diff --git a/.github/workflows/gosec.yml b/.github/workflows/gosec.yml new file mode 100644 index 000000000..74579e6f2 --- /dev/null +++ b/.github/workflows/gosec.yml @@ -0,0 +1,29 @@ +name: GoSec Security Check + +on: + push: + branches: + - main + pull_request: + branches: + - main + +jobs: + gosec: + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Install GoSec + run: | + curl -sSL https://github.com/securego/gosec/releases/download/v2.12.0/gosec_2.12.0_linux_amd64.tar.gz | tar -xz + sudo mv gosec /usr/local/bin/ + + - name: Run GoSec Scan + run: gosec -fmt=sarif -out=gosec.sarif ./... + + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: gosec.sarif diff --git a/.github/workflows/tflint.yml b/.github/workflows/tflint.yml new file mode 100644 index 000000000..5c90868e0 --- /dev/null +++ b/.github/workflows/tflint.yml @@ -0,0 +1,49 @@ +name: Terraform Lint + +on: + push: + branches: + - main + paths-ignore: + - 'docs/**' + - '.github/**' + - 'scripts/**' + - 'gitignore' + + pull_request: + branches: + - main + paths-ignore: + - 'docs/**' + - '.github/**' + - 'scripts/**' + - 'gitignore' + + +jobs: + lint: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Set up Go (for installing tflint) + uses: actions/setup-go@v2 + with: + go-version: '1.18' + + - name: Install tflint + run: | + wget https://github.com/terraform-linters/tflint/releases/download/v0.44.1/tflint-linux-amd64.tar.gz + tar -xvzf tflint-linux-amd64.tar.gz + sudo mv tflint /usr/local/bin/ + + - name: Run tflint recursively + run: | + find . -name "*.tf" | xargs tflint > tflint.sarif + + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: tflint.sarif diff --git a/.github/workflows/tfsec.yml b/.github/workflows/tfsec.yml new file mode 100644 index 000000000..b27875ccc --- /dev/null +++ b/.github/workflows/tfsec.yml @@ -0,0 +1,31 @@ +name: TFsec Security Check + +on: + push: + branches: + - main + pull_request: + branches: + - main + +jobs: + tfsec: + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Install TFsec + run: | + curl -sSL https://github.com/aquasecurity/tfsec/releases/download/v1.20.0/tfsec-linux-amd64 -o tfsec + chmod +x tfsec + sudo mv tfsec /usr/local/bin/ + + - name: Run TFsec Scan + run: tfsec . --force-all-dirs > tfsec.sarif + + - name: Upload SARIF file + uses: actions/upload-artifact@v3 + with: + name: tfsec-sarif + path: tfsec.sarif diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml new file mode 100644 index 000000000..ef95e4e0d --- /dev/null +++ b/.github/workflows/trivy.yml @@ -0,0 +1,30 @@ +name: Trivy Security Check + +on: + push: + branches: + - main + pull_request: + branches: + - main + +jobs: + trivy: + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Install Trivy + run: | + curl -sSL https://github.com/aquasecurity/trivy/releases/download/v0.22.0/trivy_0.22.0_Linux-64bit.tar.gz -o trivy_0.22.0_Linux-64bit.tar.gz + tar -xvzf trivy_0.22.0_Linux-64bit.tar.gz + sudo mv trivy /usr/local/bin/ + + - name: Run Trivy Scan + run: trivy fs . --format sarif -o trivy.sarif + + - name: Upload Sarif file + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: trivy.sarif \ No newline at end of file