tfsec.yaml

name: tfsec

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]
  schedule:
    - cron: '33 21 * * 1'

jobs:
  tfsec:
    name: Run tfsec sarif report
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
    - name: Clone repo
      uses: actions/checkout@v4
    - name: Run tfsec
      uses: aquasecurity/tfsec-sarif-action@master
      with:
        sarif_file: tfsec.sarif
    - name: Upload SARIF file
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: tfsec.sarif

  remote:
    name: Remote example test
    runs-on: ubuntu-latest
    steps:
    - name: Clone repo
      uses: actions/checkout@v4
    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v3
    - name: example Remote Validate
      run: |
        cd examples/remote
        terraform init -backend=false -upgrade -reconfigure
        terraform validate