diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml new file mode 100644 index 0000000..0cd3756 --- /dev/null +++ b/.github/workflows/ci.yaml @@ -0,0 +1,37 @@ +name: ci +on: + - pull_request + +jobs: + ci: + runs-on: ubuntu-latest + steps: + # Setup dependencies + - uses: actions/checkout@v3 + with: + ref: ${{ github.event.pull_request.head.ref }} + + # Run a couple of native Terraform checks + - uses: hashicorp/setup-terraform@v3 + - run: terraform init + - run: terraform fmt -recursive -check + - run: terraform validate + + # Checkov + - uses: bridgecrewio/checkov-action@v12 + with: + directory: . + quiet: true + skip_check: CKV_TF_1,CKV_GCP_32,CKV_GCP_34,CKV2_GCP_18 + framework: terraform + + # Terraform-docs + - uses: terraform-docs/gh-actions@v1.1.0 + with: + working-dir: . + output-file: README.md + output-method: inject + fail-on-diff: true + args: --lockfile=false + git-push: "true" # automatically push the changes to the branch + diff --git a/.github/workflows/pre-commit.yaml b/.github/workflows/pre-commit.yaml deleted file mode 100644 index 7d1a97c..0000000 --- a/.github/workflows/pre-commit.yaml +++ /dev/null @@ -1,38 +0,0 @@ -name: precommit -on: - pull_request: -permissions: - contents: read -defaults: - run: - shell: bash -jobs: - precommit: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v3 - - name: Set up Python - uses: actions/setup-python@v2 - with: - python-version: 3.8 - - name: Create virtual environment - run: python3 -m venv venv && source venv/bin/activate - - name: Install pre-commit and checkov - run: | - python3 -m pip install --upgrade pip - python3 -m pip install pre-commit==3.5.0 checkov==2.5.10 - - name: install terraform-docs - run: | - curl -sSLo ./terraform-docs.tar.gz https://terraform-docs.io/dl/v0.16.0/terraform-docs-v0.16.0-$(uname)-amd64.tar.gz - tar -xzf terraform-docs.tar.gz - chmod +x terraform-docs - mv terraform-docs /usr/local/bin/ - - name: Cache packages - uses: actions/cache@v2 - with: - path: ~/.cache/pip - key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }} - restore-keys: | - ${{ runner.os }}-pip- - - name: Run pre-commit - run: pre-commit run --show-diff-on-failure --color=always --all-files diff --git a/.gitignore b/.gitignore index 53074ba..06948e9 100644 --- a/.gitignore +++ b/.gitignore @@ -30,3 +30,8 @@ override.tf.json # Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan # example: *tfplan* + +# Checkov files +checkov-problem-matcher-softfail.json +checkov-problem-matcher.json +results.sarif \ No newline at end of file diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml deleted file mode 100644 index f5bb6d1..0000000 --- a/.pre-commit-config.yaml +++ /dev/null @@ -1,22 +0,0 @@ -repos: - - repo: https://github.com/antonbabenko/pre-commit-terraform - rev: v1.74.1 - hooks: - - id: terraform_checkov - args: - - --args=--quiet - - --args=--compact - - --args=--framework=terraform - - --args=--skip-check=CKV_TF_1,CKV_GCP_32,CKV_GCP_34,CKV2_GCP_18 - - id: terraform_fmt - exclude: ^examples/ - - id: terraform_validate - exclude: ^examples/ - - id: terraform_docs - args: ["--args=--lockfile=false"] - exclude: ^examples/ - - - repo: https://github.com/pre-commit/pre-commit-hooks - rev: v3.4.0 - hooks: - - id: check-merge-conflict diff --git a/README.md b/README.md index e7e9660..5077354 100644 --- a/README.md +++ b/README.md @@ -178,7 +178,8 @@ This error indicates that the Google Cloud Managed SSL certificate is not yet fu If all configurations are correct, it may take up to 25 minutes for the certificate to be provisioned. You can check the status of the certificate in the Google Cloud Console. - + + ## Requirements | Name | Version | @@ -271,4 +272,4 @@ You can check the status of the certificate in the Google Cloud Console. | [ip\_address](#output\_ip\_address) | The IPv4 address of the load balancer | | [managed\_ssl\_certificate\_certificate\_id](#output\_managed\_ssl\_certificate\_certificate\_id) | The unique identifier of the Google Managed SSL certificate | | [managed\_ssl\_certificate\_expire\_time](#output\_managed\_ssl\_certificate\_expire\_time) | Expire time of the Google Managed SSL certificate | - + \ No newline at end of file