Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feature: have option for terraform_tfsec.sh to only run in relevant modified directories #135

Merged
merged 6 commits into from
Sep 1, 2020
Merged

feature: have option for terraform_tfsec.sh to only run in relevant modified directories #135

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
2127949
fix: have terraform_tfsec.sh only run in relevant modified directories
nkazarian-spokeo Aug 21, 2020
7945039
docs: Update README.md to reflect changes to terraform_tfsec.sh
nkazarian-spokeo Aug 21, 2020
ccb0012
docs: example of sample hook configuration for changes proposed to te…
nkazarian-spokeo Aug 21, 2020
5770e53
Merge remote-tracking branch 'upstream/master' into master
nkazarian-spokeo Aug 31, 2020
9fc4e24
feat: bring in modified-files-only logic post-introduction of getopt …
nkazarian-spokeo Aug 31, 2020
505a958
chore: remove echo
nkazarian-spokeo Aug 31, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 16 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,7 +121,22 @@ if they are present in `README.md`.

## Notes about terraform_tfsec hooks

1. `terraform_tfsec` will recurse all directories/modules.
1. `terraform_tfsec` will consume modified files that pre-commit
passes to it, so you can perform whitelisting of directories
or files to run against via [files](https://pre-commit.com/#config-files)
pre-commit flag
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you add a quick example of how this will look in the config file, similar to the other examples in the readme, and then callout how the example will change which directories will be scanned by tfsec?

hooks:
    - id: terraform_tfsec
      files: 'prd-infra/'

Will instruct tfsec to recursively scan the ./prd-infra folder, but will ignore any other folders at the root level.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done! Please review when you get a moment.


1. Example:
```yaml
hooks:
- id: terraform_tfsec
files: ^prd-infra/
```

The above will tell pre-commit to pass down files from the `prd-infra/` folder
only such that the underlying `tfsec` tool can run against changed files in this
directory, ignoring any other folders at the root level

1. To ignore specific warnings, follow the convention from the
[documentation](https://github.com/liamg/tfsec#ignoring-warnings).
1. Example:
Expand Down
17 changes: 15 additions & 2 deletions terraform_tfsec.sh
100755 → 100644
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,21 @@ main() {
}

tfsec_() {
# Ignore $files because tfsec will recurse directories anyway.
tfsec $args .
# consume modified files passed from pre-commit so that
# tfsec runs against only those relevant directories
for file_with_path in $files; do
file_with_path="${file_with_path// /__REPLACED__SPACE__}"
paths[index]=$(dirname "$file_with_path")

let "index+=1"
done

for path_uniq in $(echo "${paths[*]}" | tr ' ' '\n' | sort -u); do
path_uniq="${path_uniq//__REPLACED__SPACE__/ }"
pushd "$path_uniq" > /dev/null
tfsec $args
popd > /dev/null
done
}

getopt() {
Expand Down