ci-infra.yml

name: CI Infra Checks

on:
  push:
    branches:
      - main
    paths:
      - bin/**
      - infra/**
      - .github/workflows/**
  pull_request:
    paths:
      - bin/**
      - infra/**
      - .github/workflows/**

jobs:
  lint-github-actions:
    # Lint github actions files using https://github.com/rhysd/actionlint
    # This job configuration is largely copied from https://github.com/rhysd/actionlint/blob/main/docs/usage.md#use-actionlint-on-github-actions
    name: Lint GitHub Actions workflows
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Download actionlint
        id: get_actionlint
        run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
        shell: bash
      - name: Check workflow files
        run: ${{ steps.get_actionlint.outputs.executable }} -color
        shell: bash
  lint-scripts:
    name: Lint scripts
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Shellcheck
        run: make infra-lint-scripts
  check-terraform-format:
    name: Check Terraform format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.9.7
          terraform_wrapper: false
      - name: Run infra-lint-terraform
        run: |
          echo "If this fails, run 'make infra-format'"
          make infra-lint-terraform
  validate-terraform:
    name: Validate Terraform modules
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.9.7
          terraform_wrapper: false
      - name: Validate
        run: make infra-validate-modules
  check-compliance-with-checkov:
    name: Check compliance with checkov
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.10"
      - name: Run Checkov check
        # Pin to specific checkov version rather than running from checkov@master
        # since checkov frequently adds new checks that can cause CI checks to fail unpredictably.
        # There is currently no way to specify the checkov version to pin to (See https://github.com/bridgecrewio/checkov-action/issues/41)
        # so we need to pin the version of the checkov-action, which indirectly pins the checkov version.
        # In this case, checkov-action v12.2875.0 is mapped to checkov v3.2.257.
        uses: bridgecrewio/checkov-action@v12.2875.0
        with:
          directory: infra
          framework: terraform
          quiet: true # only displays failed checks
  check-compliance-with-tfsec:
    name: Check compliance with tfsec
    runs-on: ubuntu-latest

    permissions:
      contents: read
      pull-requests: write

    steps:
      - uses: actions/checkout@v4
      - name: Run tfsec check
        uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
        with:
          github_token: ${{ github.token }}