code-scanning.yml

name: Secure Code Analysis
on:
  schedule:
    - cron: '35 1 * * *'
env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
permissions:
  contents: read
jobs:
  tflint:
    runs-on: '${{ matrix.os }}'
    permissions:
      actions: read
      contents: read
      security-events: write
    strategy:
      matrix:
        os:
          - ubuntu-latest
    steps:
      - name: Checkout source code
        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
        with:
          token: '${{ secrets.GITHUB_TOKEN }}'
          fetch-depth: 0
      - name: Cache plugin dir
        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
        with:
          path: ~/.tflint.d/plugins
          key: '${{ matrix.os }}-tflint-${{ hashFiles(''.tflint.hcl'') }}'
      - uses: terraform-linters/setup-tflint@3bb7d777f5c38e288977551bc117a79437bdc6fd # v3.1.0
        name: Setup TFLint
        with:
          tflint_version: latest
      - name: Init TFLint
        run: tflint --init
      - name: Run TFLint
        run: tflint --disable-rule=terraform_unused_declarations --format sarif > tflint.sarif
      - name: Upload SARIF file
        if: success() || failure()
        uses: github/codeql-action/upload-sarif@00e563ead9f72a8461b24876bee2d0c2e8bd2ee8 # v2.21.5
        with:
          sarif_file: tflint.sarif
  tfsec:
    name: tfsec
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Clone repo
        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
        with:
          token: '${{ secrets.GITHUB_TOKEN }}'
          fetch-depth: 0
      - name: Run tfsec
        uses: aquasecurity/tfsec-action@b466648d6e39e7c75324f25d83891162a721f2d6 # v1.0.3
        with:
          additional_args: '--format sarif --out tfsec.sarif --exclude aws-ssm-secret-use-customer-key,github-repositories-private,aws-vpc-no-excessive-port-access,github-repositories-require-signed-commits'
      - name: Upload SARIF file
        if: success() || failure()
        uses: github/codeql-action/upload-sarif@00e563ead9f72a8461b24876bee2d0c2e8bd2ee8 # v2.21.5
        with:
          sarif_file: tfsec.sarif
  checkov:
    name: checkov
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Checkout repo
        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
        with:
          token: '${{ secrets.GITHUB_TOKEN }}'
          fetch-depth: 0
      - name: Run Checkov action
        id: checkov
        uses: bridgecrewio/checkov-action@48475c1f02835e316decdd4a15d1183bebe5a27b # v12.2483.0
        with:
          directory: ./
          framework: terraform
          output_file_path: ./checkov.sarif
          output_format: sarif
          skip_check: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
      - name: Upload SARIF file
        if: success() || failure()
        uses: github/codeql-action/upload-sarif@00e563ead9f72a8461b24876bee2d0c2e8bd2ee8 # v2.21.5
        with:
          sarif_file: ./checkov.sarif