@@ -24,7 +24,7 @@ permissions:
2424 security-events : write
2525 pull-requests : write # Allow workflow to comment on PRs
2626 id-token : write # Needed for OIDC Authentication
27-
27+
2828# Global environment variables
2929env :
3030 ERROR_HANDLING : true # Enable enhanced error handling
5353 timeout-minutes : 60
5454 needs : check-dependabot
5555 # Run for all PRs but handle Dependabot PRs specially
56-
56+
5757 steps :
5858 - name : Checkout code
5959 uses : actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
6464 uses : actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
6565 with :
6666 node-version : ' 18.x'
67-
67+
6868 - name : Setup Terraform
6969 uses : hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
7070 with :
@@ -85,57 +85,57 @@ jobs:
8585 id : tf-fmt
8686 run : |
8787 echo "Checking Terraform formatting..."
88-
88+
8989 # Capture files that need formatting
9090 FMT_OUTPUT=$(terraform fmt -check -recursive -diff 2>&1) || FMT_EXIT=$?
91-
91+
9292 if [ "${FMT_EXIT:-0}" -ne 0 ]; then
9393 echo "::error::Terraform format check failed! Run 'terraform fmt -recursive' locally to fix formatting issues."
94-
94+
9595 # Always show which files need formatting
9696 echo ""
9797 echo "Files that need formatting:"
9898 terraform fmt -check -recursive 2>&1 | grep -v "^$" || true
99-
99+
100100 # Show diff in debug mode or if requested
101101 if [ "${{ github.event.inputs.debug }}" == "true" ] || [ "${{ env.ERROR_HANDLING }}" == "true" ]; then
102102 echo ""
103103 echo "Formatting differences:"
104104 echo "$FMT_OUTPUT"
105105 fi
106-
106+
107107 exit 1
108108 fi
109-
109+
110110 echo "All Terraform files are properly formatted."
111111 working-directory : ./infra
112112
113113 - name : Terraform Validate
114114 id : tf-validate
115115 run : |
116116 echo "Validating Terraform configuration..."
117-
117+
118118 # Run validation and capture both JSON and exit code
119119 terraform validate -json > validation_result.json 2>&1 || VALIDATE_EXIT=$?
120-
120+
121121 if [ "${VALIDATE_EXIT:-0}" -ne 0 ]; then
122122 echo "::error::Terraform validation failed! Check your Terraform files for errors."
123-
123+
124124 # Always show validation errors in a readable format
125125 echo ""
126126 echo "Validation errors:"
127127 cat validation_result.json | jq -r '.diagnostics[]? | "- [\(.severity | ascii_upcase)] \(.summary): \(.detail)"' 2>/dev/null || cat validation_result.json
128-
128+
129129 # Show full JSON output in debug mode
130130 if [ "${{ github.event.inputs.debug }}" == "true" ]; then
131131 echo ""
132132 echo "Full validation output:"
133133 cat validation_result.json | jq '.' 2>/dev/null || cat validation_result.json
134134 fi
135-
135+
136136 exit 1
137137 fi
138-
138+
139139 echo "Terraform configuration is valid."
140140 working-directory : ./infra
141141
@@ -160,36 +160,34 @@ jobs:
160160 id : tflint-run
161161 run : |
162162 echo "Running TFLint..."
163-
163+
164164 # Run TFLint and capture output
165165 tflint --format=json --force > tflint_result.json 2>&1 || TFLINT_EXIT=$?
166-
166+
167167 if [ "${TFLINT_EXIT:-0}" -ne 0 ]; then
168168 echo "::error::TFLint found issues in your Terraform configuration!"
169-
169+
170170 # Always show formatted errors
171171 echo ""
172172 echo "TFLint issues found:"
173173 cat tflint_result.json | jq -r '.issues[]? | "- [\(.severity | ascii_upcase)] \(.rule.name) in \(.range.filename):\(.range.start.line): \(.message)"' 2>/dev/null || echo "Failed to parse TFLint output"
174-
174+
175175 # Show full JSON output in debug mode
176176 if [ "${{ github.event.inputs.debug }}" == "true" ]; then
177177 echo ""
178178 echo "Full TFLint output:"
179179 cat tflint_result.json | jq '.' 2>/dev/null || cat tflint_result.json
180180 fi
181-
181+
182182 # Also create GitHub annotations for issues
183183 cat tflint_result.json | jq -r '.issues[]? | "::error file=\(.range.filename),line=\(.range.start.line),col=\(.range.start.column)::\(.message)"' 2>/dev/null || true
184-
184+
185185 exit 1
186186 fi
187-
187+
188188 echo "TFLint completed successfully with no issues."
