Skip to content

Commit fac6cf9

Browse files
jamesthompson26-nhsjamesthompson26-nhs
authored
Merge pull request #39 from NHSDigital/feature/CCM-6245_TFSec_Scanning
Feature/CCM-6245 TFSec scanning
2 parents 437e1a4 + c6ab5db commit fac6cf9

File tree

8 files changed

+217
-1
lines changed

8 files changed

+217
-1
lines changed

‎.github/actions/setup/action.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
name: Make Config Action
2+
description: Install dependencies and execute make config
3+
4+
runs:
5+
using: composite
6+
steps:
7+
- name: Install dependencies and execute make config
8+
shell: bash
9+
run: |
10+
scripts/setup/setup.sh

‎.github/actions/tfsec/action.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
name: "TFSec Scan"
2+
description: "Scan HCL using TFSec"
3+
runs:
4+
using: "composite"
5+
steps:
6+
- name: "TFSec Scan - Components"
7+
shell: bash
8+
run: |
9+
for component in $(find infrastructure/terraform/components -mindepth 1 -type d); do
10+
scripts/terraform/tfsec.sh $component
11+
done
12+
- name: "TFSec Scan - Modules"
13+
shell: bash
14+
run: |
15+
for module in $(find infrastructure/terraform/modules -mindepth 1 -type d); do
16+
scripts/terraform/tfsec.sh $module
17+
done

‎.github/workflows/stage-1-commit.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,15 +77,55 @@ jobs:
7777
fetch-depth: 0 # Full history is needed to compare branches
7878
- name: "Check English usage"
7979
uses: ./.github/actions/check-english-usage
80+
detect-terraform-changes:
81+
name: "Detect Terraform Changes"
82+
runs-on: ubuntu-latest
83+
outputs:
84+
terraform_changed: ${{ steps.check.outputs.terraform_changed }}
85+
steps:
86+
- name: "Checkout code"
87+
uses: actions/checkout@v4
88+
89+
- name: "Check for Terraform changes"
90+
id: check
91+
run: |
92+
git fetch origin main || true # Ensure you have the latest main branch
93+
CHANGED_FILES=$(git diff --name-only HEAD origin/main)
94+
echo "Changed files: $CHANGED_FILES"
95+
96+
if echo "$CHANGED_FILES" | grep -qE '\.tf$'; then
97+
echo "Terraform files have changed."
98+
echo "terraform_changed=true" >> $GITHUB_OUTPUT
99+
else
100+
echo "No Terraform changes detected."
101+
echo "terraform_changed=false" >> $GITHUB_OUTPUT
102+
fi
80103
lint-terraform:
81104
name: "Lint Terraform"
82105
runs-on: ubuntu-latest
83106
timeout-minutes: 2
107+
needs: detect-terraform-changes
108+
if: needs.detect-terraform-changes.outputs.terraform_changed == 'true'
84109
steps:
85110
- name: "Checkout code"
86111
uses: actions/checkout@v4
87112
- name: "Lint Terraform"
88113
uses: ./.github/actions/lint-terraform
114+
tfsec:
115+
name: "TFSec Scan"
116+
runs-on: ubuntu-latest
117+
timeout-minutes: 5
118+
needs: detect-terraform-changes
119+
if: needs.detect-terraform-changes.outputs.terraform_changed == 'true'
120+
steps:
121+
- name: "Checkout code"
122+
uses: actions/checkout@v4
123+
- name: "Setup ASDF"
124+
uses: asdf-vm/actions/setup@v3
125+
- name: "Perform Setup"
126+
uses: ./.github/actions/setup
127+
- name: "TFSec Scan"
128+
uses: ./.github/actions/tfsec
89129
count-lines-of-code:
90130
name: "Count lines of code"
91131
runs-on: ubuntu-latest

‎.tool-versions‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ terraform 1.9.1
44
pre-commit 3.6.0
55
nodejs 18.18.2
66
gitleaks 8.18.4
7+
tfsec 1.28.10
78

89
# ==============================================================================
910
# The section below is reserved for Docker image versions.

