Skip to content

Secure Code Analysis #235

Secure Code Analysis

Secure Code Analysis #235

Workflow file for this run

name: Secure Code Analysis
on:
schedule:
- cron: '35 1 * * *'
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
permissions:
contents: read
jobs:
tflint:
runs-on: '${{ matrix.os }}'
permissions:
actions: read
contents: read
security-events: write
strategy:
matrix:
os:
- ubuntu-latest
steps:
- name: Checkout source code
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
with:
token: '${{ secrets.GITHUB_TOKEN }}'
fetch-depth: 0
- name: Cache plugin dir
uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
with:
path: ~/.tflint.d/plugins
key: '${{ matrix.os }}-tflint-${{ hashFiles(''.tflint.hcl'') }}'
- uses: terraform-linters/setup-tflint@19a52fbac37dacb22a09518e4ef6ee234f2d4987 # v4.0.0
name: Setup TFLint
with:
tflint_version: latest
- name: Init TFLint
run: tflint --init
- name: Run TFLint
run: tflint --disable-rule=terraform_unused_declarations --format sarif > tflint.sarif
- name: Upload SARIF file
if: success() || failure()
uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
with:
sarif_file: tflint.sarif
tfsec:
name: tfsec
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
steps:
- name: Clone repo
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
with:
token: '${{ secrets.GITHUB_TOKEN }}'
fetch-depth: 0
- name: Run tfsec
uses: aquasecurity/tfsec-action@b466648d6e39e7c75324f25d83891162a721f2d6 # v1.0.3
with:
additional_args: '--format sarif --out tfsec.sarif --exclude aws-ssm-secret-use-customer-key,github-repositories-private,aws-vpc-no-excessive-port-access,github-repositories-require-signed-commits'
- name: Upload SARIF file
if: success() || failure()
uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
with:
sarif_file: tfsec.sarif
checkov:
name: checkov
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
steps:
- name: Checkout repo
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
with:
token: '${{ secrets.GITHUB_TOKEN }}'
fetch-depth: 0
- name: Run Checkov action
id: checkov
uses: bridgecrewio/checkov-action@f625980aae4c615338bd009704688f84d6f618c9 # v12.2528.0
with:
directory: ./
framework: terraform
output_file_path: ./checkov.sarif
output_format: sarif
skip_check: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
- name: Upload SARIF file
if: success() || failure()
uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
with:
sarif_file: ./checkov.sarif