docs: Updated submodules and improved formatting. (#27) #3
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Main Checks | |
| on: | |
| push: | |
| branches: | |
| - main | |
| jobs: | |
| find-modules: | |
| name: Find updated modules | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout source code | |
| uses: actions/checkout@v4 | |
| - name: Find all terraform modules | |
| id: find | |
| uses: bendrucker/find-terraform-modules@v1 | |
| - name: Show all matching modules | |
| shell: bash | |
| run: | | |
| mods=(${{ join(fromJSON(steps.find.outputs.modules), ' ') }}) | |
| printf "%s\n" "${mods[@]}" | |
| - name: Find all changed fiiles | |
| id: diff | |
| uses: technote-space/get-diff-action@v6 | |
| with: | |
| FORMAT: json | |
| - name: Show changed files | |
| run: | | |
| echo "${{ steps.diff.outputs.diff }}" | |
| - name: Get the modified modules | |
| id: modified | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const modules = ${{ steps.find.outputs.modules }} | |
| const diff = ${{ steps.diff.outputs.diff }} | |
| const modifiedModules = modules.filter( | |
| (module) => { | |
| return !!diff.find(file => new RegExp(`^${module}/.+`).test(file)) | |
| } | |
| ) | |
| core.setOutput('modules', modifiedModules) | |
| - name: Show modified modules | |
| run: | | |
| echo "${{ steps.modified.outputs.modules }}" | |
| outputs: | |
| modules: ${{ steps.modified.outputs.modules }} | |
| lint: | |
| name: Lint updated modules | |
| runs-on: ubuntu-latest | |
| needs: find-modules | |
| steps: | |
| - name: Checkout source code | |
| uses: actions/checkout@v4 | |
| - uses: actions/cache@v4 | |
| name: Cache plugin directory | |
| with: | |
| path: ~/.tflint.d/plugins | |
| key: tflint-${{ hashFiles('.tflint.hcl') }} | |
| - uses: terraform-linters/setup-tflint@v4 | |
| name: Setup TFLint | |
| - name: Show version | |
| run: tflint --version | |
| - name: Init TFLint | |
| run: tflint --init | |
| # Use a bash script to run tflint on each modified module. | |
| - name: Run TFLint | |
| shell: bash | |
| run: | | |
| set +e | |
| exit_code=0 | |
| modules=(${{ join(fromJSON(needs.find-modules.outputs.modules), ' ') }}) | |
| for module in ${modules[@]} | |
| do | |
| echo "Linting module $module" | |
| tflint --format compact --chdir $module | |
| exit_code=$(( $? > exit_code ? $? : exit_code )) | |
| done | |
| exit $exit_code | |
| trivy: | |
| name: Run security scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout source code | |
| uses: actions/checkout@v4 | |
| - name: Run Trivy vulnarability scanner | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| scan-type: config | |
| format: sarif | |
| output: "trivy-results.sarif" | |
| - name: Upload SARIF result | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: "trivy-results.sarif" |