189189 working-directory : ./infra
190190
191-
192-
193191 - name : Install GitLeaks
194192 run : |
195193 curl -sSL https://github.com/gitleaks/gitleaks/releases/download/v8.28.0/gitleaks_8.28.0_linux_x64.tar.gz -o gitleaks.tar.gz
@@ -226,7 +224,7 @@ jobs:
226224 - name : Run Checkov action
227225 id : checkov
228226 uses : bridgecrewio/checkov-action@de3c276ef8118f7ce6bcb2e51d8dd3d65ac0ae36 # v12.1347.0
229- with :
227+ with :
230228 framework : terraform
231229 download_external_modules : true
232230 directory : ./infra
@@ -244,65 +242,65 @@ jobs:
244242 category : checkov
245243 wait-for-processing : true # Wait for processing to complete before proceeding
246244
247-
248-
245+
246+
249247 - name : Summary
250248 if : always() # Always run this step
251249 run : |
252250 echo "## Terraform Validation Results :clipboard:" >> $GITHUB_STEP_SUMMARY
253251 echo "" >> $GITHUB_STEP_SUMMARY
254-
252+
255253 # Show debug mode status if enabled
256254 if [ "${{ github.event.inputs.debug }}" == "true" ]; then
257255 echo "🔍 **Debug Mode**: Enabled (verbose output shown)" >> $GITHUB_STEP_SUMMARY
258256 echo "" >> $GITHUB_STEP_SUMMARY
259257 fi
260-
258+
261259 # Check Terraform Init
262260 if [ "${{ steps.tf-init.outcome }}" == "success" ]; then
263261 echo "✅ **Terraform Init**: Passed" >> $GITHUB_STEP_SUMMARY
264262 else
265263 echo "❌ **Terraform Init**: Failed" >> $GITHUB_STEP_SUMMARY
266264 fi
267-
265+
268266 # Check Terraform Format
269267 if [ "${{ steps.tf-fmt.outcome }}" == "success" ]; then
270268 echo "✅ **Terraform Format**: Passed" >> $GITHUB_STEP_SUMMARY
271269 else
272270 echo "❌ **Terraform Format**: Failed - Run 'terraform fmt -recursive' locally" >> $GITHUB_STEP_SUMMARY
273271 echo " - Check step logs for list of files that need formatting" >> $GITHUB_STEP_SUMMARY
274272 fi
275-
273+
276274 # Check Terraform Validate
277275 if [ "${{ steps.tf-validate.outcome }}" == "success" ]; then
278276 echo "✅ **Terraform Validate**: Passed" >> $GITHUB_STEP_SUMMARY
279277 else
280278 echo "❌ **Terraform Validate**: Failed - Check configuration files" >> $GITHUB_STEP_SUMMARY
281279 echo " - Check step logs for detailed validation errors" >> $GITHUB_STEP_SUMMARY
282280 fi
283-
281+
284282 # Check TFLint
285283 if [ "${{ steps.tflint-run.outcome }}" == "success" ]; then
286284 echo "✅ **TFLint**: Passed" >> $GITHUB_STEP_SUMMARY
287285 else
288286 echo "❌ **TFLint**: Failed - Review linting errors" >> $GITHUB_STEP_SUMMARY
289287 echo " - Check step logs for detailed linting issues" >> $GITHUB_STEP_SUMMARY
290288 fi
291-
289+
292290 # Check Checkov
293291 if [ "${{ steps.checkov.outcome }}" == "success" ]; then
294292 echo "✅ **Checkov Security Check**: Passed" >> $GITHUB_STEP_SUMMARY
295293 else
296294 echo "❌ **Checkov Security Check**: Failed - Security issues found" >> $GITHUB_STEP_SUMMARY
297295 fi
298-
296+
299297 # Check GitLeaks
300298 if [ "${{ steps.gitleaks.outcome }}" == "success" ]; then
301299 echo "✅ **GitLeaks Scan**: Passed" >> $GITHUB_STEP_SUMMARY
302300 else
303301 echo "❌ **GitLeaks Scan**: Failed - Sensitive information detected" >> $GITHUB_STEP_SUMMARY
304302 fi
305-
303+
306304 # Add help message if any checks failed
307305 if [ "${{ steps.tf-fmt.outcome }}" != "success" ] || \
308306 [ "${{ steps.tf-validate.outcome }}" != "success" ] || \
@@ -326,23 +324,23 @@ jobs:
326324 github-token : ${{ secrets.GITHUB_TOKEN }}
327325 script : |
328326 const prNumber = context.issue.number;
329-
327+
330328 await github.rest.issues.createComment({
331329 owner: context.repo.owner,
332330 repo: context.repo.repo,
333331 issue_number: prNumber,
334332 body: `## Terraform Validation Passed ✅
335-
333+
336334 The Terraform provider update has been validated with:
337335 - ✅ Terraform Init
338336 - ✅ Terraform Format Check
339337 - ✅ Terraform Validation
340338 - ✅ TFLint Check
341339 - ✅ Security Scanning
342-
340+
343341 This PR can pass all the checks to be tested and then merged.`
344342 });
345-
343+
346344 // Add 'terraform-validated' label to the PR
347345 await github.rest.issues.addLabels({
348346 owner: context.repo.owner,
@@ -363,22 +361,22 @@ jobs:
363361 github-token : ${{ secrets.GITHUB_TOKEN }}
364362 script : |
365363 const prNumber = context.issue.number;
366-
364+
367365 await github.rest.issues.createComment({
368366 owner: context.repo.owner,
369367 repo: context.repo.repo,
370368 issue_number: prNumber,
371369 body: `## ❌ Terraform Validation Failed
372-
370+
373371 The Terraform provider update has failed validation. Please check the workflow logs for details.
374-
372+
375373 This may indicate that the provider update is not compatible with the current configuration.`
376374 });
377-
375+
378376 // Add 'terraform-validation-failed' label to the PR
379377 await github.rest.issues.addLabels({
380378 owner: context.repo.owner,
381379 repo: context.repo.repo,
382380 issue_number: prNumber,
383381 labels: ['terraform-validation-failed']
384- });
382+ });
0 commit comments