|
10 | 10 | workflow_dispatch:
|
11 | 11 |
|
12 | 12 | jobs:
|
13 |
| - pre-commit: |
14 |
| - runs-on: ubuntu-latest |
15 |
| - steps: |
16 |
| - - uses: actions/checkout@v4 |
17 |
| - - uses: actions/setup-python@v5 |
18 |
| - - uses: terraform-linters/setup-tflint@v4 |
19 |
| - - uses: pre-commit/action@v3.0.1 |
20 |
| - with: |
21 |
| - extra_args: "-a" |
22 |
| - |
23 | 13 | validate:
|
24 |
| - name: Validate |
25 |
| - needs: [pre-commit] |
26 |
| - runs-on: ubuntu-latest |
27 |
| - permissions: |
28 |
| - pull-requests: write |
29 |
| - strategy: |
30 |
| - fail-fast: true |
31 |
| - matrix: |
32 |
| - tf-version: ["1.0", "1.1", "1.2", "1.3", "1.4", "1.5", "1.6", "1.7", "latest"] |
33 |
| - steps: |
34 |
| - - name: Checkout code |
35 |
| - uses: actions/checkout@v4 |
36 |
| - - name: Setup Terraform |
37 |
| - uses: hashicorp/setup-terraform@v3 |
38 |
| - with: |
39 |
| - terraform_version: ${{ matrix.tf-version }} |
40 |
| - - name: Terraform Init |
41 |
| - run: | |
42 |
| - terraform init -backend=false -upgrade -reconfigure |
43 |
| - - name: Terraform FMT |
44 |
| - run: | |
45 |
| - terraform fmt -check -recursive |
46 |
| - - name: Terraform Validate |
47 |
| - run: | |
48 |
| - terraform validate |
49 |
| - - name: Terraform Version / Providers |
50 |
| - run: | |
51 |
| - terraform version |
52 |
| - terraform providers |
53 |
| - - name: Example Complete Validate |
54 |
| - run: | |
55 |
| - cd examples/complete |
56 |
| - terraform init -backend=false -upgrade -reconfigure |
57 |
| - terraform validate |
58 |
| - - name: Example Remote Validate |
59 |
| - run: | |
60 |
| - cd examples/remote |
61 |
| - terraform init -backend=false -upgrade -reconfigure |
62 |
| - terraform validate |
| 14 | + uses: saidsef/saidsef/.github/workflows/tf-validate.yaml@main |
| 15 | + with: |
| 16 | + start-version: '0' |
| 17 | + end-version: '8' |
63 | 18 |
|
64 | 19 | tfsec:
|
65 |
| - name: tfsec |
66 |
| - if: contains(github.event_name, 'pull_request') |
67 |
| - runs-on: ubuntu-latest |
68 |
| - permissions: |
69 |
| - pull-requests: write |
| 20 | + uses: saidsef/saidsef/.github/workflows/tf-security.yaml@main |
70 | 21 | needs: [validate]
|
71 |
| - steps: |
72 |
| - - name: Checkout code |
73 |
| - uses: actions/checkout@v4 |
74 |
| - - name: tfsec |
75 |
| - id: tfsec |
76 |
| - uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1 |
77 |
| - with: |
78 |
| - github_token: ${{ github.token }} |
79 |
| - tfsec_args: "--force-all-dirs --concise-output --code-theme=dark --no-color" |
80 |
| - tfsec_version: "latest" |
| 22 | + |
| 23 | + attest: |
| 24 | + uses: saidsef/saidsef/.github/workflows/tf-attest.yaml@main |
| 25 | + needs: [tfsec] |
81 | 26 |
|
82 | 27 | caller-identity-check:
|
83 | 28 | if: contains(github.event_name, 'pull_request')
|
|
98 | 43 | aws sts get-caller-identity
|
99 | 44 |
|
100 | 45 | auto-approve:
|
101 |
| - if: contains(github.event_name, 'pull_request') |
102 |
| - runs-on: ubuntu-latest |
| 46 | + uses: saidsef/saidsef/.github/workflows/auto-approve.yaml@main |
103 | 47 | needs: [validate, tfsec, caller-identity-check]
|
104 |
| - steps: |
105 |
| - - name: Auto Approve PR |
106 |
| - uses: actions/github-script@v7 |
107 |
| - with: |
108 |
| - github-token: ${{ github.token }} |
109 |
| - script: | |
110 |
| - github.rest.pulls.createReview({ |
111 |
| - owner: context.repo.owner, |
112 |
| - repo: context.repo.repo, |
113 |
| - pull_number: context.issue.number, |
114 |
| - event: "APPROVE" |
115 |
| - }) |
0 commit comments