Enable annotations for Terraform CI

Author: rusets

.github/workflows/terraform-ci.yml

@@ -12,6 +12,7 @@ on:
 permissions:
   contents: read
   pull-requests: write
+  security-events: write
 
 jobs:
   terraform-ci:
@@ -51,22 +52,39 @@ jobs:
         with:
           tflint_version: latest
 
-      - name: Run TFLint
-        run: tflint --recursive
-        working-directory: infra
+      - name: Run TFLint (with annotations)
+        uses: terraform-linters/tflint-pr-commenter-action@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          tflint_command: "tflint --recursive"
+          directory: "infra"
 
-      - name: Run tfsec
+      - name: Run tfsec (SARIF)
         uses: aquasecurity/tfsec-action@v1.0.3
         with:
           working_directory: infra
           github_token: ${{ secrets.GITHUB_TOKEN }}
+          format: sarif
+          output_file: tfsec.sarif
+
+      - name: Upload tfsec SARIF
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: tfsec.sarif
 
-      - name: Run Checkov
+      - name: Run Checkov (SARIF)
         uses: bridgecrewio/checkov-action@v12
         with:
           directory: infra
           config_file: .checkov.yml
           quiet: true
+          output_format: sarif
+          output_file_path: checkov.sarif
+
+      - name: Upload Checkov SARIF
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: checkov.sarif
 
       - name: Publish Terraform CI summary
         if: ${{ success() }}
@@ -108,28 +126,3 @@ jobs:
                 body
               });
             }
-
-      - name: Comment on PR with Terraform CI result
-        if: always()
-        uses: actions/github-script@v7
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const conclusion = '${{ job.status }}';
-            const symbols = { success: '✅', failure: '❌', cancelled: '⚪️' };
-            const symbol = symbols[conclusion] || 'ℹ️';
-            const body =
-              `${symbol} Terraform CI finished with status: **${conclusion}**\n\n` +
-              `Terraform versions tested: 1.6.6, 1.8.5, 1.9.5.\n` +
-              `See detailed results in the "Checks" tab.`;
-            const pr = context.payload.pull_request;
-            if (!pr) {
-              core.info('No pull_request context, skipping comment.');
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: pr.number,
-                body
-              });
-            }