Skip to content

Commit f598389

Browse files
jamesiarmesjamesiarmes
authored
ci: Rework workflows to decrease duplication and improve maintainability. (#35)
* ci: Add dedicated trivy workflow. * ci: Add composite action to find modified modules. * ci: Add dedicated TFLint workflow.
1 parent a12876e commit f598389

File tree

7 files changed

+177
-199
lines changed

7 files changed

+177
-199
lines changed

‎.github/actions/changed-modules/action.yaml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
name: Discover changed OpenTofu modules
2+
description: |
3+
Finds all OpenTofu modules that have changed in a pull request or push to a
4+
branch.
5+
outputs:
6+
modules:
7+
description: A JSON array of all changed modules.
8+
value: ${{ steps.modified.outputs.modules }}
9+
inputs:
10+
working-directory:
11+
description: The working directory to search for modules in.
12+
required: false
13+
default: tofu
14+
runs:
15+
using: composite
16+
steps:
17+
- name: Find all OpenTofu modules
18+
id: find
19+
uses: bendrucker/find-terraform-modules@v1
20+
with:
21+
working-directory: ${{ inputs.working-directory }}
22+
- name: Show all matching modules
23+
shell: bash
24+
run: |
25+
mods=(${{ join(fromJSON(steps.find.outputs.modules), ' ') }})
26+
printf "%s\n" "${mods[@]}"
27+
- name: Find all changed files
28+
id: diff
29+
uses: technote-space/get-diff-action@v6
30+
with:
31+
FORMAT: json
32+
- name: Show changed files
33+
shell: bash
34+
run: |
35+
echo "${{ steps.diff.outputs.diff }}"
36+
- name: Get the modified modules
37+
id: modified
38+
uses: actions/github-script@v7
39+
with:
40+
script: |
41+
const modules = ${{ steps.find.outputs.modules }}
42+
const diff = ${{ steps.diff.outputs.diff }}
43+
const modifiedModules = modules.filter(
44+
(module) => {
45+
return !!diff.find(file => new RegExp(`^${module}/.+`).test(file))
46+
}
47+
)
48+
49+
core.setOutput('modules', modifiedModules)
50+
- name: Show modified modules
51+
shell: bash
52+
run: |
53+
echo "${{ steps.modified.outputs.modules }}"

‎.github/actions/security-features/action.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: Check for GitHub security features
2+
description: |
3+
Checks if the repository is public or has GitHub Advanced Security enabled.
4+
outputs:
5+
codeql:
6+
description: Whether or not CodeQL analysis is supported.
7+
value: ${{ github.event.repository.security_and_analysis.advanced_security_enabled || !github.event.repository.private }}
8+
ghas:
9+
description: Whether or not GitHub Advanced Security is enabled.
10+
value: ${{ github.event.repository.security_and_analysis.advanced_security_enabled }}
11+
public:
12+
description: Whether or not the repository is public.
13+
value: ${{ github.event.repository.private == false }}
14+
sarif:
15+
description: Whether or not SARIF uploads are supported.
16+
value: ${{ github.event.repository.security_and_analysis.advanced_security_enabled || !github.event.repository.private }}
17+
runs:
18+
using: composite
19+
steps:
20+
- name: GHAS enabled notice
21+
shell: bash
22+
if: ${{ github.event.repository.security_and_analysis.advanced_security_enabled }}
23+
run: |
24+
echo "GitHub Advanced Security is enabled."
25+
- name: Public repository notice
26+
shell: bash
27+
if: ${{ github.event.repository.private == false }}
28+
run: |
29+
echo "Repository is public."

‎.github/workflows/branch.yaml‎

Lines changed: 0 additions & 111 deletions
This file was deleted.

‎.github/workflows/main.yaml‎

Lines changed: 0 additions & 59 deletions
This file was deleted.

