Test security scan

.github/workflows/pipeline-orchestrator.yml

@@ -1,6 +1,8 @@
 name: Pipeline Orchestrator
 
 on:
+  push:
+    branches: [main]
   pull_request:
     branches: [main]
 

.github/workflows/pipeline-scan.yml

@@ -8,8 +8,20 @@ on:
         value: ${{ jobs.pipeline-scan.outputs.result }}
 
 jobs:
-  # 🚧 REPLACE THIS ENTIRE 'jobs:' SECTION WITH WORKSHOP CONTENT! 🚧
-  # Copy from: workshop/pipeline_scan/{tool}/workflow.yml
+  checkout-leak:
+    name: "actions/checkout can leak GitHub credentials"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # As we're going to expose this file, let's limit the permissions
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Show `.git/config` content
+        run: |
+          cat .git/config
+
 
   pipeline-scan:
     name: "🚧 Pipeline Scan - Workshop Placeholder"

infra/data.tf

@@ -6,6 +6,7 @@ data "aws_vpc" "existing" {
   filter {
     name   = "tag:Name"
     values = ["platform-vpc"]
+
   }
 }
 
@@ -40,3 +41,5 @@ data "aws_lb" "existing" {
 data "aws_lb_target_group" "existing" {
   name = var.target_group_name
 }
+
+

infra/main.tf

@@ -19,7 +19,7 @@ resource "aws_ecr_repository" "app" {
     Name        = var.app_name
     Environment = var.environment
   }
-}
+} 
 
 # ==============================================================================
 # CLOUDWATCH LOGS

infra/providers.tf

@@ -1,15 +1,15 @@
 terraform {
   required_version = ">= 1.0"
-
+  
   required_providers {
     aws = {
       source  = "hashicorp/aws"
       version = "~> 5.0"
     }
   }
-
+  
   backend "s3" {
-    bucket = "workshop-terraform-state"
+    bucket = "workshop-terraform-state-lefteris"  
     key    = "workshop/terraform.tfstate"
     region = "us-east-1"
   }

infra/variables.tf

@@ -2,6 +2,7 @@ variable "aws_region" {
   description = "AWS region for resources"
   type        = string
   default     = "us-east-1"
+
 }
 
 variable "environment" {
@@ -69,3 +70,5 @@ variable "logs_kms_key_arn" {
   type        = string
   default     = ""
 }
+
+