code-scanning.yml

name: Secure Code Analysis
on:
  schedule:
    - cron: '35 1 * * *'
env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
permissions:
  contents: read
jobs:
  tflint:
    runs-on: '${{ matrix.os }}'
    permissions:
      actions: read
      contents: read
      security-events: write
    strategy:
      matrix:
        os:
          - ubuntu-latest
    steps:
      - name: Checkout source code
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          token: '${{ secrets.GITHUB_TOKEN }}'
          fetch-depth: 0
      - name: Cache plugin dir
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        with:
          path: ~/.tflint.d/plugins
          key: '${{ matrix.os }}-tflint-${{ hashFiles(''.tflint.hcl'') }}'
      - uses: terraform-linters/setup-tflint@19a52fbac37dacb22a09518e4ef6ee234f2d4987 # v4.0.0
        name: Setup TFLint
        with:
          tflint_version: latest
      - name: Init TFLint
        run: tflint --init
      - name: Run TFLint
        run: tflint --disable-rule=terraform_unused_declarations --format sarif > tflint.sarif
      - name: Upload SARIF file
        if: success() || failure()
        uses: github/codeql-action/upload-sarif@b611370bb5703a7efb587f9d136a52ea24c5c38c # v3.25.11
        with:
          sarif_file: tflint.sarif
  trivy:
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status.
    name: trivy
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      - name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@7c2007bcb556501da015201bcba5aa14069b74e2
        with:
          scan-type: 'fs'
          scanners: misconfig,vuln,secret
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
          trivyignores: ./.trivyignore.yaml

      - name: Upload Trivy scan results to GitHub Security tab
        if: success() || failure()
        uses: github/codeql-action/upload-sarif@b611370bb5703a7efb587f9d136a52ea24c5c38c # v3.25.11
        with:
          sarif_file: 'trivy-results.sarif'
  checkov:
    name: checkov
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Checkout repo
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          token: '${{ secrets.GITHUB_TOKEN }}'
          fetch-depth: 0
      - name: Run Checkov action
        id: checkov
        uses: bridgecrewio/checkov-action@b406dfe80a3d33640d5b5deb4341f2475cc016a0 # v12.2812.0
        with:
          directory: ./
          framework: terraform
          output_file_path: ./checkov.sarif
          output_format: sarif
          skip_check: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
      - name: Upload SARIF file
        if: success() || failure()
        uses: github/codeql-action/upload-sarif@b611370bb5703a7efb587f9d136a52ea24c5c38c # v3.25.11
        with:
          sarif_file: ./checkov.sarif