checkov.yaml

name: Run Checkov static analysis on the template

on:
  pull_request:
    types: [opened, synchronize, reopened]
    paths:
      - "deploy/template.yaml"
jobs:
  RunCheckov:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
      - name: Set up Python 3.8
        uses: actions/setup-python@v6
        with:
          python-version: 3.8
      - name: install checkov
        run: pip3 install checkov
      - name: run checkov
        run: checkov --directory deploy
  RunSamValidate:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
      - uses: aws-actions/setup-sam@v2
        with:
          use-installer: true
      - run: sam validate -t deploy/template.yaml --region eu-west-2 --lint