‎.github/workflows/pull-request.yaml‎

Lines changed: 10 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -11,43 +11,24 @@ jobs:
1111
steps:
1212
- name: Checkout source code
1313
uses: actions/checkout@v4
14-
- name: Find all configs
15-
id: find
16-
uses: bendrucker/find-terraform-modules@v1
14+
- name: Find changed OpenTofu modules
15+
id: modified
16+
uses: ./.github/actions/changed-modules
1717
with:
1818
working-directory: tofu/config
19-
- name: Show all matching configs
20-
shell: bash
21-
run: |
22-
mods=(${{ join(fromJSON(steps.find.outputs.modules), ' ') }})
23-
printf "%s\n" "${mods[@]}"
24-
- name: Find all changed files
25-
id: diff
26-
uses: technote-space/get-diff-action@v6
27-
with:
28-
FORMAT: json
29-
- name: Show changed files
30-
run: |
31-
echo "${{ steps.diff.outputs.diff }}"
32-
- name: Get the modified configs
33-
id: modified
19+
- name: Strip prefix from modified configs
20+
id: configs
3421
uses: actions/github-script@v7
3522
with:
3623
script: |
37-
const configs = ${{ steps.find.outputs.modules }}
38-
const diff = ${{ steps.diff.outputs.diff }}
39-
const modifiedConfigs = configs.filter(
40-
(config) => {
41-
return !!diff.find(file => new RegExp(`^${config}/.+`).test(file))
42-
}
43-
).map(config => config.replace(/^tofu\/config\//, ''))
44-
45-
core.setOutput('configs', modifiedConfigs)
24+
const modules = ${{ steps.modified.outputs.modules }}
25+
const configs = modules.map(m => m.replace(/^tofu\/config\//, ''))
26+
core.setOutput('configs', configs)
4627
- name: Show modified configs
4728
run: |
48-
echo "${{ steps.modified.outputs.configs }}"
29+
echo "${{ steps.configs.outputs.configs }}"
4930
outputs:
50-
configs: ${{ steps.modified.outputs.configs }}
31+
configs: ${{ steps.configs.outputs.configs }}
5132

5233
plan:
5334
uses: ./.github/workflows/plan.yaml

‎.github/workflows/tflint.yaml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: TFLint Checks
2+
3+
on:
4+
push:
5+
pull_request:
6+
branches:
7+
- main
8+
9+
permissions:
10+
contents: read
11+
12+
jobs:
13+
lint:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Checkout source code
17+
uses: actions/checkout@v4
18+
- name: Check security features
19+
id: security-features
20+
uses: ./.github/actions/security-features
21+
- name: Cache plugin directory
22+
uses: actions/cache@v4
23+
with:
24+
path: ~/.tflint.d/plugins
25+
key: tflint-${{ hashFiles('.tflint.hcl') }}
26+
- uses: terraform-linters/setup-tflint@v5
27+
name: Setup TFLint
28+
- name: Show version
29+
run: tflint --version
30+
- name: Init TFLint
31+
run: tflint --init
32+
- name: Run TFLint
33+
run: tflint --format sarif --recursive --config "$GITHUB_WORKSPACE/.tflint.hcl" > tflint-results.sarif
34+
- name: Parse SARIF file for annotations
35+
if: always()
36+
uses: Miragon/[email protected]
37+
with:
38+
severity-level: low
39+
sarif-file: tflint-results.sarif
40+
# When run on main, if SARIF uploads are available, we want to upload the
41+
# SARIF file to GitHub.
42+
- name: Upload SARIF result
43+
if: always() && github.ref == 'refs/heads/main' && steps.security-features.outputs.sarif == 'true'
44+
uses: github/codeql-action/upload-sarif@v3
45+
with:
46+
sarif_file: tflint-results.sarif

‎.github/workflows/trivy.yaml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: Trivy Analysis
2+
3+
on:
4+
push:
5+
6+
permissions:
7+
contents: read
8+
9+
jobs:
10+
trivy:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Checkout source code
14+
uses: actions/checkout@v4
15+
- name: Check security features
16+
id: security-features
17+
uses: ./.github/actions/security-features
18+
- name: Run Trivy vulnerability scanner
19+
uses: aquasecurity/[email protected]
20+
with:
21+
scan-type: config
22+
ignore-unfixed: true
23+
skip-dirs: "**/*/.terraform"
24+
exit-code: 1
25+
format: sarif
26+
output: trivy-results.sarif
27+
- name: Parse SARIF file for annotations
28+
if: always()
29+
uses: Miragon/[email protected]
30+
with:
31+
severity-level: low
32+
sarif-file: trivy-results.sarif
33+
# When run on main, if SARIF uploads are available, we want to upload the
34+
# SARIF file to GitHub.
35+
- name: Upload SARIF result
36+
if: always() && github.ref == 'refs/heads/main' && steps.security-features.outputs.sarif == 'true'
37+
uses: github/codeql-action/upload-sarif@v3
38+
with:
39+
sarif_file: trivy-results.sarif

0 commit comments

Comments
 (0)