terraform_static_analysis.yml

name: "Terraform security scan"

on: [pull_request]

defaults:
  run:
    shell: bash

jobs:
  terraform-security-scan:
    if: github.ref != 'refs/heads/main'
    runs-on: ubuntu-latest
    continue-on-error: false
    steps:
      - name: Checkout
        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

      - name: Test with Checkov
        id: checkov
        uses: bridgecrewio/checkov-action@master
        with:
          directory: ./
          framework: terraform 
          soft_fail: true
          quiet: true
          download_external_modules: true
          output_format: cli,sarif
          output_file_path: console,results.sarif
          config_file: ./aws/.checkov.yml

      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: results.sarif