cf-test.yml

name: "CF template tests"
on: [workflow_dispatch, pull_request]

jobs:
  ValidateLinting:
    name: "Cloud Formation template linting verification"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Setup Cloud Formation Linter with Latest Version
        uses: scottbrenner/cfn-lint-action@v2

      - name: Print the Cloud Formation Linter Version & run Linter.
        run: |
          cfn-lint aws-observability/**/*.yaml --ignore-templates aws-observability/**/*TestTemplate.yaml

  CFSecurityChecksCheckovt:
    name: "Cloud Formation template tests using checkov"
    runs-on: "ubuntu-latest"
    steps:
      - name: Checkout repo
        uses: actions/checkout@v3

      - uses: bridgecrewio/checkov-action@master
        with:
          directory: 'aws-observability/'
          quiet: false
          framework: cloudformation
          output_format: cli
          output_bc_ids: true

  CFSecurityChecksCFNNAG:
    name: "cfn-nag for Cloud Formation template"
    runs-on: "ubuntu-latest"
    steps:
      - uses: actions/checkout@v2
      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: 2.6
      - name: Install cfn_nag
        run: |
          gem install cfn-nag

      - name: Validate with cfn_nag
        run: |
          cfn_nag_scan -i aws-observability/**/*.yaml

#  ValidatePython:
#    name: "Validate Python test"
#    runs-on: "ubuntu-latest"
#    steps:
#      - name: Checkout repo
#        uses: actions/checkout@v3
#
#      - run: |
#          unzip aws-observability/apps/SumoLogicAWSObservabilityHelper/*.zip -d SumoLogicAWSObservabilityHelper
#      - uses: bridgecrewio/checkov-action@master
#        with:
#          directory: 'aws-observability/apps/SumoLogicAWSObservabilityHelper/'
#          quiet: false
#          framework: sast_python
#          output_format: cli
#          output_bc_ids: true