terraform/.github/workflows/precommit.yaml at master · pipetail/terraform · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
---
name: precommit

on: [pull_request]

permissions: read-all

jobs:
  precommit:
    runs-on: ubuntu-latest
    name: Run pre-commit checks
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0

      - name: Install Dependencies
        run: |
          sudo apt update
          sudo apt install -y python3 python3-pip curl unzip
          # tflint
          curl -sSLo ./tflint.zip \
            https://github.com/terraform-linters/tflint/releases/download/v0.60.0/tflint_linux_amd64.zip
          unzip ./tflint.zip
          chmod +x ./tflint
          sudo mv tflint /usr/local/bin/tflint

          # terraform
          curl -sSLo ./terraform.zip \
            https://releases.hashicorp.com/terraform/1.14.4/terraform_1.14.4_linux_amd64.zip
          sudo unzip -o ./terraform.zip -d /usr/local/bin/
          sudo chmod +x /usr/local/bin/terraform

          # terraform-docs
          curl -sSLo ./terraform-docs.tar.gz \
            https://terraform-docs.io/dl/v0.21.0/terraform-docs-v0.21.0-$(uname)-amd64.tar.gz
          tar -xzf ./terraform-docs.tar.gz
          chmod +x ./terraform-docs
          sudo mv ./terraform-docs /usr/local/bin/terraform-docs

          # shfmt
          curl -sSLo ./shfmt \
            https://github.com/mvdan/sh/releases/download/v3.12.0/shfmt_v3.12.0_linux_amd64
          chmod +x ./shfmt
          sudo mv ./shfmt /usr/local/bin/shfmt

          # conftest
          curl -sSLo ./conftest.tar.gz \
            https://github.com/open-policy-agent/conftest/releases/download/v0.66.0/conftest_0.66.0_Linux_x86_64.tar.gz
          tar -xzf ./conftest.tar.gz conftest
          chmod +x ./conftest
          sudo mv ./conftest /usr/local/bin/conftest

          # opa
          curl -sSLo ./opa \
            https://github.com/open-policy-agent/opa/releases/download/v1.13.2/opa_linux_amd64_static
          chmod +x ./opa
          sudo mv ./opa /usr/local/bin/opa

          pip install pre-commit
          pip install checkov==3.2.500


      - name: pre-commit run
        run: |
          # this path is needed for pre-commit
          export PATH="~/.local/bin:$PATH"

          tflint --init --config .tflint.hcl
          pre-commit run \
            --show-diff-on-failure \
            --from-ref origin/${GITHUB_BASE_REF} \
            --to-ref HEAD