terraform-terrascan-pipeline.yml

trigger: none

pool:
  vmImage: 'ubuntu-latest'

stages:
- stage: QualityCheckStage
  displayName: Quality Check Stage
  jobs:
    - job: TerraScanJob
      displayName: Run TerraScan Scan
      steps:
      - script: | 
          mkdir TerraScanReport
          docker pull accurics/terrascan
          docker run --rm --volume $(System.DefaultWorkingDirectory)/terraform/azure:/iac --workdir /iac accurics/terrascan:latest scan --iac-type terraform --policy-type all --verbose --output xml > $(System.DefaultWorkingDirectory)/TerraScanReport/TerraScan-Report.xml
          docker run --rm --volume $(System.DefaultWorkingDirectory)/terraform/azure:/iac --workdir /iac accurics/terrascan:latest scan --iac-type terraform --policy-type all --verbose
        displayName: 'Accurics TerraScan Code Analysis'
      
      - script: |
          cd $(System.DefaultWorkingDirectory)/TerraScanReport
          ls -la
        displayName: 'DIR Contents'
        condition: always()
      
      # Publish the TerraScan report as an artifact to Azure Pipelines
      - task: PublishBuildArtifacts@1
        displayName: 'Publish Artifact: Terrascan Report'
        condition: succeededOrFailed()
        inputs:
          PathtoPublish: '$(System.DefaultWorkingDirectory)/TerraScanReport'
          ArtifactName: TerrascanReport

      - task: PublishTestResults@2
        displayName: Publish Terrascan Test Results
        condition: succeededOrFailed()
        inputs:
          testResultsFormat: 'JUnit' # Options JUnit, NUnit, VSTest, xUnit, cTest
          testResultsFiles: '**/*TerraScan-Report.xml'
          searchFolder: '$(System.DefaultWorkingDirectory)/TerraScanReport'
          mergeTestResults: false
          testRunTitle: Terrascan Scan
          failTaskOnFailedTests: false
          publishRunAttachments: true