pre-commit-pr.yml

name: Scan
on:
  push:
    branches:
      - main
  pull_request:
    types:
      - opened
      - reopened
      - synchronize
      - ready_for_review
    branches:
      - main
    paths:
      - "**.tf"
      - "**.go"
      - ".github/**"
      - "README.md"

permissions:
  contents: read

jobs:
  tflint:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - uses: opentofu/setup-opentofu@12f4debbf681675350b6cd1f0ff8ecfbda62027b # v1.0.4    
        with:
          # renovate: datasource=github-tags depName=opentofu/opentofu versioning=semver
          tofu_version: 1.8.6

      - name: tofu init
        run: tofu init

      - name: tofu validate
        run: tofu validate

      - name: tofu fmt
        run: tofu fmt -recursive

      - name: Update Tofu Docs
        uses: terraform-docs/gh-actions@aeae0038ed47a547e0c0fca5c059d3335f48fb25 # v1.3.0
        with:
          working-dir: .
          output-method: inject
          git-push: false
          fail-on-diff: true

      - name: Setup TFLint
        uses: terraform-linters/setup-tflint@8093687ecc9dcbfa88d07c103ad4176739a7287e # v4.1.0
        with:
          # renovate: datasource=github-tags depName=terraform-linters/tflint versioning=semver
          tflint_version: v0.54.0

      - name: Show version
        run: tflint --version

      - name: Init TFLint
        run: tflint --init
        env:
          # https://github.com/terraform-linters/tflint/blob/master/docs/user-guide/plugins.md#avoiding-rate-limiting
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} 

      - name: Run TFLint
        run: tflint -f compact --recursive

  tfsec-scan:
    needs: [tflint]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: tfsec
        uses: aquasecurity/tfsec-action@b466648d6e39e7c75324f25d83891162a721f2d6 # v1.0.3
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }} 
          soft_fail: true

  regula:
    needs: [tflint]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: List Directories
        run: ls -lsa

      - name: Scan with Regula
        uses: fugue/regula-action@e47ae38fae32dccedc5ef814acdb2081eb2a351d # v3.2.1
        with:
          input_path: .
          input_type: tf
          severity: high

  lintgo:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Run golangci-lint
        uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6.1.1