Skip to content

Commit d2de8b4

Browse files
yadavprakashyadavprakash
authored
Merge pull request #7 from clouddrove/1.0.1
Add tfsec.yml
2 parents 7acf24c + 2487cd9 commit d2de8b4

File tree

8 files changed

+322
-147
lines changed

8 files changed

+322
-147
lines changed

‎.github/workflows/readme.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
python-version: '3.x'
1919

2020
- name: 'create readme'
21-
uses: 'clouddrove/github-actions@v8.0'
21+
uses: 'clouddrove/github-actions@v9.0.2'
2222
with:
2323
actions_subcommand: 'readme'
2424
github_token: '${{ secrets.GITHUB}}'
@@ -35,7 +35,7 @@ jobs:
3535
continue-on-error: true
3636

3737
- name: 'push readme'
38-
uses: 'clouddrove/github-actions@v8.0'
38+
uses: 'clouddrove/github-actions@v9.0.2'
3939
continue-on-error: true
4040
with:
4141
actions_subcommand: 'push'

‎.github/workflows/terraform.yml

Lines changed: 57 additions & 116 deletions
Original file line numberDiff line numberDiff line change
@@ -1,91 +1,49 @@
1-
name: 'Terraform GitHub Actions'
1+
name: static-checks
2+
23
on:
34
pull_request:
4-
branches:
5-
- master
65

76
jobs:
8-
fmt:
9-
name: 'terraform fmt'
7+
versionExtract:
8+
name: Get min/max versions
109
runs-on: ubuntu-latest
11-
steps:
12-
- name: 'Checkout'
13-
uses: actions/checkout@v2.3.4
14-
15-
- name: 'Terraform Format'
16-
uses: 'clouddrove/github-actions@v8.0'
17-
with:
18-
actions_subcommand: 'fmt'
19-
- name: 'Terraform Format'
20-
uses: 'clouddrove/github-actions@v8.0'
21-
with:
22-
actions_subcommand: 'fmt'
2310

24-
private-hostedzone:
25-
name: 'private-hostedzone'
26-
runs-on: ubuntu-latest
2711
steps:
28-
- name: 'Checkout'
29-
uses: actions/checkout@v2.3.4
12+
- name: Checkout
13+
uses: actions/checkout@v2
3014

31-
- name: 'Configure AWS Credentials'
32-
uses: clouddrove/configure-aws-credentials@v1
33-
with:
34-
aws-access-key-id: ${{ secrets.TEST_AWS_ACCESS_KEY }}
35-
aws-secret-access-key: ${{ secrets.TEST_AWS_ACCESS_SECRET_KEY }}
36-
aws-region: us-east-2
37-
38-
- name: 'Terraform init for private-hostedzone'
39-
uses: 'clouddrove/github-actions@v8.0'
40-
with:
41-
actions_subcommand: 'init'
42-
tf_actions_working_dir: ./_example/private-hostedzone
43-
44-
- name: 'Terraform validate for private-hostedzone'
45-
uses: 'clouddrove/github-actions@v8.0'
46-
with:
47-
actions_subcommand: 'validate'
48-
tf_actions_working_dir: ./_example/private-hostedzone
15+
- name: Terraform min/max versions
16+
id: minMax
17+
uses: clowdhaus/terraform-min-max@main
18+
outputs:
19+
minVersion: ${{ steps.minMax.outputs.minVersion }}
20+
maxVersion: ${{ steps.minMax.outputs.maxVersion }}
4921

50-
- name: 'Terraform plan for private-hostedzone'
51-
uses: 'clouddrove/github-actions@v8.0'
52-
with:
53-
actions_subcommand: 'plan'
54-
tf_actions_working_dir: ./_example/private-hostedzone
5522

56-
public-hostedzone:
57-
name: 'public-hostedzone'
23+
versionEvaluate:
24+
name: Evaluate Terraform versions
5825
runs-on: ubuntu-latest
59-
steps:
60-
- name: 'Checkout'
61-
uses: actions/checkout@v2.3.4
26+
needs: versionExtract
27+
strategy:
28+
fail-fast: false
29+
matrix:
30+
version:
31+
- ${{ needs.versionExtract.outputs.minVersion }}
32+
- ${{ needs.versionExtract.outputs.maxVersion }}
33+
directory:
34+
- _example/private-hostedzone
35+
- _example/public-hostedzone
36+
- _example/vpc-association
6237

63-
- name: 'Configure AWS Credentials'
64-
uses: clouddrove/configure-aws-credentials@v1
65-
with:
66-
aws-access-key-id: ${{ secrets.TEST_AWS_ACCESS_KEY }}
67-
aws-secret-access-key: ${{ secrets.TEST_AWS_ACCESS_SECRET_KEY }}
68-
aws-region: us-east-2
6938

