-
Notifications
You must be signed in to change notification settings - Fork 7
126 lines (126 loc) · 4.17 KB
/
terraform-checks.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
name: Lint-Format-Scan
on: [push]
jobs:
terraform_fmt:
name: Run terraform fmt
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- name: Terraform fmt
uses: pre-commit/[email protected]
with:
extra_args: terraform_fmt --all-files
terraform_lint:
name: Run tflint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- name: Install tflint
uses: nick-fields/[email protected]
with:
timeout_seconds: 30
max_attempts: 5
retry_on: error
command: >-
curl -s https://raw.githubusercontent.com/terraform-linters/tflint/master/install_linux.sh | bash
- uses: pre-commit/[email protected]
with:
extra_args: terraform_tflint --all-files
terraform_trivy:
name: Run trivy
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- name: Install trivy
uses: nick-fields/[email protected]
with:
timeout_seconds: 60
max_attempts: 5
retry_wait_seconds: 20
retry_on: error
command: |
apt-get install wget apt-transport-https gnupg lsb-release
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
echo deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main | sudo tee -a /etc/apt/sources.list.d/trivy.list
sudo apt-get update
sudo apt-get install trivy
trivy version
- uses: pre-commit/[email protected]
with:
extra_args: terraform_trivy --all-files
terraform_validate:
name: Run terraform validate
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- name: Generate pvt key
run: >-
ssh-keygen -q -P '' -t rsa -b 4096 -m PEM -f tests/domino.pem
- name: Terraform validate
uses: pre-commit/[email protected]
with:
extra_args: terraform_validate --all-files
terraform_providers_lock:
name: Run terraform providers_lock
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- name: Generate pvt key
run: ssh-keygen -q -P '' -t rsa -b 4096 -m PEM -f tests/domino.pem
- name: Terraform providers_lock
uses: pre-commit/[email protected]
with:
extra_args: terraform_providers_lock --all-files
terraform_docs:
name: Run terraform docs
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- name: Install terraform docs
uses: nick-fields/[email protected]
with:
timeout_seconds: 60
max_attempts: 5
retry_wait_seconds: 20
retry_on: error
command: >-
curl -L https://github.com/terraform-docs/terraform-docs/releases/download/v0.16.0/terraform-docs-v0.16.0-linux-amd64.tar.gz | tar -C /tmp -xzf - && chmod +x /tmp/terraform-docs && sudo mv /tmp/terraform-docs /usr/local/bin
- name: Terraform docs
uses: pre-commit/[email protected]
with:
extra_args: terraform_docs --all-files
checkov:
name: Run checkov scan
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- uses: actions/setup-python@v5
- name: Install checkov
run: pip3 install checkov
- name: Run Checkov scan
uses: pre-commit/[email protected]
with:
extra_args: terraform_checkov --all-files
check_aws_partition:
name: Check for hardcoded aws partition
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- name: Check for hardcoded aws partition
uses: pre-commit/[email protected]
with:
extra_args: check_aws_partition --all-files
test-examples:
runs-on: ubuntu-latest
steps:
- name: Test-Examples-Plan
id: examples-plan-test-workflow
uses: CircleCI-Public/[email protected]
env:
CCI_TOKEN: ${{ secrets.CIRCLE_PERSONAL_TOKEN }}
validate-iam-bootstrap:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- name: Validate IAM bootstrap
run: bin/pre-commit/validate-iam-bootstrap.py