tfsec-gcp.yml

# Copyright (C) Nicolas Lamirault <nicolas.lamirault@gmail.com>
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# SPDX-License-Identifier: Apache-2.0

---
name: GCP / Security

# Controls when the action will run. Triggers the workflow on push or pull request
# events but only for the main branch
on: # yamllint disable-line rule:truthy
  # push:
  #   branches:
  #     - main
  #   paths:
  #     - "terraform/gcp/**"
  pull_request:
    branches:
    - main
    paths:
    - "terraform/gcp/**"

jobs:

  gcp_artifact-registry:
    name: gcp-artifact-registry
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/artifact-registry/modules/artifact-registry

    - name: Terraform security scan usage
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/artifact-registry/dev

  gcp_bastion:
    name: gcp-bastion
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/bastion/modules/bastion

    - name: Terraform security scan usage
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/bastion/dev

  gcp_cert-manager:
    name: gcp-cert-manager
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/cert-manager/modules/cert-manager

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/cert-manager/dev

  gcp_cloud-armor:
    name: gcp-cloud-armor
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/cloud-armor/modules/cloud-armor

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/cloud-armor/dev

  gcp_cloud-dns:
    name: gcp-cloud-dns
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/cloud-dns/modules/cloud-dns

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/cloud-dns/dev

  gcp_cloud-nat:
    name: gcp-cloud-nat
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/cloud-nat/modules/cloud-nat

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/cloud-nat/dev

  gcp_external-dns:
    name: gcp-external-dns
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/external-dns/modules/external-dns

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/external-dns/dev

  gcp_external-ips-cloud-nat:
    name: gcp-external-ips-cloud-nat
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/external-ips/cloud-nat/modules/cloud-nat

    - name: Terraform security scan usage
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/external-ips/cloud-nat/dev

  gcp_external-ips-external-lb:
    name: gcp-external-ips-external-lb
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Terraform security scan module
        uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
        with:
          github_token: ${{ github.token }}
          working_dir: terraform/gcp/external-ips/external-lb/modules/external-lb

      - name: Terraform security scan usage
        uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
        with:
          github_token: ${{ github.token }}
          working_dir: terraform/gcp/external-ips/external-lb/dev

  gcp_gh-oidc:
    name: gcp-gh-oidc
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/gh-oidc/terraform

  gcp_gke:
    name: gcp-gke
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/gke/modules/gke

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/gke/dev

  gcp_internal-ips-internal-lb:
    name: gcp-internal-ips-internal-lb
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/internal-ips/internal-lb/modules/internal-lb

    - name: Terraform security scan usage
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/internal-ips/internal-lb/dev

  gcp_observability:
    name: gcp-observability
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/observability/modules/observability

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/observability/dev

  gcp_pubsub:
    name: gcp-pubsub
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/pubsub/modules/pubsub

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/pubsub/dev

  gcp_sops:
    name: gcp-sops
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/sops/terraform

  gcp_terraform-cloud:
    name: gcp-terraform-cloud
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/terraform-cloud/terraform

  gcp_vector:
    name: gcp-vector
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/vector/modules/vector

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/vector/dev

  gcp_velero:
    name: gcp-velero
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/velero/modules/velero

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/velero/dev

  gcp_vpc:
    name: gcp-vpc
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/vpc/modules/vpc

    - name: Terraform security scan module
      uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
      with:
        github_token: ${{ github.token }}
        working_dir: terraform/gcp/vpc/dev