terraform.yml

---
name: "Terraform CI"

on:
  push:
    branches: ["main"]
  pull_request:

permissions:
  contents: read

jobs:
  pre-commit:
    name: "Run Pre-Commit hooks"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      - name: Setup Python
        uses: actions/setup-python@v3
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v1
        #with:
        #  cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}
      - name: Terraform Init
        run: terraform init
      - name: Setup terraform-docs
        run: sudo .devcontainer/scripts/setup-docker-container.sh install terraform-docs latest
      - name: Setup trivy
        run: sudo .devcontainer/scripts/setup-docker-container.sh install trivy latest
      - name: Run Pre-Commit
        uses: pre-commit/action@v3.0.0

  terraform-trivy:
    name: "Vulnerability scan"
    runs-on: ubuntu-latest
    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      - name: Run Trivy vulnerability scanner in fs mode
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: "fs"
          scan-ref: "."
          trivy-config: trivy.yaml

  # terraform-plan:
  #   name: "terraform plan"
  #   runs-on: ubuntu-latest
  #   # environment: production

  #   # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest
  #   defaults:
  #     run:
  #       shell: bash

  #   steps:
  #     # Checkout the repository to the GitHub Actions runner
  #     - name: Checkout
  #       uses: actions/checkout@v3
  #     # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token
  #     - name: Setup Terraform
  #       uses: hashicorp/setup-terraform@v1
  #       #with:
  #       #  cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}
  #     # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
  #     - name: Terraform Init
  #       run: terraform init
  #     # Checks that all Terraform configuration files adhere to a canonical format
  #     - name: Terraform Format
  #       run: terraform fmt -check
  #     # Generates an execution plan for Terraform
  #     - name: Terraform Plan
  #       run: terraform plan -input=false -out=tfplan
  #     # On push to "main", build or change infrastructure according to Terraform configuration files
  #     # Note: It is recommended to set up a required "strict" status check in your repository for "Terraform Cloud". See the documentation on "strict" required status checks for more information: https://help.github.com/en/github/administering-a-repository/types-of-required-status-checks
  #     # - name: Terraform Apply
  #     #   if: github.ref == 'refs/heads/"main"' && github.event_name == 'push'
  #     #   run: terraform apply -auto-approve -input=false tfplan