feat: add CI on merge on master (triat#13)

.github/workflows/CI.yml

@@ -6,9 +6,9 @@ on:
 
 jobs:
   shellcheck:
-    name: Shellcheck
+    name: CI
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v2
-    - name: Run ShellCheck
+    - name: ShellCheck
       uses: ludeeus/[email protected]

.github/workflows/MasterCI.yml

@@ -0,0 +1,21 @@
+name: Master CI
+on:
+  push:
+    branches: [ master ]
+
+jobs:
+  CI:
+    name: CI
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+    - name: ShellCheck
+      uses: ludeeus/[email protected]
+    - name: Terraform security scan
+      uses: triat/terraform-security-scan@master
+      with:
+        tfsec_actions_comment: false
+        tfsec_actions_working_dir: "test/"
+        tfsec_exclude: "AWS018,AWS006,AWS004,AWS003,AZU003"
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

README.md

@@ -8,7 +8,7 @@ The action requires the https://github.com/actions/checkout before to download t
 
 * `tfsec_actions_comment` - (Optional) Whether or not to comment on GitHub pull requests. Defaults to `true`.
 * `tfsec_actions_working_dir` - (Optional) Terraform working directory location. Defaults to `'.'`.
-* `tfsec_exclude` - (Optional) Provide checks via , without space to exclude from run. No default
+* `tfsec_exclude` - (Optional) Provide checks via `,` without space to exclude from run. No default
 * `tfsec_version` - (Optional) Specify the version of tfsec to install. Defaults to the latest
 
 ## Outputs

test/main.tf

@@ -0,0 +1,28 @@
+resource "aws_security_group_rule" "my-rule" {
+    type        = "ingress"
+    cidr_blocks = ["0.0.0.0/0"]
+}
+
+resource "aws_alb_listener" "my-valid-alb-listener"{
+    port     = "80"
+    protocol = "HTTPS"
+}
+
+resource "aws_alb_listener" "my-wrong-alb-listener"{
+    port     = "80"
+    protocol = "HTTP"
+}
+
+resource "aws_db_security_group" "my-group" {
+
+}
+
+variable "enableEncryption" {
+	default = false
+}
+
+resource "azurerm_managed_disk" "source" {
+    encryption_settings {
+        enabled = var.enableEncryption
+    }
+}