code-scanning.yml

name: Secure Code Analysis
on:
  schedule:
    - cron: '35 1 * * *'
env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
permissions:
  contents: read
jobs:
  tflint:
    runs-on: '${{ matrix.os }}'
    permissions:
      actions: read
      contents: read
      security-events: write
    strategy:
      matrix:
        os:
          - ubuntu-latest
    steps:
      - name: Checkout source code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          token: '${{ secrets.GITHUB_TOKEN }}'
          fetch-depth: 0
      - name: Cache plugin dir
        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
        with:
          path: ~/.tflint.d/plugins
          key: '${{ matrix.os }}-tflint-${{ hashFiles(''.tflint.hcl'') }}'
      - uses: terraform-linters/setup-tflint@19a52fbac37dacb22a09518e4ef6ee234f2d4987 # v4.0.0
        name: Setup TFLint
        with:
          tflint_version: latest
      - name: Init TFLint
        run: tflint --init
      - name: Run TFLint
        run: tflint --disable-rule=terraform_unused_declarations --format sarif > tflint.sarif
      - name: Upload SARIF file
        if: success() || failure()
        uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
        with:
          sarif_file: tflint.sarif
  trivy:
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status.
    name: trivy
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2
        with:
          scan-type: 'fs'
          scanners: misconfig,vuln,secret
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
          trivyignores: ./.trivyignore.yaml

      - name: Upload Trivy scan results to GitHub Security tab
        if: success() || failure()
        uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
        with:
          sarif_file: 'trivy-results.sarif'
  checkov:
    name: checkov
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Checkout repo
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          token: '${{ secrets.GITHUB_TOKEN }}'
          fetch-depth: 0
      - name: Run Checkov action
        id: checkov
        uses: bridgecrewio/checkov-action@55cc3d10db73cfe1ba3bfc895d4b57e1a9d82b99 # v12.2889.0
        with:
          directory: ./
          framework: terraform
          output_file_path: ./checkov.sarif
          output_format: sarif
          skip_check: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
      - name: Upload SARIF file
        if: success() || failure()
        uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
        with:
          sarif_file: ./checkov.sarif