terraform-plan.yaml

name: 'Terraform Plan'

on:
  push:
    branches: [ "main" ]
  pull_request:

    # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:
          
jobs:
  terraform:
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status

    strategy:
      fail-fast: false
      matrix:
        type: [nginx, istio, cilium]

    name: 'Terraform'
    runs-on: ubuntu-latest
    environment: production

    defaults:
      run:
        shell: bash

    steps:
    - name: Checkout
      uses: actions/checkout@v4

    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v3

    - name: Terraform Plan
      run: cd examples/kind-with-${{matrix.type}} && terraform init && terraform plan -no-color -out=tfplan.out && terraform show -json tfplan.out > tfplan.json

    - name: Output Plan
      run: cat examples/kind-with-${{matrix.type}}/tfplan.json

    - name: Checkov Analysis
      id: checkov
      uses: bridgecrewio/checkov-action@v12
      with:
        directory: examples/kind-with-${{matrix.type}}/
        file: examples/kind-with-${{matrix.type}}/tfplan.json 
        output_format: cli,sarif
        output_file_path: console,results.sarif
        # Ignoring checks since the original helm charts is so configure
        # Reference: https://github.com/kubernetes/ingress-nginx/blob/main/charts/ingress-nginx
        skip_check: CKV_K8S_25,CKV_K8S_22,CKV_K8S_35,CKV_K8S_26,CKV_K8S_11,CKV_K8S_15,CKV_K8S_12

    - name: Upload SARIF file
      uses: github/codeql-action/upload-sarif@v3
        # Results are generated only on a success or failure
        # this is required since GitHub by default won't run the next step
        # when the previous one has failed. Security checks that do not pass will 'fail'.
        # An alternative is to add `continue-on-error: true` to the previous step
        # Or 'soft_fail: true' to checkov.
      if: success() || failure()
      with:
        sarif_file: results.sarif