Skip to content

Secure Code Analysis #414

Secure Code Analysis

Secure Code Analysis #414

Workflow file for this run

name: Secure Code Analysis
on:
schedule:
- cron: '35 1 * * *'
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
permissions:
contents: read
jobs:
tflint:
runs-on: '${{ matrix.os }}'
permissions:
actions: read
contents: read
security-events: write
strategy:
matrix:
os:
- ubuntu-latest
steps:
- name: Checkout source code
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
with:
token: '${{ secrets.GITHUB_TOKEN }}'
fetch-depth: 0
- name: Cache plugin dir
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
with:
path: ~/.tflint.d/plugins
key: '${{ matrix.os }}-tflint-${{ hashFiles(''.tflint.hcl'') }}'
- uses: terraform-linters/setup-tflint@19a52fbac37dacb22a09518e4ef6ee234f2d4987 # v4.0.0
name: Setup TFLint
with:
tflint_version: latest
- name: Init TFLint
run: tflint --init
- name: Run TFLint
run: tflint --disable-rule=terraform_unused_declarations --format sarif > tflint.sarif
- name: Upload SARIF file
if: success() || failure()
uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
with:
sarif_file: tflint.sarif
tfsec:
name: tfsec
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
steps:
- name: Clone repo
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
with:
token: '${{ secrets.GITHUB_TOKEN }}'
fetch-depth: 0
- name: Run tfsec
uses: aquasecurity/tfsec-action@b466648d6e39e7c75324f25d83891162a721f2d6 # v1.0.3
with:
additional_args: '--format sarif --out tfsec.sarif --exclude aws-ssm-secret-use-customer-key,github-repositories-private,aws-vpc-no-excessive-port-access,github-repositories-require-signed-commits'
- name: Upload SARIF file
if: success() || failure()
uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
with:
sarif_file: tfsec.sarif
checkov:
name: checkov
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
steps:
- name: Checkout repo
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
with:
token: '${{ secrets.GITHUB_TOKEN }}'
fetch-depth: 0
- name: Run Checkov action
id: checkov
uses: bridgecrewio/checkov-action@653c205af0300161be5a64752a784c24a76cba7a # v12.2707.0
with:
directory: ./
framework: terraform
output_file_path: ./checkov.sarif
output_format: sarif
skip_check: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
- name: Upload SARIF file
if: success() || failure()
uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
with:
sarif_file: ./checkov.sarif