pr.yaml

name: pull-request

on:
  pull_request:

permissions: read-all

env:
  BUCKET_TF_STATE: ${{ secrets.BUCKET_TF_STATE}}

jobs:
  pull-request:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # @v4

      - name: Setup Terraform with specified version on the runner
        uses: hashicorp/setup-terraform@651471c36a6092792c552e8b1bef71e592b462d8 # @v3
        with:
          terraform_version: 1.8.3

      - name: Terraform format
        id: fmt
        run: terraform fmt -check
        working-directory: ./terraform/

      - name: Run Checkov action
        id: checkov
        uses: bridgecrewio/checkov-action@0549dc60bddd4c55cb85c6c3a07072e3cf2ca48e
        with:
          skip_check: CKV_DOCKER_2,CKV_DOCKER_3,CKV_SECRET_6
          quiet: true
          output_format: cli,sarif
          output_file_path: console,results.sarif
          download_external_modules: true

      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@d39d31e687223d841ef683f52467bd88e9b21c14 # v3
        if: success() || failure()
        with:
          sarif_file: results.sarif