CCAP-295: Added database deployments for the document transfer servic… #5
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Main Checks | |
| on: | |
| push: | |
| branches: | |
| - main | |
| jobs: | |
| find-modules: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout source code | |
| uses: actions/checkout@v4 | |
| - name: Find all terraform modules | |
| id: find | |
| uses: bendrucker/find-terraform-modules@v1 | |
| with: | |
| working-directory: tofu | |
| - name: Show all matching modules | |
| shell: bash | |
| run: | | |
| mods=(${{ join(fromJSON(steps.find.outputs.modules), ' ') }}) | |
| printf "%s\n" "${mods[@]}" | |
| - name: Find all changed files | |
| id: diff | |
| uses: technote-space/get-diff-action@v6 | |
| with: | |
| FORMAT: json | |
| - name: Show changed files | |
| run: | | |
| echo "${{ steps.diff.outputs.diff }}" | |
| - name: Get the modified modules | |
| id: modified | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const modules = ${{ steps.find.outputs.modules }} | |
| const diff = ${{ steps.diff.outputs.diff }} | |
| const modifiedModules = modules.filter( | |
| (module) => { | |
| return !!diff.find(file => new RegExp(`^${module}/.+`).test(file)) | |
| } | |
| ) | |
| core.setOutput('modules', modifiedModules) | |
| - name: Show modified modules | |
| run: | | |
| echo "${{ steps.modified.outputs.modules }}" | |
| outputs: | |
| modules: ${{ steps.modified.outputs.modules }} | |
| lint: | |
| runs-on: ubuntu-latest | |
| needs: find-modules | |
| steps: | |
| - name: Checkout source code | |
| uses: actions/checkout@v4 | |
| - uses: actions/cache@v4 | |
| name: Cache plugin directory | |
| with: | |
| path: ~/.tflint.d/plugins | |
| key: tflint-${{ hashFiles('.tflint.hcl') }} | |
| - uses: terraform-linters/setup-tflint@v4 | |
| name: Setup TFLint | |
| - name: Show version | |
| run: tflint --version | |
| - name: Init TFLint | |
| run: tflint --init | |
| # Use a bash script to run tflint on each modified module. | |
| - name: Run TFLint | |
| shell: bash | |
| run: | | |
| set +e | |
| exit_code=0 | |
| modules=(${{ join(fromJSON(needs.find-modules.outputs.modules), ' ') }}) | |
| for module in ${modules[@]} | |
| do | |
| echo "Linting module $module" | |
| tflint --format compact --chdir $module | |
| exit_code=$(( $? > exit_code ? $? : exit_code )) | |
| done | |
| exit $exit_code | |
| trivy: | |
| name: trivy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout source code | |
| uses: actions/checkout@v4 | |
| - name: Run Trivy vulnarability scanner | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| scan-type: config | |
| ignore-unfixed: true | |
| skip-dirs: '**/*/.terraform' | |
| exit-code: 1 | |
| format: sarif | |
| output: 'trivy-results.sarif' | |
| - name: Parse SARIF file | |
| if: always() | |
| uses: Ayrx/[email protected] | |
| with: | |
| sarif_file: 'trivy-results.sarif' |