Run tfsec as a GitHub action with configurable output

To add the action, add tfsec.yml into the .github/workflows directory in the root of your Github project.

The contents of tfsec.yml should be;

name: tfsec
on:
  push:
    branches:
      - main
  pull_request:
jobs:
  tfsec:
    name: tfsec
    runs-on: ubuntu-latest

    steps:
      - name: Clone repo
        uses: actions/checkout@master
      - name: tfsec
        uses: aquasecurity/[email protected]

Run tfsec as part of a GitHub Action flow. Optionally prevent the failure of tfsec from breaking the build or pass additional arguments using additional_args.

There are a number of optional inputs that can be used in the with: block.

working_directory - the directory to scan in, defaults to ., ie current working directory

version - the version of tfsec to use, defaults to latest

format - Default format can be overridden to any of the following - [json,csv,checkstyle,junit,sarif]

additional_args - any additional arguments you want to have passed to tfsec

soft_fail - set to true if you dont want the action to break the build

github_token - a GitHub token to be used when calling the GitHub API, which helps in avoiding rate-limiting

tfsec provides an extensive number of arguments which can be passed through as in the example below;

name: tfsec
on:
  push:
    branches:
      - main
  pull_request:
jobs:
  tfsec:
    name: tfsec
    runs-on: ubuntu-latest

    steps:
      - name: Clone repo
        uses: actions/checkout@master
      - name: tfsec
        uses: aquasecurity/[email protected]
        with:
          soft_fail: true

• bash: GPL 3.0 or later
• curl: curl license
• git: GPL 2.0 or later
• jq: MIT

MIT License