gitops-infrastructure-demo/.github/workflows/ci.yaml at main · somethingwithproof/gitops-infrastructure-demo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  security-events: write

jobs:
  terraform-validate:
    name: Terraform Validate
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
      - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4
        with:
          terraform_version: 1.15.8
      - name: Terraform Format Check
        run: terraform fmt -check -recursive
      - name: Terraform Init
        working-directory: terraform/environments/dev
        run: terraform init -backend=false
      - name: Terraform Validate
        working-directory: terraform/environments/dev
        run: terraform validate

  terraform-security:
    name: Terraform Security Scan
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
      - uses: aquasecurity/tfsec-action@b466648d6e39e7c75324f25d83891162a721f2d6 # v1.0.3
        with:
          soft_fail: false

  helm-lint:
    name: Helm Lint
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
        with:
          version: v3.13.0
      - run: helm lint helm/sample-app
      - run: helm template sample-app helm/sample-app

  yaml-lint:
    name: YAML Lint
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - name: Install yamllint
        run: python -m pip install yamllint==1.35.1
      - name: Run yamllint
        run: >
          yamllint -f parsable
          -d "{extends: default, rules: {line-length: {max: 150, level: warning}, document-start: disable}}"
          argocd/