pipeline.yml

name: 'Terraform'
on:
  push:
    branches:
      - main
  pull_request:

env:
  tf_version: 1.3.9
  tflint_version: v0.45.0

concurrency:
  group: ci-pipeline-${{ github.workflow }}-${{ github.event.pull_request.number || github.event.pull_request.head.ref || github.ref }}

jobs:
  linters:
    name: 'Terraform Linters'
    runs-on: ubuntu-20.04
    defaults:
      run:
        shell: bash
    steps:
      -
        name: Check out code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      -
        name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.tf_version }}
          terraform_wrapper: false
      -
        name: Setup TFLint
        uses: terraform-linters/setup-tflint@v4
        with:
          tflint_version: ${{ env.tflint_version }}
      -
        name: Setup TFLint cache plugin dir
        uses: actions/cache@v4.1.2
        with:
          path: ~/.tflint.d/plugins
          key: tflint-${{ hashFiles('.tflint.hcl') }}
      -
        name: Test code with terraform fmt
        run: terraform fmt --recursive -check=true --diff
        continue-on-error: true
      -
        name: Test code with TFLint
        continue-on-error: true
        run: |
          tflint --init
          tflint -f compact
      -
        name: Test code with TFSec
        continue-on-error: true
        uses: aquasecurity/tfsec-action@v1.0.3
        with:
          soft_fail: true
      -
        name: Test code with Checkov
        uses: bridgecrewio/checkov-action@v12.2891.0
        with:
          directory: /
          framework: terraform
          soft_fail: true
          quiet: true
          download_external_modules: false
  semver:
    name: 'Set code version tag'
    runs-on: ubuntu-20.04
    permissions:
      contents: write
    needs:
      - linters
    defaults:
      run:
        shell: bash
    steps:
      -
        name: Check out code
        uses: actions/checkout@v4
        if: github.event_name == 'pull_request'
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.ref }}
      -
        name: Check out code
        uses: actions/checkout@v4
        if: github.event_name == 'push'
        with:
          fetch-depth: 0
      -
        name: Set application version
        id: set_version
        uses: kvendingoldo/semver-action@v1.20
        with:
          enable_github_releases: true
          release_tag_prefix: "v"
          github_token: "${{ secrets.GITHUB_TOKEN }}"