iac_scan.yaml

# Copyright 2023 Amazon.com, Inc. or its affiliates. 
# SPDX-License-Identifier: Apache-2.0
# Licensed under the Apache License, Version 2.0 https://aws.amazon.com/apache-2-0/

name: Infra-as-Code Code Scanning
on: [push, pull_request]
permissions:
  contents: read

jobs:

################
# Trivy Checks #
################
  trivy:
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
    runs-on: ubuntu-latest
    env:
      TRIVY_REPORT_FILE: trivy_report.sarif

    steps:
      - name: Checkout the branch
        uses: actions/checkout@v3

      - name: Run trivy in fs mode and generate report
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          ignore-unfixed: true
          trivy-config: ".github/conf/trivy.yaml"
          trivyignores: ".github/conf/.trivyignore"
          # severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
          # output: ${{ env.TRIVY_REPORT_FILE }} # This flag doesnt seem to be working.
        env:
          TRIVY_OUTPUT: ${{ env.TRIVY_REPORT_FILE }}

      # As per the following issue/solution: https://github.com/aquasecurity/trivy/issues/5003
      - name: Fix trivy SARIF report for URI scheme
        run: |-
          sed -i 's#git::https:/##g' ${{ env.TRIVY_REPORT_FILE }}

      - name: Upload trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        if: success() || failure()
        with:
          sarif_file: "${{ env.TRIVY_REPORT_FILE }}"

      - name: Save report results as an artifact
        uses: actions/upload-artifact@v3
        with:
          name: ${{ env.TRIVY_REPORT_FILE }}
          path: ${{ env.TRIVY_REPORT_FILE }}

##################
# Checkov Checks #
##################
  checkov:
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
    runs-on: ubuntu-latest
    env:
      CHECKOV_REPORT_FILE: checkov_report.sarif

    steps:
      - name: Checkout the branch
        uses: actions/checkout@v3

      - name: Run checkov and generate report
        uses: bridgecrewio/checkov-action@v12
        with:
          config_file: ".github/conf/checkov.yaml"
          output_format: cli,sarif
          output_file_path: console,${{ env.CHECKOV_REPORT_FILE }}

      - name: Upload checkov scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        if: success() || failure()
        with:
          sarif_file: "${{ env.CHECKOV_REPORT_FILE }}"

      - name: Save report results as an artifact
        uses: actions/upload-artifact@v3
        with:
          name: ${{ env.CHECKOV_REPORT_FILE }}
          path: ${{ env.CHECKOV_REPORT_FILE }}

#################
# TFLint Checks #
#################
  tflint:
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
    runs-on: ubuntu-latest
    env:
      TFLINT_REPORT_FILE: tflint_report.sarif

    steps:
      - name: Checkout the branch
        uses: actions/checkout@v3

      - name: Setup tflint
        uses: terraform-linters/setup-tflint@v3
        with:
          tflint_wrapper: true

      - name: Install tflint plugins
        run: |-
          tflint --init -c .github/conf/tflint.hcl

      - name: Run tflint
        id: tflint_run
        run: |-
          tflint --recursive --format sarif -c $(pwd)/.github/conf/tflint.hcl
        env:
          GITHUB_TOKEN: ${{ github.token }}

      - name: Generate report
        run: |-
          echo '${{ steps.tflint_run.outputs.stdout }}' > "${{ env.TFLINT_REPORT_FILE }}"

      - name: Upload tflint scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        if: success() || failure()
        with:
          sarif_file: "${{ env.TFLINT_REPORT_FILE }}"

      - name: Save report results as an artifact
        uses: actions/upload-artifact@v3
        with:
          name: ${{ env.TFLINT_REPORT_FILE }}
          path: ${{ env.TFLINT_REPORT_FILE }}

#############
# TF Checks #
#############
  tfchecks:
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
    runs-on: ubuntu-latest

    steps:
      - name: Checkout the branch
        uses: actions/checkout@v3

      - name: Check Terraform fmt for grid
        uses: dflook/terraform-fmt-check@v1
        with:
          path: deployment/grid/terraform

      - name: Validate Terraform code for grid
        uses: dflook/terraform-validate@v1
        if: success() || failure()
        with:
          path: deployment/grid/terraform

      - name: Check Terraform fmt for image_repository
        uses: dflook/terraform-fmt-check@v1
        if: success() || failure()
        with:
          path: deployment/image_repository/terraform

      - name: Validate Terraform code for image_repository
        uses: dflook/terraform-validate@v1
        if: success() || failure()
        with:
          path: deployment/image_repository/terraform