tf-check-secure-estimate.yml

name: 'Terraform Check-Secure-Estimate'

on:
  pull_request:

#Special permissions required for OIDC authentication
permissions:
  id-token: write
  contents: read
  pull-requests: write

env:
  AWS_ACCESS_KEY_ID : "${{ secrets.AWS_ACCESS_KEY_ID }}"
  AWS_SECRET_ACCESS_KEY : "${{ secrets.AWS_SECRET_ACCESS_KEY }}"
  TF_ROOT : "."
  
jobs:
  terraform-check-code:
    name: 'TF Validate code'
    runs-on: ubuntu-latest

    steps:
    # Checkout the repository to the GitHub Actions runner
    - name: Checkout
      uses: actions/checkout@v3

    # Install the latest version of Terraform CLI
    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v2
      with:
        terraform_wrapper: false

    # Initialize a new or existing Terraform working directory
    - name: Terraform Init
      run: terraform init

    # Validate terraform files
    - name: Terraform Validate
      run: terraform validate

    # Checks that all Terraform configuration files adhere to a canonical format
    - name: Terraform Check Format
      run: terraform fmt -check -recursive
    
    ## TFLint installation and configuration
    - uses: actions/cache@v3
      name: TFLint - Cache plugin dir
      with:
        path: ~/.tflint.d/plugins
        key: ubuntu-latest-tflint-${{ hashFiles('.tflint.hcl') }}

    - uses: terraform-linters/setup-tflint@v3
      name: TFLint - Setup
      with:
        tflint_version: latest

    - name: TFLint - Show version
      run: tflint --version

    - name: TFLint - Initiate
      run: tflint --init
      env:
        # https://github.com/terraform-linters/tflint/blob/master/docs/user-guide/plugins.md#avoiding-rate-limiting
        GITHUB_TOKEN: ${{ github.token }}

    - name: TFLint - Execute
      run: tflint -f compact

  terraform-secu-scan-tfsec:
    needs: terraform-check-code
    name: 'TF Security Scan'
    runs-on: ubuntu-latest

    steps:
    # Checkout the repository to the GitHub Actions runner
    - name: Checkout PR branch
      uses: actions/checkout@v3
    # Perform a security scan of the terraform code using TFsec
    - name: Run TFsec scan
      uses: aquasecurity/tfsec-action@v1.0.0

  terraform-plan-estimate:
    needs: terraform-secu-scan-tfsec
    if: |
      always() &&
      contains(needs.*.result, 'success')
    name: 'TF Estimate Cost and Plan'
    runs-on: ubuntu-latest

    steps:
    # Checkout the repository to the GitHub Actions runner
    - name: Checkout
      uses: actions/checkout@v3

    # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token
    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v2
      with:
        terraform_wrapper: false

    # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
    - name: Terraform Init
      run: terraform init

    # Plan change 
    - name: Terraform Plan
      run: terraform plan
  
    - name: Setup Infracost
      uses: infracost/actions/setup@v2
      with:
       api-key: ${{ secrets.INFRACOST_API_KEY }}

     # Checkout the base branch of the pull request (e.g. main/master).
    - name: Checkout base branch
      uses: actions/checkout@v3
      with:
        ref: '${{ github.event.pull_request.base.ref }}'

      # Generate Infracost JSON file as the baseline.
    - name: Generate Infracost cost estimate baseline
      run: |
        infracost breakdown --path=${TF_ROOT} \
                            --format=json \
                            --out-file=/tmp/infracost-base.json

      # Checkout the repository to the GitHub Actions runner
    - name: Checkout PR branch
      uses: actions/checkout@v3

      # Generate an Infracost diff and save it to a JSON file.
    - name: Generate Infracost diff
      run: |
        infracost diff --path=${TF_ROOT} \
                       --format=json \
                       --compare-to=/tmp/infracost-base.json \
                       --out-file=/tmp/infracost.json

      # Posts a comment to the PR using the 'update' behavior.
      # This creates a single comment and updates it. The "quietest" option.
      # The other valid behaviors are:
      #   delete-and-new - Delete previous comments and create a new one.
      #   hide-and-new - Minimize previous comments and create a new one.
      #   new - Create a new cost estimate comment on every push.
      # See https://www.infracost.io/docs/features/cli_commands/#comment-on-pull-requests for other options.
    - name: Post Infracost comment
      run: |
        infracost comment github --path=/tmp/infracost.json \
                                 --repo=$GITHUB_REPOSITORY \
                                 --github-token=${{github.token}} \
                                 --pull-request=${{github.event.pull_request.number}} \
                                 --behavior=update