Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adds Terrascan pre-commit #953

Merged
merged 30 commits into from
Jul 31, 2021
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
30 commits
Select commit Hold shift + click to select a range
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .pre-commit-hooks.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
- id: terraform-pre-commit
name: terrascan
description: Runs terrascan on supported IaC templates.
language: script
entry: scripts/pre-commit-hook.sh
63 changes: 63 additions & 0 deletions docs/integrations/pre-commit-integration.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,63 @@
# Integrating Terrascan with Pre-commit

## Overview
Terrascan scan can be used as a pre-commit hook in order to automatically scan your IaC before every commit.
For more information about pre-commit hooks see https://pre-commit.com/#intro

___

**Requirements**

* Ensure Terrascan is properly installed (See https://runterrascan.io/docs/getting-started/#installing-terrascan)
* Have Pre-commit package manager installed (See https://pre-commit.com/#install)
___
## Integration Method
___
### Add config file
1. Add file called .pre-commit-config.yaml to root of repo you wish to scan with pre-commit. It should look like this:
```yaml
repos:
- repo: https://github.com/accurics/terrascan
rev: <COMMIT/VERSION>
hooks:
- id: terraform-pre-commit
args: [ '-i <IAC PROVIDER>'] #optional
```
**Note:**
The optional args line allows you to specify the IaC provider. For example,
```yaml
repos:
- repo: https://github.com/accurics/terrascan
rev: <COMMIT/VERSION>
hooks:
- id: terraform-pre-commit
args: [ '-i k8s']
```
will cause
```bash
'terrascan scan -i k8s'
```
to run and thus scan kubernetes yaml files. You may exclude the args like so:
```yaml
repos:
- repo: https://github.com/accurics/terrascan
rev: <COMMIT/VERSION>
hooks:
- id: terraform-pre-commit
```
which causes the default
```bash
'terrascan scan'
```
to be run, scanning all IaC provider types.

___

Once you have everything installed, and add the appropriate config file to your repo,
```bash
'terrascan scan -i <IAC PROVIDER>'
```
everytime you attempt to commit your staged changes. You can also call the hook directly on all files using pre-commit run --all-files



Loading