do stuff for cdk

Author: anthony-nhs

.github/workflows/quality-checks.yml

@@ -114,35 +114,54 @@ jobs:
             node_modules
             .git
 
-      - name: Check for CloudFormation templates
-        id: check_cfn_templates
+      - name: Check for SAM templates
+        id: check_sam_templates
         run: |
-          if [ -d "cloudformation" ] || [ -d "SAMtemplates" ]; then
-            echo "exists=true" >> $GITHUB_OUTPUT
+          if [ -d "SAMtemplates" ]; then
+            echo "sam_exists=true" >> $GITHUB_OUTPUT
           else
-            echo "exists=false" >> $GITHUB_OUTPUT
+            echo "sam_exists=false" >> $GITHUB_OUTPUT
           fi
 
-      - name: Install cfn-lint
-        if: steps.check_cfn_templates.outputs.exists == 'true'
-        run: pip install cfn-lint
+      - name: Check for cloudformation templates
+        id: check_cf_templates
+        run: |
+          if [ -d "cloudformation" ]; then
+            echo "cf_exists=true" >> $GITHUB_OUTPUT
+          else
+            echo "cf_exists=false" >> $GITHUB_OUTPUT
+          fi
+  
+      - name: Check for cdk
+        id: check_cdk
+        run: |
+          if [ -d "packages/cdk" ]; then
+            echo "cdk_exists=true" >> $GITHUB_OUTPUT
+          else
+            echo "cdk_exists=false" >> $GITHUB_OUTPUT
+          fi
 
       - name: Run cfn-lint
-        if: steps.check_cfn_templates.outputs.exists == 'true'
+        if: steps.check_sam_templates.outputs.exists == 'true' || steps.check_cf_templates.outputs.exists == 'true'
         run: |
+          pip install cfn-lint
           cfn-lint -I "cloudformation/**/*.y*ml" 2>&1 | awk '/Run scan/ { print } /^[EW][0-9]/ { print; getline; print }'
           cfn-lint -I "SAMtemplates/**/*.y*ml" 2>&1 | awk '/Run scan/ { print } /^[EW][0-9]/ { print; getline; print }'
 
       - name: Run unit tests
         run: make test
-
+  
+      - name: Run cdk-synth
+        if: steps.check_cdk.outputs.exists == 'true'
+        run: |
+          make cdk-synth
+  
       - name: Install AWS SAM CLI
-        if: steps.check_cfn_templates.outputs.exists == 'true'
+        if: steps.check_sam_templates.outputs.exists == 'true'
         run: |
           pip install aws-sam-cli
 
-      - name: Run cfn-guard script
-        if: steps.check_cfn_templates.outputs.exists == 'true'
+      - name: Init cfn-guard
         run: |
           #!/usr/bin/env bash
           set -eou pipefail
@@ -157,6 +176,12 @@ jobs:
 
           mkdir -p cfn_guard_output
 
+      - name: Run cfn-guard script for sam templates
+        if: steps.check_sam_templates.outputs.exists == 'true'
+        run: |
+          #!/usr/bin/env bash
+          set -eou pipefail
+
           declare -a rulesets=("ncsc" "ncsc-cafv3" "wa-Reliability-Pillar" "wa-Security-Pillar")
           for ruleset in "${rulesets[@]}"
           do
@@ -176,7 +201,39 @@ jobs:
             done < <(find ./SAMtemplates -name '*.y*ml' -print0)
           done
 
-          rm -rf /tmp/ruleset
+      - name: Run cfn-guard script for cloudformation templates
+        if: steps.check_cf_templates.outputs.exists == 'true'
+        run: |
+          #!/usr/bin/env bash
+
+          declare -a rulesets=("ncsc" "ncsc-cafv3" "wa-Reliability-Pillar" "wa-Security-Pillar")
+          for ruleset in "${rulesets[@]}"
+          do
+            echo "Checking all templates in cloudformation folder with ruleest $ruleset"
+
+            ~/.guard/bin/cfn-guard validate \
+                --data cloudformation \
+                    --rules "/tmp/ruleset/output/$ruleset.guard" \
+                --show-summary fail \
+                > "cfn_guard_output/cloudformation_$ruleset.txt"
+          done
+
+      - name: Run cfn-guard script for cdk templates
+        if: steps.check_cdk.outputs.exists == 'true'
+        run: |
+          #!/usr/bin/env bash
+
+          declare -a rulesets=("ncsc" "ncsc-cafv3" "wa-Reliability-Pillar" "wa-Security-Pillar")
+          for ruleset in "${rulesets[@]}"
+          do
+            echo "Checking all templates in cdk.out folder with ruleest $ruleset"
+
+            ~/.guard/bin/cfn-guard validate \
+                --data cdk.out \
+                    --rules "/tmp/ruleset/output/$ruleset.guard" \
+                --show-summary fail \
+                > "cfn_guard_output/cdk.out_$ruleset.txt"
+          done
 
       - name: Show cfn-guard output
         if: failure()