-
Notifications
You must be signed in to change notification settings - Fork 13
103 lines (95 loc) · 2.96 KB
/
ci-infra.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
name: CI Infra Checks
on:
push:
branches:
- main
paths:
- infra/**
- .github/workflows/ci-infra.yml
pull_request:
paths:
- infra/**
- test/**
- .github/workflows/ci-infra.yml
jobs:
check-terraform-format:
name: Check Terraform format
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: hashicorp/setup-terraform@v2
with:
terraform_version: 1.4.6
terraform_wrapper: false
- name: Run infra-lint
run: |
echo "If this fails, run 'make infra-format'"
make infra-lint
validate-terraform:
name: Validate Terraform modules
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: hashicorp/setup-terraform@v2
with:
terraform_version: 1.4.6
terraform_wrapper: false
- name: Run infra-validate
run: make infra-validate
check-compliance-with-checkov:
name: Check compliance with checkov
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/setup-python@v4
with:
python-version: "3.10"
- name: Run Checkov check
# Pin to specific checkov version rather than running from checkov@master
# since checkov frequently adds new checks that can cause CI checks to fail unpredictably.
# There is currently no way to specify the checkov version to pin to (See https://github.com/bridgecrewio/checkov-action/issues/41)
# so we need to pin the version of the checkov-action, which indirectly pins the checkov version.
# In this case, checkov-action v12.2296.0 is mapped to checkov v2.3.194.
uses: bridgecrewio/[email protected]
with:
directory: infra
framework: terraform
quiet: true # only displays failed checks
check-compliance-with-tfsec:
name: Check compliance with tfsec
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: write
steps:
- uses: actions/checkout@v3
- name: Run tfsec check
uses: aquasecurity/[email protected]
with:
github_token: ${{ github.token }}
# !! Uncomment to trigger automated infra tests once dev environment is set up
# infra-test-e2e:
# name: End-to-end tests
# runs-on: ubuntu-latest
#
# permissions:
# contents: read
# id-token: write
#
# steps:
# - uses: actions/checkout@v3
# - uses: hashicorp/setup-terraform@v2
# with:
# terraform_version: 1.2.1
# terraform_wrapper: false
# - uses: actions/setup-go@v3
# with:
# go-version: ">=1.19.0"
# - name: Configure AWS credentials
# uses: ./.github/actions/configure-aws-credentials
# with:
# app_name: app
# # Run infra CI on dev environment
# environment: dev
# - name: Run Terratest
# run: make infra-test