terraform-tools.yml

name: terraform-tools

on:
  push:
    branches: [ main ]
  pull_request:
  workflow_dispatch:

jobs:
  tflint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4.1.0
      - uses: actions/cache@v3
        with:
          path: ~/.tflint.d/plugins
          key: tflint-${{ hashFiles('.tflint.hcl') }}
      - uses: terraform-linters/setup-tflint@v4
        with:
          tflint_version: v0.44.1
      - run: find . -type f -name "*.tfvars" -delete # remove terraform variable files before linting
      - run: tflint --version
      - run: tflint --init
      - run: tflint -f compact --recursive -c $(realpath .tflint.hcl)
  tfsec:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@v4.1.0
      - uses: aquasecurity/tfsec-sarif-action@v0.1.4
        with:
          tfsec_args: --force-all-dirs --soft-fail -m=CRITICAL --no-module-downloads --exclude-path=terraform/aws-accounts/cloud-platform-ephemeral-test --exclude-path=terraform/aws-accounts/cloud-platform-dsd --exclude-path=terraform/aws-accounts/cloud-platform-aws/vpc/kops --exclude-path=terraform/modules
          sarif_file: tfsec.sarif
      - uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: tfsec.sarif