receive-pull-request.yml

name: Receive pull request

on:
  pull_request:

jobs:
  compliance-scan:
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Run Checkov action
        id: checkov
        uses: bridgecrewio/checkov-action@v12.2726.0
        with:
          framework: terraform
          # we are fine with Google's Keys
          # we are fine with basic roles (no org), we are fine with our own module
          skip_check: CKV_GCP_84,CKV_GIT_4,CKV_GCP_117,CKV_TF_1
          output_format: cli
          download_external_modules: true

  security-scan:
    runs-on: ubuntu-20.04

    steps:
      - uses: actions/checkout@v4
      - run: docker run -v ${PWD}:/src aquasec/tfsec:v1.8 /src

  lint:
    runs-on: ubuntu-20.04

    steps:
      - uses: actions/checkout@v4
      - uses: terraform-linters/setup-tflint@v4
        name: Setting up TFLint
        with:
          tflint_version: v0.29.0
      - name: Initializing TFLint
        run: tflint --init
      - name: Linting
        run: tflint -f compact --disable-rule=terraform_module_pinned_source

  qa:
    runs-on: ubuntu-20.04

    steps:
      - uses: actions/checkout@v4
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
      - name: Terraform Format
        run: terraform fmt -check -recursive