terraform-tools.yml

name: terraform-tools

on:
  push:
    branches: [ main ]
  pull_request:
  workflow_dispatch:

jobs:
  tfsec:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - run: rm -r modules/ # remove modules from being security checked
      - uses: aquasecurity/tfsec-sarif-action@v0.1.4
        with:
          tfsec_args: --force-all-dirs --soft-fail -m CRITICAL
          sarif_file: tfsec.sarif
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: tfsec.sarif
  tflint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/cache@v3.3.2
        with:
          path: ~/.tflint.d/plugins
          key: tflint-${{ hashFiles('.tflint.hcl') }}
      - uses: terraform-linters/setup-tflint@v4.0.0
        with:
          tflint_version: "v0.49.0"
      - run: tflint --version
      - run: tflint -c $(realpath .tflint.hcl) --init
        env:
          GITHUB_TOKEN: ${{ github.token }} # https://github.com/terraform-linters/tflint/blob/master/docs/user-guide/plugins.md#avoiding-rate-limiting
      - run: rm -r modules/ # remove modules from being linted
      - run: tflint -c $(realpath .tflint.hcl) -f compact --recursive