.gitlab-ci.yml

# Based on the template at:
# https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/Terraform.gitlab-ci.yml

variables:
  TF_AUTO_DEPLOY: "true"

include:
  - local: templates/tf/Base.latest.gitlab-ci.yml
  # See https://gitlab.com/gitlab-org/gitlab/blob/master/lib/gitlab/ci/templates/Terraform/

stages:
  - validate
  - test
  - build
  - deploy
  - configure
  - cleanup

fmt:
  extends: .terraform:fmt
  needs: []

validate:
  extends: .terraform:validate
  needs: []

build:
  extends: .terraform:build

deploy:
  extends: .terraform:deploy
  before_script:
    - mkdir generated
  dependencies:
    - build
  environment:
    name: $TF_STATE_NAME
  artifacts:
    name: variables
    paths:
      - ${TF_ROOT}/generated/*

tfsec:
  image: aquasec/tfsec
  stage: validate
  script:
    - cd "${TF_ROOT}"
    - /usr/bin/tfsec
  allow_failure: false

# Doesn't work with modules & moving resources to modules.
#terrascan:
#  image: tenable/terrascan
#  stage: validate
#  script:
#    - terrascan scan -i terraform --iac-version v14 --iac-dir ${TF_ROOT} --non-recursive --skip-rules=AC_AWS_0369

check_compliance:
  image: eerkunt/terraform-compliance
  stage: validate
  variables:
    TF_STATE_NAME: ${TF_STATE_NAME}
  before_script:
    - export TF_VAR_common_token_name=$COMMON_REPO_TOKEN_NAME
    - export TF_VAR_common_token_pass=$COMMON_REPO_TOKEN_PASS
  script:
    - git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@bbpgitlab.epfl.ch/cs/cloud/aws/terraform-compliance
    - ls -la terraform-compliance
    - rm -f gitlab-config.tf
    - terraform init
    - terraform plan -out=plan.tfplan > /dev/null && terraform show -json plan.tfplan > plan.json
    - terraform-compliance -f ./terraform-compliance -p ./plan.json