reusable_tf_checks.yml

on:
  workflow_call:
    inputs:
      checks_enabled:
        type: string
        default: '["tf_fmt", "trivy_config_scan", "tflint", "terraform_docs"]'
      working_directory:
        type: string
        default: "./"
        description: Working directory for the checks to run in
      tf_fmt_args:
        type: string
        default: -recursive -check -diff
        description: Arguments to pass to "terraform fmt"
      trivy_skip_dirs:
        type: string
        default: ""
        description: Comma separated list of directories where traversal is skipped
      tflint_config:
        type: string
        default: .tflint.hcl
        description: TFLint config file path
      tflint_args:
        type: string
        default: --recursive --color
        description: Arguments to pass to "tflint"

jobs:
  tf_fmt:
    name: run terraform fmt
    runs-on: ubuntu-latest
    if: ${{ contains(fromJson(inputs.checks_enabled), 'tf_fmt') }}
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Setup terraform
        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
      - name: Run terraform fmt
        env:
          ARGS: ${{ inputs.tf_fmt_args }}
          WORKING_DIRECTORY: ${{ inputs.working_directory }}
        run: |
          terraform fmt ${ARGS} "${WORKING_DIRECTORY}"

  trivy_config_scan:
    name: run trivy config scan
    runs-on: ubuntu-latest
    if: ${{ contains(fromJson(inputs.checks_enabled), 'trivy_config_scan') }}
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Run trivy config scan
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          github-pat: ${{ secrets.GITHUB_TOKEN }}
          scan-type: config
          scan-ref: ${{ inputs.working_directory }}
          skip-dirs: ${{ inputs.trivy_skip_dirs }}
          exit-code: '1'
          format: table

  tflint:
    name: run tflint
    runs-on: ubuntu-latest
    if: ${{ contains(fromJson(inputs.checks_enabled), 'tflint') }}
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        name: Cache plugin dir
        with:
          path: ~/.tflint.d/plugins
          key: tflint-${{ hashFiles('.tflint.hcl') }}
      - uses: terraform-linters/setup-tflint@b480b8fcdaa6f2c577f8e4fa799e89e756bb7c93 # v6.2.2
        name: Setup TFLint
        with:
          tflint_version: latest
      - name: Init TFLint
        env:
          CONFIG: ${{ inputs.tflint_config }}
        run: |
          tflint --init -c "${GITHUB_WORKSPACE}/${CONFIG}"
      - name: Run TFLint
        env:
          CONFIG: ${{ inputs.tflint_config }}
          ARGS: ${{ inputs.tflint_args }}
        run: |
          tflint -c "${GITHUB_WORKSPACE}/${CONFIG}" ${ARGS}

  terraform_docs:
    name: run terraform-docs
    runs-on: ubuntu-latest
    if: ${{ contains(fromJson(inputs.checks_enabled), 'terraform_docs') }}
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0
      - name: Validate terraform docs are present and valid
        uses: terraform-docs/gh-actions@6de6da0cefcc6b4b7a5cbea4d79d97060733093c # v1.4.1
        with:
          find-dir: ${{ inputs.working_directory }}
          fail-on-diff: true
      - name: List README.md diff files
        if: ${{ failure() }}
        run: |
          git status
          echo "## run terraform-docs failure" >> $GITHUB_STEP_SUMMARY
          echo "### Newly generated or changed README.md files" >> $GITHUB_STEP_SUMMARY
          echo "There should be no new files generated by terraform-docs" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          git status >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY