feat(config): use spf13/viper to read config from env vars

[nitrocode]

what

• use spf13/viper to read config from env vars

why

• This will allow configuring settings using TFSEC_ prefix e.g. TFSEC_VERBOSE=true, TFSEC_SOFT_FAIL=true, etc
• This uses spf13/viper (created by the same author as spf13/cobra) and it integrates seamlessly here

references

• Closes https://github.com/aquasecurity/tfsec/issues/1956
• Upstream library https://github.com/spf13/viper
• Strong inspiration https://github.com/carolynvs/stingoftheviper/blob/main/main.go
• https://carolynvanslyck.com/blog/2020/08/sting-of-the-viper/

commands

Build

$ asdf install go 1.18
$ asdf local go 1.18
$ go mod tidy
$ go get github.com/spf13/viper
$ go get github.com/spf13/pflag
$ make build

Run

$ ./bin/darwin/tfsec-darwin-amd64
...

  14 passed, 2 ignored, 13 potential problem(s) detected.

$ echo $?
1

$ TFSEC_SOFT_FAIL=true ./bin/darwin/tfsec-darwin-amd64
...

 14 passed, 2 ignored, 13 potential problem(s) detected.

$ echo $?
0

[nitrocode]

Friendly ping @owenrumney

[nitrocode]

Friendly ping @itaysk

[nitrocode]

Friendly ping @owenrumney @itaysk

[itaysk]

@nitrocode thank you very much for taking the time to contribute.
As we shared before, we are focusing our attention from tfsec to Trivy (which has the same terraform scanning capability). Read more about this here: https://github.com/aquasecurity/tfsec/discussions/1994

[nitrocode]

Does this mean that this PR will not be reviewed or merged since you folks are trying to deprecate tfsec in favor of trivy ?

Is it possible that this PR can be the last one merged before the full deprecation? 🙏

[simar7]

hi @nitrocode could you rebase this PR on the latest master branch of tfsec and make sure the tests pass? We're trying to merge all outstanding PRs for tfsec at the moment.

[nitrocode]

@simar7 I rebased and fixed the linting issue locally. I verified using make quality.

[nitrocode]

@simar7 could we get an official release for this pr merge? I'd love to start using this feature in my pipeline.

[nitrocode]

Friendly ping @simar7 @AnaisUrlichs @itaysk. Could you folks release a final version of v1.28.2 or v1.29.0 please?

[simar7]

Friendly ping @simar7 @AnaisUrlichs @itaysk. Could you folks release a final version of v1.28.2 or v1.29.0 please?

Hi, at the moment we can't promise a definite date on getting the next release but I will circle back on this next week to see if I can spend some cycles to move it forward. Thanks for your patience.

[nitrocode]

Friendly ping when you folks get a chance. 😄

Have a nice weekend!

[nitrocode]

Friendly ping (hope it doesn't seem like nagging, just very excited for this release) @simar7 and all 😁🙏🏽

[nitrocode]

Friendly ping @simar7 ! Hope this is OK every once in a while 😄

[nitrocode]

Friendly ping all @simar7 @AnaisUrlichs @itaysk ! Hope you folks are doing OK. Have a nice weekend. Looking forward to the next release! 🚀 🙏

[nitrocode]

Thank you! You guys are awesome!

Released in v1.28.2