diff --git a/.github/workflows/tfsec.yml b/.github/workflows/tfsec.yml deleted file mode 100644 index 1e55427..0000000 --- a/.github/workflows/tfsec.yml +++ /dev/null @@ -1,107 +0,0 @@ -name: tfsec-security-scan - -on: - workflow_call: - inputs: - minimum_severity: - description: 'Minimum severity level to report (CRITICAL, HIGH, MEDIUM, LOW)' - required: false - type: string - default: 'HIGH' - upload_sarif: - description: 'Upload SARIF results to GitHub Security tab' - required: false - type: boolean - default: true - post_comment: - description: 'Post comment on PR if scan fails' - required: false - type: boolean - default: true - -jobs: - tfsec: - name: tfsec Security Scan - runs-on: ubuntu-24.04 - permissions: - contents: read - pull-requests: write - security-events: write - env: - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true - steps: - - name: Checkout - uses: actions/checkout@v6 - - - name: Find Terraform files - id: modules - run: | - DIRS=$(find . -name "*.tf" -not -path "./.terraform/*" -exec dirname {} \; | sort -u | tr '\n' ' ') - - if [ -z "$DIRS" ]; then - echo "No Terraform files found" - echo "has_tf_files=false" >> "$GITHUB_OUTPUT" - exit 0 - fi - - echo "Found directories: $DIRS" - echo "has_tf_files=true" >> "$GITHUB_OUTPUT" - echo "dirs=$DIRS" >> "$GITHUB_OUTPUT" - - - name: Install tfsec - if: steps.modules.outputs.has_tf_files == 'true' - run: | - curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash - tfsec --version - - - name: Run tfsec - if: steps.modules.outputs.has_tf_files == 'true' - id: tfsec - run: | - EXIT_CODE=0 - for dir in ${{ steps.modules.outputs.dirs }}; do - echo "::group::Scanning $dir" - if ! tfsec "$dir" --format lovely --minimum-severity ${{ inputs.minimum_severity }}; then - EXIT_CODE=1 - fi - echo "::endgroup::" - done - echo "exit_code=$EXIT_CODE" >> "$GITHUB_OUTPUT" - continue-on-error: true - - - name: Generate SARIF report - if: steps.modules.outputs.has_tf_files == 'true' && inputs.upload_sarif - run: | - tfsec . --format sarif --soft-fail --out results.sarif \ - --exclude-path .terraform \ - --exclude-path node_modules || true - - - name: Upload SARIF file - if: steps.modules.outputs.has_tf_files == 'true' && inputs.upload_sarif && hashFiles('results.sarif') != '' - uses: github/codeql-action/upload-sarif@v4 - with: - sarif_file: results.sarif - category: tfsec - continue-on-error: true - - - name: Post failure comment - if: steps.tfsec.outputs.exit_code == '1' && inputs.post_comment && github.event_name == 'pull_request' - uses: actions/github-script@v9 - with: - script: | - github.rest.issues.createComment({ - issue_number: context.issue.number, - owner: context.repo.owner, - repo: context.repo.repo, - body: `## Security Scan Failed - - tfsec found security issues with **${{ inputs.minimum_severity }}** or higher severity. - - Please review the workflow logs and fix the issues before merging. - - [View Details](${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId})` - }) - - - name: Fail if issues found - if: steps.tfsec.outputs.exit_code == '1' - run: exit 1