-
-
Notifications
You must be signed in to change notification settings - Fork 3
47 lines (41 loc) · 1.16 KB
/
ci.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
name: CI
on:
pull_request:
branches:
- main
push:
branches:
- main
workflow_dispatch:
jobs:
validate:
uses: saidsef/saidsef/.github/workflows/tf-validate.yaml@main
with:
start-version: '3'
end-version: '8'
tfsec:
uses: saidsef/saidsef/.github/workflows/tf-security.yaml@main
needs: [validate]
attest:
uses: saidsef/saidsef/.github/workflows/tf-attest.yaml@main
needs: [tfsec]
caller-identity-check:
if: contains(github.event_name, 'pull_request')
runs-on: ubuntu-latest
name: Return the IAM user
needs: [validate, tfsec]
permissions:
contents: read
id-token: write
steps:
- name: Configure AWS credentials
uses: aws-actions/[email protected]
with:
aws-region: ${{ secrets.AWS_REGION }}
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/github-actions
role-session-name: ${{ github.event.repository.name }}-${{ github.ref_type }}
- run: |
aws sts get-caller-identity
auto-approve:
uses: saidsef/saidsef/.github/workflows/auto-approve.yaml@main
needs: [validate, tfsec, caller-identity-check]