Template infra deploy #5728954717 #50
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI Infra Checks | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - infra/** | |
| - .github/workflows/ci-infra.yml | |
| pull_request: | |
| paths: | |
| - infra/** | |
| - test/** | |
| - .github/workflows/ci-infra.yml | |
| jobs: | |
| check-terraform-format: | |
| name: Check Terraform format | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - uses: hashicorp/setup-terraform@v2 | |
| with: | |
| terraform_version: 1.4.6 | |
| terraform_wrapper: false | |
| - name: Run infra-lint | |
| run: | | |
| echo "If this fails, run 'make infra-format'" | |
| make infra-lint | |
| validate-terraform: | |
| name: Validate Terraform modules | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - uses: hashicorp/setup-terraform@v2 | |
| with: | |
| terraform_version: 1.4.6 | |
| terraform_wrapper: false | |
| - name: Run infra-validate | |
| run: make infra-validate | |
| check-compliance-with-checkov: | |
| name: Check compliance with checkov | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - uses: actions/setup-python@v4 | |
| with: | |
| python-version: "3.10" | |
| - name: Run Checkov check | |
| # Pin to specific checkov version rather than running from checkov@master | |
| # since checkov frequently adds new checks that can cause CI checks to fail unpredictably. | |
| # There is currently no way to specify the checkov version to pin to (See https://github.com/bridgecrewio/checkov-action/issues/41) | |
| # so we need to pin the version of the checkov-action, which indirectly pins the checkov version. | |
| # In this case, checkov-action v12.2296.0 is mapped to checkov v2.3.194. | |
| uses: bridgecrewio/[email protected] | |
| with: | |
| directory: infra | |
| framework: terraform | |
| check-compliance-with-tfsec: | |
| name: Check compliance with tfsec | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - name: Run tfsec check | |
| uses: aquasecurity/[email protected] | |
| with: | |
| github_token: ${{ github.token }} | |
| infra-test-e2e: | |
| name: End-to-end tests | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - uses: hashicorp/setup-terraform@v2 | |
| with: | |
| terraform_version: 1.2.1 | |
| terraform_wrapper: false | |
| - uses: actions/setup-go@v3 | |
| with: | |
| go-version: ">=1.19.0" | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@v1 | |
| with: | |
| role-to-assume: arn:aws:iam::327446564135:role/platform-nextjs-github-actions | |
| aws-region: us-east-1 | |
| - name: Run Terratest | |
| run: make infra-test |