Feat/traefik compose #6

Workflow file for this run

.github/workflows/terraform.yaml at 02b64de

	name: Terraform

	on:
	workflow_dispatch:
	push:
	branches:
	- main
	paths:
	- 'infrastructure/**'
	pull_request:
	branches:
	- main
	paths:
	- 'infrastructure/**'

	env:
	TF_VERSION: "1.14.3"
	TF_WORKING_DIR: infrastructure

	permissions:
	contents: write
	pull-requests: write

	jobs:
	format:
	name: Format
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	with:
	ref: ${{ github.head_ref \|\| github.ref_name }}

	- name: Setup Terraform
	uses: hashicorp/setup-terraform@v3
	with:
	terraform_version: ${{ env.TF_VERSION }}

	- name: Terraform Format
	run: terraform fmt -recursive
	working-directory: ${{ env.TF_WORKING_DIR }}

	- name: Commit formatting changes
	run: \|
	git config user.name "github-actions[bot]"
	git config user.email "github-actions[bot]@users.noreply.github.com"
	git add -A
	git diff --staged --quiet \|\| git commit -m "style: terraform fmt"
	git push

	validate:
	name: Validate
	runs-on: ubuntu-latest
	needs: format
	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup Terraform
	uses: hashicorp/setup-terraform@v3
	with:
	terraform_version: ${{ env.TF_VERSION }}

	- name: Terraform Init (validation only)
	run: terraform init -backend=false
	working-directory: ${{ env.TF_WORKING_DIR }}

	- name: Terraform Validate
	id: validate
	run: terraform validate
	working-directory: ${{ env.TF_WORKING_DIR }}

	security-scan:
	name: Security Scan
	runs-on: ubuntu-latest
	needs: validate
	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Install tfsec
	run: \|
	curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh \| bash
	sudo mv ./tfsec /usr/local/bin/

	- name: Run tfsec
	run: \|
	tfsec ${{ env.TF_WORKING_DIR }} --format lovely > tfsec-results.txt 2>&1 \|\| true
	cat tfsec-results.txt

	- name: Run Checkov
	run: \|
	pip install checkov
	checkov -d ${{ env.TF_WORKING_DIR }} --framework terraform --output cli > checkov-results.txt 2>&1 \|\| true
	cat checkov-results.txt

	- name: Upload scan results
	uses: actions/upload-artifact@v4
	with:
	name: security-scan-results
	path: \|
	tfsec-results.txt
	checkov-results.txt

	- name: Post scan results to PR
	if: github.event_name == 'pull_request'
	uses: actions/github-script@v7
	with:
	script: \|
	const fs = require('fs');
	const tfsec = fs.readFileSync('tfsec-results.txt', 'utf8');
	const checkov = fs.readFileSync('checkov-results.txt', 'utf8');
	const max = 30000;
	const trim = (s) => s.length > max ? s.substring(0, max) + '\n\n(truncated)' : s;

	github.rest.issues.createComment({
	issue_number: context.issue.number,
	owner: context.repo.owner,
	repo: context.repo.repo,
	body: `tfsec\n\`\`\`\n${trim(tfsec)}\n\`\`\`\n\ncheckov\n\`\`\`\n${trim(checkov)}\n\`\`\``
	})

	plan:
	name: Plan
	runs-on: ubuntu-latest
	needs: security-scan
	if: github.event_name == 'pull_request' \|\| github.event_name == 'workflow_dispatch'
	env:
	AWS_ACCESS_KEY_ID: ${{ secrets.TF_AWS_ACCESS_KEY_ID }}
	AWS_SECRET_ACCESS_KEY: ${{ secrets.TF_AWS_SECRET_ACCESS_KEY }}
	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup Terraform
	uses: hashicorp/setup-terraform@v3
	with:
	terraform_version: ${{ env.TF_VERSION }}

	- name: Terraform Init
	run: terraform init
	working-directory: ${{ env.TF_WORKING_DIR }}

	- name: Terraform Plan
	id: plan
	run: terraform plan -no-color -out=tfplan 2>&1 \| tee plan_output.txt
	working-directory: ${{ env.TF_WORKING_DIR }}

	- name: Upload plan output
	uses: actions/upload-artifact@v4
	with:
	name: terraform-plan
	path: ${{ env.TF_WORKING_DIR }}/plan_output.txt

	- name: Post Plan to PR
	if: github.event_name == 'pull_request'
	uses: actions/github-script@v7
	with:
	script: \|
	const fs = require('fs');
	const plan = fs.readFileSync('${{ env.TF_WORKING_DIR }}/plan_output.txt', 'utf8');
	const max = 65000;
	const output = plan.length > max ? plan.substring(0, max) + '\n\n(truncated)' : plan;

	github.rest.issues.createComment({
	issue_number: context.issue.number,
	owner: context.repo.owner,
	repo: context.repo.repo,
	body: `Terraform Plan\n\n\`\`\`\n${output}\n\`\`\``
	})

	apply:
	name: Apply
	runs-on: ubuntu-latest
	needs: security-scan
	if: github.ref == 'refs/heads/main' && (github.event_name == 'push' \|\| github.event_name == 'workflow_dispatch')
	environment: production
	env:
	AWS_ACCESS_KEY_ID: ${{ secrets.TF_AWS_ACCESS_KEY_ID }}
	AWS_SECRET_ACCESS_KEY: ${{ secrets.TF_AWS_SECRET_ACCESS_KEY }}
	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup Terraform
	uses: hashicorp/setup-terraform@v3
	with:
	terraform_version: ${{ env.TF_VERSION }}

	- name: Terraform Init
	run: terraform init
	working-directory: ${{ env.TF_WORKING_DIR }}

	- name: Terraform Plan
	run: terraform plan -no-color -out=tfplan
	working-directory: ${{ env.TF_WORKING_DIR }}

	- name: Terraform Apply
	run: terraform apply -auto-approve tfplan
	working-directory: ${{ env.TF_WORKING_DIR }}

Navigation Menu

Feat/traefik compose #6

Workflow file

Feat/traefik compose #6

Uh oh!

Workflow file for this run