arm-template-test.yml

name: "ARM template tests"
on: [workflow_dispatch, pull_request]

jobs:
  best-practices-test:
    name: "ARM template tests using arm-ttk"
    runs-on: "ubuntu-latest"
    strategy:
      matrix: 
        include: # Includes one more job
          - file: 'azuredeploy_metrics.json'
            dir: 'EventHubs/src'
          - file: 'blobreaderdeploy.json'
            dir: 'BlockBlobReader/src'
          - file: 'blobreaderdeploywithPremiumPlan.json'
            dir: 'BlockBlobReader/src'
          - file: 'appendblobreaderdeploy.json'
            dir: 'AppendBlobReader/src'
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4

      - name: Rename file 
        run: |
          cp ${{ matrix.dir }}/${{ matrix.file }} ${{ matrix.dir }}/mainTemplate.json 
          cd ${{ matrix.dir }}
          find . -maxdepth 1 -type f -name '*.json' ! -name 'mainTemplate.json' -exec rm -f {} +

      - uses: microsoft/action-armttk@main
        with:
          workdir: ${{ matrix.dir }}
          fail_on_error: true
          level: "info"

  security-test:
    name: "ARM template tests using checkov"
    runs-on: "ubuntu-latest"
    strategy:
      matrix: 
        include: # Includes one more job
          - file: 'azuredeploy_metrics.json'
            dir: 'EventHubs/src'
          - file: 'blobreaderdeploy.json'
            dir: 'BlockBlobReader/src'
          - file: 'blobreaderdeploywithPremiumPlan.json'
            dir: 'BlockBlobReader/src'
          - file: 'appendblobreaderdeploy.json'
            dir: 'AppendBlobReader/src'
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4

      - uses: bridgecrewio/checkov-action@master
        with:
          file: ${{ matrix.dir }}/${{ matrix.file }}
          skip_check: CKV_AZURE_16,CKV_AZURE_17,CKV_AZURE_35,CKV_AZURE_78
          quiet: false
          framework: arm
          output_format: cli
          output_bc_ids: true