static-analysis.yaml

name: static analysis

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main

permissions:
  contents: read
  pull-requests: write

jobs:
  fmt:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        terraform: [ 1.5.6, ~ 1.8 ]
    steps:
      - uses: actions/checkout@v4

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ matrix.terraform }}

      - run: make fmt

  validate:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        terraform: [ 1.5.6, ~ 1.8 ]
    steps:
      - uses: actions/checkout@v4

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ matrix.terraform }}

      - run: make validate

  tflint:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        terraform: [ 1.5.6, ~ 1.8 ]
    steps:
      - uses: actions/checkout@v4

      - uses: actions/cache@v4
        with:
          path: ~/.tflint.d/plugins
          key: ${{ matrix.os }}-tflint-${{ hashFiles('.tflint.hcl') }}

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ matrix.terraform }}

      - uses: terraform-linters/setup-tflint@v4
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}

      - run: make tflint

  trivy:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        terraform: [ 1.5.6, ~ 1.8 ]
    steps:
      - uses: actions/checkout@v4

      - name: config
        run: |
          cat >> ./trivy.yaml << EOF
          # see https://aquasecurity.github.io/trivy/latest/docs/references/configuration/config-file/ for reference
          exit-code: 1
          exit-on-eol: 1
          misconfiguration:
            terraform:
              exclude-downloaded-modules: true
          severity:
            - HIGH
            - CRITICAL
          scan:
            skip-dirs:
              - "**/.terraform/**/*"
          EOF

          cat ./trivy.yaml

      - uses: aquasecurity/trivy-action@0.21.0
        with:
          scan-type: 'config'
          hide-progress: false
          trivy-config: trivy.yaml