Trivy and TFLint CI check implementation #68
Conversation
tmikula-dev
requested review from
ABMC831,
Zejnilovic,
oto-macenauer-absa and
petr-pokorny-absa
as code owners
WalkthroughNew GitHub Actions workflow implements static code analysis for Terraform files using Trivy (security scanning) and TFLint (linting), triggered on pull requests and pushes to master. Supporting documentation and configuration files updated to document the new tools and ignore SARIF output artifacts. Changes
Sequence DiagramsequenceDiagram
participant GH as GitHub
participant Workflow as Workflow
participant Trivy
participant TFLint
participant CodeQL
GH->>Workflow: Trigger (PR/Push/Dispatch)
Workflow->>Workflow: Checkout Code
par Parallel Execution
Workflow->>Trivy: Run Config Scan
Trivy->>Trivy: Scan terraform/
Trivy-->>Workflow: Generate SARIF Report
Workflow->>CodeQL: Upload Trivy SARIF
Workflow->>Workflow: Check Exit Code
and
Workflow->>TFLint: Initialize & Lint
TFLint->>TFLint: Lint terraform/
TFLint-->>Workflow: Generate SARIF Report
Workflow->>CodeQL: Upload TFLint SARIF
Workflow->>Workflow: Check Findings
end
Workflow->>Workflow: Enforce Failure on Issues
Workflow-->>GH: Workflow Complete
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes The changes represent a cohesive feature addition with consistent patterns: a straightforward GitHub Actions workflow configuration, minimal configuration updates, and uniform documentation additions. The workflow logic is clear and follows standard practices for tool integration and SARIF reporting. Poem
Pre-merge checks and finishing touches✅ Passed checks (5 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
tmikula-dev
added
the
work in progress
|
✅ UTG Post-Process Complete No new issues were detected in the generated code and all check runs have completed. The unit test generation process has completed successfully. |
|
Creating a PR to put the unit tests in... The changes have been created in this pull request: View PR |
tmikula-dev
removed
the
work in progress
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
DEVELOPER.md (2)
108-127: Minor phrasing and terminology improvements.A few small refinements for clarity:
- Line 111: "We are forcing to eliminate" → "All errors reported by TFLint must be eliminated"
- Line 117: Missing space after period in link text →
[following link.](→[following link](or keep period with space- Line 121: "from the root file" → "from the root directory"
Apply this diff:
-This project uses the [TFLint](https://github.com/terraform-linters/tflint) tool for static analysis of Terraform code. -We are forcing to eliminate **all** errors reported by TFLint. Any detected warnings and notices should be corrected as well as a best practice. +This project uses the [TFLint](https://github.com/terraform-linters/tflint) tool for static analysis of Terraform code. +All errors reported by TFLint must be eliminated. Any detected warnings and notices should be corrected as well as a best practice. - Find possible errors (like invalid instance types) for Major Cloud providers (AWS/Azure/GCP). - Warn about deprecated syntax, unused declarations. - Enforce best practices, naming conventions. -> For installation instructions, please refer to the [following link.](https://github.com/terraform-linters/tflint) +> For installation instructions, please refer to the [following link](https://github.com/terraform-linters/tflint). ### Run TFLint -For running TFLint you need to be in the `terraform/` directory. From the root file run the following commands: +For running TFLint you need to be in the `terraform/` directory. From the root directory run the following commands:
129-143: Minor terminology correction.Line 138: "from the root file" should be "from the root directory" for consistency with standard terminology.
Apply this diff:
### Run Trivy -For running Trivy tool locally run the following command from the root file: +For running Trivy tool locally run the following command from the root directory: ```shell trivy config terraform/ # Default table output (all severities) trivy config --severity HIGH,CRITICAL terraform/ # Show only HIGH and CRITICAL severities
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (5)
.github/CODEOWNERS(1 hunks).github/workflows/check_terraform.yml(1 hunks)DEVELOPER.md(3 hunks)README.md(1 hunks)terraform/lambda.tf(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- terraform/lambda.tf
🧰 Additional context used
🪛 LanguageTool
DEVELOPER.md
[grammar] ~5-~5: There might be a mistake here.
Context: ...-environment) - Run Pylint Tool Locally - [Run Black Tool Locally](#run-black-tool-...
(QB_NEW_EN)
[grammar] ~6-~6: There might be a mistake here.
Context: ...-tool-locally) - Run Black Tool Locally - [Run mypy Tool Locally](#run-mypy-tool-lo...
(QB_NEW_EN)
[grammar] ~7-~7: There might be a mistake here.
Context: ...k-tool-locally) - Run mypy Tool Locally - [Run TFLint Tool Locally](#run-tflint-too...
(QB_NEW_EN)
[grammar] ~8-~8: There might be a mistake here.
Context: ...tool-locally) - Run TFLint Tool Locally - [Run Trivy Tool Locally](#run-trivy-tool-...
(QB_NEW_EN)
[grammar] ~9-~9: There might be a mistake here.
Context: ...-tool-locally) - Run Trivy Tool Locally - Run Unit Test - [Co...
(QB_NEW_EN)
[grammar] ~10-~10: There might be a mistake here.
Context: ...run-trivy-tool-locally) - Run Unit Test - Code Coverage ## Get S...
(QB_NEW_EN)
[grammar] ~113-~113: There might be a mistake here.
Context: ...r Major Cloud providers (AWS/Azure/GCP). - Warn about deprecated syntax, unused dec...
(QB_NEW_EN)
[grammar] ~114-~114: There might be a mistake here.
Context: ... deprecated syntax, unused declarations. - Enforce best practices, naming conventio...
(QB_NEW_EN)
[grammar] ~131-~131: There might be a mistake here.
Context: ...r security issues and misconfigurations. It is an open‑source security scanner ma...
(QB_NEW_EN)
🔇 Additional comments (4)
DEVELOPER.md (1)
168-177: LGTM! Good addition of code coverage documentation.The new Code Coverage section clearly documents how to run coverage reports and view results. The enforcement of an 80% minimum threshold and HTML report generation are valuable practices.
.github/workflows/check_terraform.yml (2)
1-21: LGTM! Well-structured workflow configuration.The workflow metadata, triggers, and permissions are properly configured:
- Appropriate path filters for terraform changes
- Concurrency group prevents duplicate runs
- Correct permissions for SARIF uploads
23-56: LGTM! Trivy job correctly implements exit code enforcement.The Trivy job properly:
- Captures exit codes with
set +e- Filters to HIGH/CRITICAL severities
- Uploads SARIF before enforcing failure
- Provides clear failure messaging
README.md (1)
127-137: LGTM! Clean table formatting and comprehensive tool coverage.The reformatted table with fixed-width columns improves readability, and the new TFLint and Trivy entries properly document the expanded static analysis tooling. This aligns well with the additions in DEVELOPER.md and the new CI workflow.
Overview
This pull request introduces a new GitHub Actions workflow for static checking of Terraform. It using Trivy for security scanning and TFLint for linting. Results are uploaded in SARIF format for integration with GitHub's security dashboard.
Release Notes:
Related
Closes #67
Summary by CodeRabbit
Chores
Documentation