Merge branch 'main' into mg-948-consistent-results #227
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI Infra Checks | |
| # TODO: Re-enable this later | |
| on: [] | |
| # push: | |
| # branches: | |
| # - main | |
| # paths: | |
| # - bin/** | |
| # - infra/** | |
| # - .github/workflows/** | |
| # pull_request: | |
| # paths: | |
| # - bin/** | |
| # - infra/** | |
| # - .github/workflows/** | |
| jobs: | |
| lint-github-actions: | |
| # Lint github actions files using https://github.com/rhysd/actionlint | |
| # This job configuration is largely copied from https://github.com/rhysd/actionlint/blob/main/docs/usage.md#use-actionlint-on-github-actions | |
| name: Lint GitHub Actions workflows | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - name: Download actionlint | |
| id: get_actionlint | |
| run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) | |
| shell: bash | |
| - name: Check workflow files | |
| run: ${{ steps.get_actionlint.outputs.executable }} -color | |
| shell: bash | |
| lint-scripts: | |
| name: Lint scripts | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - name: Shellcheck | |
| run: make infra-lint-scripts | |
| check-terraform-format: | |
| name: Check Terraform format | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - uses: hashicorp/setup-terraform@v2 | |
| with: | |
| terraform_version: 1.8.3 | |
| terraform_wrapper: false | |
| - name: Run infra-lint-terraform | |
| run: | | |
| echo "If this fails, run 'make infra-format'" | |
| make infra-lint-terraform | |
| validate-terraform: | |
| name: Validate Terraform modules | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - uses: hashicorp/setup-terraform@v2 | |
| with: | |
| terraform_version: 1.8.3 | |
| terraform_wrapper: false | |
| - name: Validate | |
| run: make infra-validate-modules | |
| check-compliance-with-checkov: | |
| name: Check compliance with checkov | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - uses: actions/setup-python@v4 | |
| with: | |
| python-version: "3.10" | |
| - name: Run Checkov check | |
| # Pin to specific checkov version rather than running from checkov@master | |
| # since checkov frequently adds new checks that can cause CI checks to fail unpredictably. | |
| # There is currently no way to specify the checkov version to pin to (See https://github.com/bridgecrewio/checkov-action/issues/41) | |
| # so we need to pin the version of the checkov-action, which indirectly pins the checkov version. | |
| # In this case, checkov-action v12.2296.0 is mapped to checkov v2.3.194. | |
| uses: bridgecrewio/checkov-action@v12.2296.0 | |
| with: | |
| directory: infra | |
| framework: terraform | |
| quiet: true # only displays failed checks | |
| check-compliance-with-tfsec: | |
| name: Check compliance with tfsec | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - name: Run tfsec check | |
| uses: aquasecurity/tfsec-pr-commenter-action@v1.2.0 | |
| with: | |
| github_token: ${{ github.token }} |