code-scanning.yml

name: Secure Code Analysis
on:
  schedule:
    - cron: '35 1 * * *'
env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
permissions:
  contents: read
jobs:
  tflint:
    runs-on: '${{ matrix.os }}'
    permissions:
      actions: read
      contents: read
      security-events: write
    strategy:
      matrix:
        os:
          - ubuntu-latest
    steps:
      - name: Checkout source code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          token: '${{ secrets.GITHUB_TOKEN }}'
          fetch-depth: 0
      - name: Cache plugin dir
        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
        with:
          path: ~/.tflint.d/plugins
          key: '${{ matrix.os }}-tflint-${{ hashFiles(''.tflint.hcl'') }}'
      - uses: terraform-linters/setup-tflint@19a52fbac37dacb22a09518e4ef6ee234f2d4987 # v4.0.0
        name: Setup TFLint
        with:
          tflint_version: latest
      - name: Init TFLint
        run: tflint --init
      - name: Run TFLint
        run: tflint --disable-rule=terraform_unused_declarations --format sarif > tflint.sarif
      - name: Upload SARIF file
        if: success() || failure()
        uses: github/codeql-action/upload-sarif@e5f05b81d5b6ff8cfa111c80c22c5fd02a384118 # v3.23.0
        with:
          sarif_file: tflint.sarif
  tfsec:
    name: tfsec
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Clone repo
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          token: '${{ secrets.GITHUB_TOKEN }}'
          fetch-depth: 0
      - name: Run tfsec
        uses: aquasecurity/tfsec-action@b466648d6e39e7c75324f25d83891162a721f2d6 # v1.0.3
        with:
          additional_args: '--format sarif --out tfsec.sarif --exclude aws-ssm-secret-use-customer-key,github-repositories-private,aws-vpc-no-excessive-port-access,github-repositories-require-signed-commits'
      - name: Upload SARIF file
        if: success() || failure()
        uses: github/codeql-action/upload-sarif@e5f05b81d5b6ff8cfa111c80c22c5fd02a384118 # v3.23.0
        with:
          sarif_file: tfsec.sarif
  checkov:
    name: checkov
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Checkout repo
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          token: '${{ secrets.GITHUB_TOKEN }}'
          fetch-depth: 0
      - name: Run Checkov action
        id: checkov
        uses: bridgecrewio/checkov-action@75bdfb4b5e1332c35f82eb1fbdbf1f5b35366779 # v12.2641.0
        with:
          directory: ./
          framework: terraform
          output_file_path: ./checkov.sarif
          output_format: sarif
          skip_check: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
      - name: Upload SARIF file
        if: success() || failure()
        uses: github/codeql-action/upload-sarif@e5f05b81d5b6ff8cfa111c80c22c5fd02a384118 # v3.23.0
        with:
          sarif_file: ./checkov.sarif