code-scanning.yml

name: Secure Code Analysis
on:
  schedule:
    - cron: '35 1 * * *'
env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
permissions:
  contents: read
jobs:
  tflint:
    runs-on: '${{ matrix.os }}'
    permissions:
      actions: read
      contents: read
      security-events: write
    strategy:
      matrix:
        os:
          - ubuntu-latest
    steps:
      - name: Checkout source code
        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
        with:
          token: '${{ secrets.GITHUB_TOKEN }}'
          fetch-depth: 0
      - name: Cache plugin dir
        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
        with:
          path: ~/.tflint.d/plugins
          key: '${{ matrix.os }}-tflint-${{ hashFiles(''.tflint.hcl'') }}'
      - uses: terraform-linters/setup-tflint@19a52fbac37dacb22a09518e4ef6ee234f2d4987 # v4.0.0
        name: Setup TFLint
        with:
          tflint_version: latest
      - name: Init TFLint
        run: tflint --init
      - name: Run TFLint
        run: tflint --disable-rule=terraform_unused_declarations --format sarif > tflint.sarif
      - name: Upload SARIF file
        if: success() || failure()
        uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
        with:
          sarif_file: tflint.sarif
  tfsec:
    name: tfsec
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Clone repo
        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
        with:
          token: '${{ secrets.GITHUB_TOKEN }}'
          fetch-depth: 0
      - name: Run tfsec
        uses: aquasecurity/tfsec-action@b466648d6e39e7c75324f25d83891162a721f2d6 # v1.0.3
        with:
          additional_args: '--format sarif --out tfsec.sarif --exclude aws-ssm-secret-use-customer-key,github-repositories-private,aws-vpc-no-excessive-port-access,github-repositories-require-signed-commits'
      - name: Upload SARIF file
        if: success() || failure()
        uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
        with:
          sarif_file: tfsec.sarif
  checkov:
    name: checkov
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Checkout repo
        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
        with:
          token: '${{ secrets.GITHUB_TOKEN }}'
          fetch-depth: 0
      - name: Run Checkov action
        id: checkov
        uses: bridgecrewio/checkov-action@f6243e0bd0159652f2017c47743fbb7e36859d00 # v12.2526.0
        with:
          directory: ./
          framework: terraform
          output_file_path: ./checkov.sarif
          output_format: sarif
          skip_check: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
      - name: Upload SARIF file
        if: success() || failure()
        uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
        with:
          sarif_file: ./checkov.sarif