-
Notifications
You must be signed in to change notification settings - Fork 0
95 lines (91 loc) · 3.03 KB
/
ci-infra.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
name: CI Infra Checks
on:
push:
branches:
- main
paths:
- bin/**
- infra/**
- .github/workflows/**
pull_request:
paths:
- bin/**
- infra/**
- .github/workflows/**
jobs:
lint-github-actions:
# Lint github actions files using https://github.com/rhysd/actionlint
# This job configuration is largely copied from https://github.com/rhysd/actionlint/blob/main/docs/usage.md#use-actionlint-on-github-actions
name: Lint GitHub Actions workflows
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Download actionlint
id: get_actionlint
run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
shell: bash
- name: Check workflow files
run: ${{ steps.get_actionlint.outputs.executable }} -color
shell: bash
lint-scripts:
name: Lint scripts
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Shellcheck
run: make infra-lint-scripts
check-terraform-format:
name: Check Terraform format
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: hashicorp/setup-terraform@v2
with:
terraform_version: 1.8.3
terraform_wrapper: false
- name: Run infra-lint-terraform
run: |
echo "If this fails, run 'make infra-format'"
make infra-lint-terraform
validate-terraform:
name: Validate Terraform modules
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: hashicorp/setup-terraform@v2
with:
terraform_version: 1.8.3
terraform_wrapper: false
- name: Validate
run: make infra-validate-modules
check-compliance-with-checkov:
name: Check compliance with checkov
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
with:
python-version: "3.10"
- name: Run Checkov check
# Pin to specific checkov version rather than running from checkov@master
# since checkov frequently adds new checks that can cause CI checks to fail unpredictably.
# There is currently no way to specify the checkov version to pin to (See https://github.com/bridgecrewio/checkov-action/issues/41)
# so we need to pin the version of the checkov-action, which indirectly pins the checkov version.
# In this case, checkov-action v12.2296.0 is mapped to checkov v2.3.194.
uses: bridgecrewio/[email protected]
with:
directory: infra
framework: terraform
quiet: true # only displays failed checks
check-compliance-with-tfsec:
name: Check compliance with tfsec
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: write
steps:
- uses: actions/checkout@v4
- name: Run tfsec check
uses: aquasecurity/[email protected]
with:
github_token: ${{ github.token }}