‎.vscode/settings.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
"**/CVS": true,
1010
"**/Thumbs.db": true,
1111
".devcontainer": true,
12-
".github": true,
12+
".github": false,
1313
".vscode": false
1414
}
1515
}

‎scripts/config/tfsec.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
---
2+
minimum_severity: MEDIUM

‎scripts/setup/setup.sh‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
#!/usr/bin/env bash
2+
3+
# WARNING: Please DO NOT edit this file! It is maintained in the Repository Template (https://github.com/NHSDigital/nhs-notify-repository-template). Raise a PR instead.
4+
5+
set -euo pipefail
6+
7+
# Pre-Install dependencies and run make config on Github Runner.
8+
#
9+
# Usage:
10+
# $ ./setup.sh
11+
# ==============================================================================
12+
13+
function main() {
14+
15+
cd "$(git rev-parse --show-toplevel)"
16+
17+
run-setup
18+
}
19+
20+
function run-setup() {
21+
22+
sudo apt install bundler -y
23+
time make config
24+
25+
check-setup-status
26+
}
27+
28+
# Check the exit status of tfsec.
29+
function check-setup-status() {
30+
31+
if [ $? -eq 0 ]; then
32+
echo "Setup completed successfully."
33+
else
34+
echo "Setup was unsuccessful."
35+
exit 1
36+
fi
37+
}
38+
39+
# ==============================================================================
40+
41+
main "$@"
42+
43+
exit 0

‎scripts/terraform/tfsec.sh‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
#!/usr/bin/env bash
2+
3+
# WARNING: Please DO NOT edit this file! It is maintained in the Repository Template (https://github.com/NHSDigital/nhs-notify-repository-template). Raise a PR instead.
4+
5+
set -euo pipefail
6+
7+
# TFSec command wrapper. It will run the command natively if TFSec is
8+
# installed, otherwise it will run it in a Docker container.
9+
# Run tfsec for security checks on Terraform code.
10+
#
11+
# Usage:
12+
# $ ./tfsec.sh [directory]
13+
# ==============================================================================
14+
15+
function main() {
16+
17+
cd "$(git rev-parse --show-toplevel)"
18+
19+
local dir_to_scan=${1:-.}
20+
21+
if command -v tfsec > /dev/null 2>&1 && ! is-arg-true "${FORCE_USE_DOCKER:-false}"; then
22+
# shellcheck disable=SC2154
23+
run-tfsec-natively "$dir_to_scan"
24+
else
25+
run-tfsec-in-docker "$dir_to_scan"
26+
fi
27+
}
28+
29+
# Run tfsec on the specified directory.
30+
# Arguments:
31+
# $1 - Directory to scan
32+
function run-tfsec-natively() {
33+
34+
local dir_to_scan="$1"
35+
36+
echo "TFSec found locally, running natively"
37+
38+
echo "Running TFSec on directory: $dir_to_scan"
39+
tfsec \
40+
--concise-output \
41+
--force-all-dirs \
42+
--exclude-downloaded-modules \
43+
--config-file scripts/config/tfsec.yaml \
44+
--format text \
45+
--soft-fail \
46+
"$dir_to_scan"
47+
48+
check-tfsec-status
49+
}
50+
51+
# Check the exit status of tfsec.
52+
function check-tfsec-status() {
53+
54+
if [ $? -eq 0 ]; then
55+
echo "TFSec completed successfully."
56+
else
57+
echo "TFSec found issues."
58+
exit 1
59+
fi
60+
}
61+
62+
function run-tfsec-in-docker() {
63+
64+
# shellcheck disable=SC1091
65+
source ./scripts/docker/docker.lib.sh
66+
local dir_to_scan="$1"
67+
68+
# shellcheck disable=SC2155
69+
local image=$(name=aquasec/tfsec docker-get-image-version-and-pull)
70+
# shellcheck disable=SC2086
71+
echo "TFSec not found locally, running in Docker Container"
72+
echo "Running TFSec on directory: $dir_to_scan"
73+
docker run --rm --platform linux/amd64 \
74+
--volume "$PWD":/workdir \
75+
--workdir /workdir \
76+
"$image" \
77+
--concise-output \
78+
--force-all-dirs \
79+
--exclude-downloaded-modules \
80+
--config-file scripts/config/tfsec.yaml \
81+
--format text \
82+
--soft-fail \
83+
"$dir_to_scan"
84+
check-tfsec-status
85+
}
86+
# ==============================================================================
87+
88+
function is-arg-true() {
89+
90+
if [[ "$1" =~ ^(true|yes|y|on|1|TRUE|YES|Y|ON)$ ]]; then
91+
return 0
92+
else
93+
return 1
94+
fi
95+
}
96+
97+
# ==============================================================================
98+
99+
is-arg-true "${VERBOSE:-false}" && set -x
100+
101+
main "$@"
102+
103+
exit 0

0 commit comments

Comments
 (0)