terraform.yaml

name: Terraform
on:
  push:
    branches:
      - main
    paths-ignore:
      - '**.md'
    tags-ignore:
      - '**'
  workflow_dispatch:

permissions: write-all

concurrency:
  group: terraform
  cancel-in-progress: false

env:
  ARM_USE_OIDC: true
  ARM_USE_AZUREAD: true
  ARM_TENANT_ID: ${{ secrets.azure_tenant_id }}
  ARM_SUBSCRIPTION_ID: ${{ secrets.azure_subscription_id }}
  ARM_CLIENT_ID: ${{ secrets.azure_client_id }}

jobs:
  terraform-workflow:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v2
    - name: Cache Terraform modules
      uses: actions/cache@v3
      id: cache
      with:
        path: ./terraform
        key: ${{ runner.os }}-terraform-${{ hashFiles('terraform/**/*.tf') }}
    - name: Az CLI login
      uses: azure/login@v1
      with:
        client-id: ${{ secrets.azure_client_id }}
        tenant-id: ${{ secrets.azure_tenant_id }}
        subscription-id: ${{ secrets.azure_subscription_id }}
    - name: Terraform Init
      working-directory: ./terraform
      run: terraform init
    - name: Terraform Format
      working-directory: ./terraform
      run: terraform fmt -check
    - name: Terraform Validate
      working-directory: ./terraform
      run: terraform validate
    - name: Setup TFLint
      uses: terraform-linters/setup-tflint@v4.0.0
    - name: Init TFLint
      run: tflint --init
      working-directory: ./terraform
      env:
        # https://github.com/terraform-linters/tflint/blob/master/docs/user-guide/plugins.md#avoiding-rate-limiting
        GITHUB_TOKEN: ${{ github.token }}
    - name: Run TFLint
      working-directory: ./terraform
      run: tflint --module
    - name: Terraform Test
      working-directory: ./terraform
      run: |
        terraform test
    - name: Run Trivy vulnerability scanner in IaC mode
      uses: aquasecurity/trivy-action@master
      with:
        scan-type: 'config'
        scan-ref: './terraform'
        format: sarif
        output: trivy-results.sarif
        exit-code: 1
    - name: Upload Trivy scan results to GitHub Security tab
      uses: github/codeql-action/upload-sarif@v2
      with:
        sarif_file: 'trivy-results.sarif'
    - name: Terraform Plan
      working-directory: ./terraform
      run: |
        terraform plan -out=tfplan -var="location=eastus" -var="name_prefix=test" -var="bastion_admin_password=${{ secrets.BASTION_ADMIN_PASSWORD }}" -var="ssh_public_key=${{ secrets.BASTION_SSH_PUBLIC_KEY }}"
        terraform-bin show -json -no-color tfplan > tfplan.json
        terraform-bin show -no-color tfplan >> $GITHUB_STEP_SUMMARY
    - name: Terraform Apply
      working-directory: ./terraform
      run: terraform apply tfplan