
+  ],
+  rebaseWhen: 'conflicted',
+  commitBodyTable: true,
+  labels: [
+    'renovate',
+  ],
+  'pre-commit': {
+    enabled: true,
+  },
+  pip_requirements: {
+    managerFilePatterns: [
+      '/(^|/)requirements\\.txt$/',
+      '/(^|/)\\.hooks/requirements\\.txt$/',
+    ],
+  },
+  packageRules: [
+    {
+      description: 'Auto merge Galaxy dependencies',
+      matchManagers: [
+        'ansible-galaxy',
+      ],
+      automerge: true,
+      automergeType: 'pr',
+      matchUpdateTypes: [
+        'minor',
+        'patch',
+      ],
+    },
+    {
+      description: 'Auto-merge GitHub Actions',
+      matchManagers: [
+        'github-actions',
+      ],
+      automerge: true,
+      automergeType: 'pr',
+      matchUpdateTypes: [
+        'major',
+        'minor',
+        'patch',
+      ],
+    },
+    {
+      description: 'Auto-merge pre-commit hooks',
+      matchManagers: [
+        'pre-commit',
+      ],
+      automerge: true,
+      automergeType: 'pr',
+      matchUpdateTypes: [
+        'minor',
+        'patch',
+      ],
+    },
+    {
+      description: 'Auto-merge pip dependencies',
+      matchManagers: [
+        'pip_requirements',
+      ],
+      automerge: true,
+      automergeType: 'pr',
+      matchUpdateTypes: [
+        'minor',
+        'patch',
+      ],
+    },
+    {
+      description: 'Group Ansible Galaxy dependencies',
+      matchManagers: [
+        'ansible-galaxy',
+      ],
+      groupName: 'ansible-dependencies',
+    },
+  ],
+  customManagers: [
+    {
+      customType: 'regex',
+      description: 'Update Python version in GitHub Actions workflows',
+      managerFilePatterns: [
+        '/^\\.github\\/workflows\\/[^/]+\\.ya?ml$/',
+      ],
+      matchStrings: [
+        'PYTHON_VERSION:\\s*["\']?(?<currentValue>[0-9.]+)["\']?',
+      ],
+      depNameTemplate: 'python',
+      datasourceTemplate: 'python-version',
+    },
+    {
+      customType: 'regex',
+      description: 'Update Go version in GitHub Actions workflows',
+      managerFilePatterns: [
+        '/^\\.github\\/workflows\\/[^/]+\\.ya?ml$/',
+      ],
+      matchStrings: [
+        'GO_VERSION:\\s*["\']?(?<currentValue>[0-9.]+)["\']?',
+      ],
+      depNameTemplate: 'go',
+      datasourceTemplate: 'golang-version',
+    },
+    {
+      customType: 'regex',
+      description: 'Update Task version in GitHub Actions workflows',
+      managerFilePatterns: [
+        '/^\\.github\\/workflows\\/[^/]+\\.ya?ml$/',
+      ],
+      matchStrings: [
+        'TASK_VERSION:\\s*(?<currentValue>[0-9.]+)',
+      ],
+      depNameTemplate: 'task',
+      datasourceTemplate: 'github-releases',
+      packageNameTemplate: 'go-task/task',
+      extractVersionTemplate: '^v(?<version>.+)$',
+    },
+  ],
+}

.github/workflows/meta-labeler.yaml

@@ -0,0 +1,28 @@
+---
+name: "Labeler"
+on:
+  pull_request_target:
+    branches: ["main"]
+    types: ["opened", "synchronize"]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  labeler:
+    name: Labeler
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate Token
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        id: app-token
+        with:
+          app-id: "${{ secrets.BOT_APP_ID }}"
+          private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"
+
+      - name: Labeler
+        uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+        with:
+          configuration-path: .github/labeler.yaml
+          repo-token: "${{ steps.app-token.outputs.token }}"