static-analysis.yml

name: Static analysis

on:
  push:
  pull_request:
    types:
      - opened
      - synchronize

jobs:
  terraform_lint:
    name: Terraform lint

    runs-on: ubuntu-24.04

    # Exclude in-repo PRs from running this job
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork

    steps:
      - name: 📥 Checkout source
        uses: actions/checkout@v4

      - name: 🧰 Setup Terraform CLI
        uses: hashicorp/setup-terraform@v3
        env:
          # renovate: datasource=docker depName=hashicorp/terraform versioning=docker
          TERRAFORM_VERSION: 1.9.6
        with:
          terraform_version: ${{ env.TERRAFORM_VERSION }}
          terraform_wrapper: false

      - name: ⚙️ Initialize Terraform
        run: terraform init

      - name: 🔍 Terraform files format check
        run: terraform fmt -check

      - name: 🔍 Validate Terraform files
        run: terraform validate

  ansible_lint:
    name: Ansible lint

    runs-on: ubuntu-24.04

    # Exclude in-repo PRs from running this job
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork

    steps:
      - name: 📥 Checkout source
        uses: actions/checkout@v4

      - name: 🧰 Set up Poetry
        env:
          # renovate: datasource=pypi depName=poetry
          POETRY_VERSION: 1.8.3
        run: pipx install poetry==${{ env.POETRY_VERSION }}

      - name: 🧰 Set up Python
        uses: actions/setup-python@v5
        with:
          python-version-file: pyproject.toml
          cache: poetry

      - name: ⚙️ Create Ansible Vault password file
        env:
          ANSIBLE_VAULT_PASSWORD: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
        run: |
          mkdir secrets
          echo "$ANSIBLE_VAULT_PASSWORD" > secrets/vault_password

      - name: 🧰 Install Poetry dependencies
        run: poetry install

      - name: 🔍 Run ansible-lint
        run: poetry run ansible-lint .