70-
- name: 'Terraform init for public-hostedzone'
71-
uses: 'clouddrove/github-actions@v8.0'
72-
with:
73-
actions_subcommand: 'init'
74-
tf_actions_working_dir: ./_example/public-hostedzone
39+
steps:
40+
- name: Checkout
41+
uses: actions/checkout@v2
7542

76-
- name: 'Terraform validate for public-hostedzone'
77-
uses: 'clouddrove/github-actions@v8.0'
43+
- name: Install Terraform v${{ matrix.version }}
44+
uses: hashicorp/setup-terraform@v1
7845
with:
79-
actions_subcommand: 'validate'
80-
tf_actions_working_dir: ./_example/public-hostedzone
81-
82-
83-
vpc-association:
84-
name: 'vpc-association'
85-
runs-on: ubuntu-latest
86-
steps:
87-
- name: 'Checkout'
88-
uses: actions/checkout@v2.3.4
46+
terraform_version: ${{ matrix.version }}
8947

9048
- name: 'Configure AWS Credentials'
9149
uses: clouddrove/configure-aws-credentials@v1
@@ -94,51 +52,34 @@ jobs:
9452
aws-secret-access-key: ${{ secrets.TEST_AWS_ACCESS_SECRET_KEY }}
9553
aws-region: us-east-2
9654

97-
- name: 'Terraform init for vpc-association'
98-
uses: 'clouddrove/github-actions@v8.0'
99-
with:
100-
actions_subcommand: 'init'
101-
tf_actions_working_dir: ./_example/vpc-association
102-
103-
- name: 'Terraform validate for vpc-association'
104-
uses: 'clouddrove/github-actions@v8.0'
105-
with:
106-
actions_subcommand: 'validate'
107-
tf_actions_working_dir: ./_example/vpc-association
108-
109-
- name: 'Terraform plan for vpc-association'
110-
uses: 'clouddrove/github-actions@v8.0'
55+
- name: Init & validate v${{ matrix.version }}
56+
run: |
57+
cd ${{ matrix.directory }}
58+
terraform init
59+
terraform validate
60+
61+
- name: tflint
62+
uses: reviewdog/action-tflint@master
11163
with:
112-
actions_subcommand: 'plan'
113-
tf_actions_working_dir: ./_example/vpc-association
114-
115-
pre-commit:
116-
name: 'Pre-Commit'
117-
needs:
118-
- fmt
119-
- private-hostedzone
120-
- public-hostedzone
121-
- vpc-association
64+
github_token: ${{ secrets.GITHUB }}
65+
working_directory: ${{ matrix.directory }}
66+
fail_on_error: 'true'
67+
filter_mode: 'nofilter'
68+
flags: '--module'
69+
70+
format:
71+
name: Check code format
12272
runs-on: ubuntu-latest
123-
steps:
124-
- name: 'Checkout'
125-
uses: actions/checkout@v2.3.4
126-
127-
- name: 'Install Tflint'
128-
run: |
129-
curl https://raw.githubusercontent.com/terraform-linters/tflint/master/install_linux.sh | bash
73+
needs: versionExtract
13074

131-
- name: 'Pre-Commit 🔎'
132-
uses: pre-commit/action@v2.0.3
133-
continue-on-error: true
75+
steps:
76+
- name: Checkout
77+
uses: actions/checkout@v2
13478

135-
- name: 'Slack Notification'
136-
uses: clouddrove/action-slack@v2
79+
- name: Install Terraform v${{ needs.versionExtract.outputs.maxVersion }}
80+
uses: hashicorp/setup-terraform@v1
13781
with:
138-
status: ${{ job.status }}
139-
fields: repo,author
140-
author_name: 'CloudDrove'
141-
env:
142-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # required
143-
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_TERRAFORM }} # required
144-
if: always()
82+
terraform_version: ${{ needs.versionExtract.outputs.maxVersion }}
83+
84+
- name: Check Terraform format changes
85+
run: terraform fmt --recursive

‎.github/workflows/tfsec.yml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: tfsec
2+
on:
3+
pull_request:
4+
5+
jobs:
6+
tfsec:
7+
name: tfsec sarif report
8+
runs-on: ubuntu-latest
9+
10+
steps:
11+
- name: Clone repo
12+
uses: actions/checkout@master
13+
14+
- name: tfsec
15+
uses: aquasecurity/tfsec-sarif-action@v0.1.0
16+
with:
17+
sarif_file: tfsec.sarif
18+
working_directory: _example
19+
full_repo_scan: true
20+
21+
- name: Upload SARIF file
22+
uses: github/codeql-action/upload-sarif@v1
23+
with:
24+
# Path to SARIF file relative to the root of the repository
25+
sarif_file: tfsec.sarif
26+

0 commit comments

Comments
 (0)