cdk-nag.yml

name: CDK Nag

on:
  workflow_dispatch:
  push:
    paths:
    - "deploy/**"
    branches:
    - main
  pull_request:
    paths:
    - "deploy/**"
    branches:
    - main
    - v2m*

permissions:
  contents: read

jobs:
  cdk-nag:
    strategy:
      matrix:
        python-version: [3.9]
    env:
      CDK_DEFAULT_REGION: eu-west-1
      CDK_DEFAULT_ACCOUNT: 111111111111
      GITHUB_ACTIONS: true
    runs-on: ubuntu-latest
    steps:
      - name: Git clone
        uses: actions/checkout@v4
      - name: Set up Node.js
        uses: actions/setup-node@v3
      - name: Install CDK 
        run: |
          npm install -g aws-cdk cdk-nag
          cdk --version
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python-version }}
      - name: Upgrade Pip
        run: python -m pip install --upgrade pip
      - name: Install Requirements
        run: python -m pip install -r deploy/requirements.txt
      - name: CDK Synth
        run: |
          npx cdk synth