terraform-test.yml

name: Validation

on:
  push:
    branches: main
  pull_request:

jobs:
  terraform-validate:
    name: Terraform Validate
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@v4

      - name: Check for terraform version mismatch
        working-directory: terraform
        run: |
          DOTFILE_VERSION=$(cat .terraform-version)
          TERRAFORM_IMAGE_REFERENCES=$(grep "uses: docker://hashicorp/terraform" .github/workflows/terraform-test.yml | grep -v TERRAFORM_IMAGE_REFERENCES | wc -l | tr -d ' ')
          if [ "$(grep "docker://hashicorp/terraform:${DOTFILE_VERSION}" .github/workflows/terraform-test.yml | wc -l | tr -d ' ')" != "$TERRAFORM_IMAGE_REFERENCES" ]
          then
            echo -e "\033[1;31mError: terraform version in .terraform-version file does not match docker://hashicorp/terraform versions in .github/workflows/terraform-test.yml"
            exit 1
          fi

      - name: Remove azure backend
        run: rm ./backend.tf
        working-directory: terraform

      - name: Run a Terraform init
        uses: docker://hashicorp/terraform:1.9.7
        with:
          entrypoint: terraform
          args: init

      - name: Run a Terraform validate
        uses: docker://hashicorp/terraform:1.9.7
        with:
          entrypoint: terraform
          args: validate

      - name: Run a Terraform format check
        uses: docker://hashicorp/terraform:1.9.7
        with:
          entrypoint: terraform
          args: fmt -check=true -diff=true

  terraform-docs-validation:
    name: Terraform Docs validation
    needs: terraform-validate
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.ref }}

      - name: Generate Terraform docs
        uses: terraform-docs/gh-actions@v1.3.0
        with:
          working-dir: terraform
          config-file: .terraform-docs.yml
          output-file: README.md
          output-method: inject
          fail-on-diff: true

  tflint:
    name: tflint
    runs-on: ubuntu-latest
    steps:
      - name: Clone repo
        uses: actions/checkout@v4

      - name: Setup TFLint
        uses: terraform-linters/setup-tflint@v4
        with:
          tflint_version: v0.44.1

      - name: Run TFLint
        working-directory: terraform
        run: tflint -f compact

  tfsec-pr-commenter:
    name: tfsec
    runs-on: ubuntu-latest
    steps:
      - name: Clone repo
        uses: actions/checkout@v4

      - name: tfsec
        uses: aquasecurity/tfsec-pr-commenter-action@v1.3.1
        with:
          working_directory: terraform
          github_token: ${{ github.token }}