ci-check-infra.yml

name: Infra - Check

on:
  workflow_call:
    inputs:
      stage:
        description: 'The name of the Terraform workspace to use'
        type: string
        required: true
      tf-directory:
        description: 'The directory containing the Terraform files'
        type: string
        default: ${{ vars.TF_DIRECTORY }}
      run-label:
        description: 'The run label to use for the actions'
        type: string
        default: 'ubuntu-latest'
    secrets:
      TF_API_TOKEN:
        required: true

permissions:
  contents: read

env:
  TF_API_TOKEN: ${{ secrets.TF_API_TOKEN }}
  TF_WORKSPACE: wl-${{ inputs.stage }}

jobs:
  check-fmt:
    name: Formatting
    runs-on: ${{ inputs.run-label }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive
          token: ${{ secrets.PRIVATE_SUBMODULE_ACCESS_TOKEN || github.token }}

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

      - name: Check Formatting
        working-directory: ${{ inputs.tf-directory }}
        run: terraform fmt -recursive -check

  validate:
    name: Validate
    runs-on: ${{ inputs.run-label }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive
          token: ${{ secrets.PRIVATE_SUBMODULE_ACCESS_TOKEN || github.token }}

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

      - name: Cache Terraform data
        uses: actions/cache@v4
        with:
          path: ${{ inputs.tf-directory }}/.terraform
          key: terraform-${{ hashFiles('${{ inputs.tf-directory }}/.terraform.lock.hcl') }}

      - name: Init Terraform
        working-directory: ${{ inputs.tf-directory }}
        run: terraform init -no-color

      - name: Validate Terraform
        working-directory: ${{ inputs.tf-directory }}
        run: terraform validate

  tfsec:
    name: TFSec
    runs-on: ${{ inputs.run-label }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive
          token: ${{ secrets.PRIVATE_SUBMODULE_ACCESS_TOKEN || github.token }}

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

      - name: Cache Terraform data
        uses: actions/cache@v4
        with:
          path: ${{ inputs.tf-directory }}/.terraform
          key: terraform-${{ hashFiles('${{ inputs.tf-directory }}/.terraform.lock.hcl') }}

      - name: Init Terraform
        working-directory: ${{ inputs.tf-directory }}
        run: terraform init -no-color

      - uses: aquasecurity/tfsec-action@v1.0.3
        with:
          working_directory: ${{ inputs.tf-directory }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          additional_args: '--exclude aws-ecs-enable-container-insight'

  tflint:
    name: TFLint
    runs-on: ${{ inputs.run-label }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive
          token: ${{ secrets.PRIVATE_SUBMODULE_ACCESS_TOKEN || github.token }}

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

      - name: Cache Terraform data
        uses: actions/cache@v4
        with:
          path: ${{ inputs.tf-directory }}/.terraform
          key: terraform-${{ hashFiles('${{ inputs.tf-directory }}/.terraform.lock.hcl') }}

      - name: Init Terraform
        working-directory: ${{ inputs.tf-directory }}
        run: terraform init -no-color

      - name: Setup TFLint
        uses: terraform-linters/setup-tflint@v4
        with:
          tflint_version: v0.45.0

      - name: Cache `tflint` plugins
        uses: actions/cache@v4
        with:
          path: ~/.tflint.d/plugins
          key: tflint-${{ hashFiles('${{ inputs.tf-directory }}/.tflint.hcl') }}

      - name: Init TFLint
        run: tflint --init
        working-directory: ${{ inputs.tf-directory }}
        env:
          GITHUB_TOKEN: ${{ github.token }}

      - name: Check
        run: tflint --recursive --format=compact
        working-directory: ${{ inputs.tf-directory }}