-
Notifications
You must be signed in to change notification settings - Fork 8
135 lines (135 loc) · 4.45 KB
/
terraform-checks.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
name: Lint-Format-Scan
on: [push]
jobs:
terraform_fmt:
name: Run terraform fmt
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- uses: hashicorp/setup-terraform@v3
with:
terraform_version: "1.10.4"
- name: Terraform fmt
uses: pre-commit/[email protected]
with:
extra_args: terraform_fmt --all-files
terraform_lint:
name: Run tflint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- uses: hashicorp/setup-terraform@v3
with:
terraform_version: "1.10.4"
- name: Install tflint
uses: nick-fields/[email protected]
with:
timeout_seconds: 30
max_attempts: 5
retry_on: error
command: >-
curl -s https://raw.githubusercontent.com/terraform-linters/tflint/master/install_linux.sh | bash
- uses: pre-commit/[email protected]
with:
extra_args: terraform_tflint --all-files
terraform_trivy:
name: Run trivy
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- name: Install trivy
uses: nick-fields/[email protected]
with:
timeout_seconds: 60
max_attempts: 5
retry_wait_seconds: 20
retry_on: error
command: |
apt-get install wget apt-transport-https gnupg lsb-release
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
echo deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main | sudo tee -a /etc/apt/sources.list.d/trivy.list
sudo apt-get update
sudo apt-get install trivy
trivy version
- uses: pre-commit/[email protected]
with:
extra_args: terraform_trivy --all-files
terraform_validate:
name: Run terraform validate
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- uses: hashicorp/setup-terraform@v3
with:
terraform_version: "1.10.4"
- name: Generate pvt key
run: >-
ssh-keygen -q -P '' -t rsa -b 4096 -m PEM -f tests/domino.pem
- name: Terraform validate
uses: pre-commit/[email protected]
with:
extra_args: terraform_validate --all-files
terraform_providers_lock:
name: Run terraform providers_lock
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- name: Generate pvt key
run: ssh-keygen -q -P '' -t rsa -b 4096 -m PEM -f tests/domino.pem
- name: Terraform providers_lock
uses: pre-commit/[email protected]
with:
extra_args: terraform_providers_lock --all-files
terraform_docs:
name: Run terraform docs
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- name: Install terraform docs
uses: nick-fields/[email protected]
with:
timeout_seconds: 60
max_attempts: 5
retry_wait_seconds: 20
retry_on: error
command: >-
curl -L https://github.com/terraform-docs/terraform-docs/releases/download/v0.19.0/terraform-docs-v0.19.0-$(uname)-amd64.tar.gz | tar -C /tmp -xzf - && chmod +x /tmp/terraform-docs && sudo mv /tmp/terraform-docs /usr/local/bin
- name: Terraform docs
uses: pre-commit/[email protected]
with:
extra_args: terraform_docs --all-files
checkov:
name: Run checkov scan
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- uses: actions/setup-python@v5
- name: Install checkov
run: pip3 install checkov
- name: Run Checkov scan
uses: pre-commit/[email protected]
with:
extra_args: terraform_checkov --all-files
check_aws_partition:
name: Check for hardcoded aws partition
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- name: Check for hardcoded aws partition
uses: pre-commit/[email protected]
with:
extra_args: check_aws_partition --all-files
test-examples:
runs-on: ubuntu-latest
steps:
- name: Test-Examples-Plan
id: examples-plan-test-workflow
uses: CircleCI-Public/[email protected]
env:
CCI_TOKEN: ${{ secrets.CIRCLE_PERSONAL_TOKEN }}
validate-iam-bootstrap:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- name: Validate IAM bootstrap
run: bin/pre-commit/validate-iam-bootstrap.py