refresh

JamesWoolfenden · Dec 3, 2023 · bd1ce9d · bd1ce9d
1 parent 0607076
commit bd1ce9d
Show file tree

Hide file tree

Showing 19 changed files with 160 additions and 271 deletions.
diff --git a/.github/workflows/compare.yml b/.github/workflows/compare.yml
diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
@@ -5,36 +5,51 @@ on:
   pull_request:
   workflow_dispatch:
 
+env:
+  terraform: 1.3.0
+  tf_target_dir: example/examplea
+
+permissions: read-all
+
 jobs:
   terraform:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           token: ${{ github.token }}
           fetch-depth: '0'
       - name: Terraform Init
-        uses: hashicorp/terraform-github-actions@master
+        uses: hashicorp/terraform-github-actions@b2ca17c0c25198c67c668c37edcbc45ca086a91e # v0.8.0
         with:
-          tf_actions_version: 1.0.1
+          tf_actions_version: ${{ env.terraform }}
           tf_actions_subcommand: init
-          tf_actions_working_dir: example/examplea
+          tf_actions_working_dir: ${{ env.tf_target_dir }}
       - name: Terraform Validate
-        uses: hashicorp/terraform-github-actions@master
+        uses: hashicorp/terraform-github-actions@b2ca17c0c25198c67c668c37edcbc45ca086a91e # v0.8.0
         with:
-          tf_actions_version: 1.0.1
+          tf_actions_version: ${{ env.terraform }}
           tf_actions_subcommand: validate
-          tf_actions_working_dir: example/examplea
+          tf_actions_working_dir: ${{ env.tf_target_dir }}
   security:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           token: ${{ github.token }}
           fetch-depth: '0'
-      - uses: actions/setup-python@v2
+      - uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
         with:
-          python-version: 3.8
-      - uses: pre-commit/action@v2.0.0
+          python-version: 3.11
+      - run: |
+          wget https://github.com/terraform-docs/terraform-docs/releases/download/v0.16.0/terraform-docs-v0.16.0-linux-amd64.tar.gz
+          mkdir "$GITHUB_WORKSPACE/bin"
+          tar -xvf terraform-docs*.tar.gz --directory "$GITHUB_WORKSPACE/bin"
+          chmod +x "$GITHUB_WORKSPACE/bin/terraform-docs"
+          wget https://github.com/rhysd/actionlint/releases/download/v1.6.23/actionlint_1.6.23_linux_amd64.tar.gz
+          tar -xvf actionlint_1.6.23_linux_amd64.tar.gz --directory "$GITHUB_WORKSPACE/bin"
+          chmod +x "$GITHUB_WORKSPACE/bin/actionlint"
+          echo "$GITHUB_WORKSPACE/bin" >> "$GITHUB_PATH"
+      - uses: pre-commit/action@646c83fcd040023954eafda54b4db0192ce70507 # v3.0.0
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
@@ -0,0 +1,89 @@
+---
+# yamllint disable rule:line-length
+name: Verify
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - master
+permissions: read-all
+
+env:
+  terraform: 1.3.0
+  tf_target_dir: example/examplea
+  branch: master
+  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID}}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY}}
+  GITHUB_API_TOKEN: ${{ github.token }}
+jobs:
+  terraform:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: hashicorp/setup-terraform@a1502cd9e758c50496cc9ac5308c4843bcd56d36 # v3.0.0
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          ref: ${{ env.branch }}
+          token: ${{ github.token }}
+          fetch-depth: '0'
+      - name: Config Terraform plugin cache
+        run: |
+          echo "plugin_cache_dir=$HOME/.terraform.d/plugin-cache" >~/.terraformrc
+          mkdir --parents ~/.terraform.d/plugin-cache
+      - name: Cache Terraform
+        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        with:
+          path: |
+            ~/.terraform.d/plugin-cache
+          key: ${{ runner.os }}-terraform-${{ hashFiles('**/.terraform.lock.hcl') }}
+          restore-keys: |
+            ${{ runner.os }}-terraform-
+      - name: Terraform Init
+        id: init
+        run: terraform init
+        working-directory: ${{ env.tf_target_dir }}
+      - name: Terraform validate
+        id: validate
+        run: terraform validate
+        working-directory: ${{ env.tf_target_dir }}
+      - name: Terraform plan
+        id: plan
+        run: terraform plan
+        working-directory: ${{ env.tf_target_dir }}
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          ref: ${{ env.branch }}
+          token: ${{ github.token }}
+          fetch-depth: '0'
+      - uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
+        with:
+          python-version: 3.11
+      - run: |
+          wget https://github.com/terraform-docs/terraform-docs/releases/download/v0.16.0/terraform-docs-v0.16.0-linux-amd64.tar.gz
+          mkdir "$GITHUB_WORKSPACE/bin"
+          tar -xvf terraform-docs*.tar.gz --directory "$GITHUB_WORKSPACE/bin"
+          chmod +x "$GITHUB_WORKSPACE/bin/terraform-docs"
+          wget https://github.com/rhysd/actionlint/releases/download/v1.6.23/actionlint_1.6.23_linux_amd64.tar.gz
+          tar -xvf actionlint_1.6.23_linux_amd64.tar.gz --directory "$GITHUB_WORKSPACE/bin"
+          chmod +x "$GITHUB_WORKSPACE/bin/actionlint"
+          echo "$GITHUB_WORKSPACE/bin" >> "$GITHUB_PATH"
+      - uses: pre-commit/action@646c83fcd040023954eafda54b4db0192ce70507 # v3.0.0
+  version:
+    permissions: write-all
+    name: versioning
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          fetch-depth: '0'
+      - name: Bump version and push tag
+        uses: anothrNick/github-tag-action@a2c70ae13a881faf2b4953baaa9e49731997ab36 # 1.67.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DEFAULT_BUMP: patch
+          WITH_V: "true"
+    needs: [terraform, security]