terraform-checks.yml

name: "Terraform Checks"

on:
  push:
    branches:
      - develop
    paths:
      - infra/**

  pull_request:
    branches:
      - develop
    paths:
      - infra/**

jobs:

  terraform-CI-check-production:
    name: "Formatting and validation Checks for Production"
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: infra/prod-aws
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          cli_config_credentials_token: ${{ secrets.TF_CLOUD_TOKEN }}

      - name: Check code formating
        id: fmt
        run: terraform fmt -check

      - name: Initialise modules
        id: init
        run: terraform init

      - name: Validate template
        id: validate
        run: terraform validate -no-color

  terrascan-production:
    name: "Terrascan Production Checks"
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: infra/prod-aws
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Run Terrascan on production
        id: terrascan
        uses: tenable/terrascan-action@main
        with:
          iac_type: "terraform"
          iac_dir: "./infra/prod-aws"
          iac_version: "v15"
          policy_type: "all"

  checkov-production:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    name: "Checkov Production Checks"
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Checkov GitHub Action
        uses: bridgecrewio/checkov-action@v12
        with:
          directory: infra/prod-aws/
          output_format: cli,sarif
          output_file_path: console,results.sarif

      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v3

        # Results are generated only on a success or failure
        # this is required since GitHub by default won't run the next step
        # when the previous one has failed. Security checks that do not pass will 'fail'.
        # An alternative is to add `continue-on-error: true` to the previous step
        # Or 'soft_fail: true' to checkov.
        if: success() || failure()
        with:
          sarif_file: results.sarif