ci(infra): run tfsec + checkov on Terraform plan in CI (#373)

* ci(infra): run tfsec + checkov on Terraform plan in CI

Add IaC security scanning gate that runs tfsec and checkov against all
Terraform changes on pull requests and pushes to main.

- .github/workflows/terraform-scan.yml: CI workflow with two parallel jobs running
tfsec and checkov against infrastructure/terraform/ directory
- infrastructure/terraform/.tfsec.yml: tfsec config enforcing HIGH minimum severity

Closes #166

* fix(ci): resolve tfsec format error and add checkov baseline

- tfsec: change format from 'table' to 'text' (table is not a valid
  format for aquasecurity/tfsec-action)
- checkov: add .checkov.baseline to acknowledge 85 pre-existing
  findings so CI only fails on new regressions
- Workflow: add baseline and quiet params to checkov step

* docs(infra): add note about regenerating checkov baseline to README

* fix(ci): correct checkov baseline path and suppress tfsec false-positive on ALB

- Fix checkov baseline path to be relative to workspace root
  (infrastructure/terraform/.checkov.baseline) instead of scan dir
- Add tfsec:ignore for aws-ec2-no-public-ingress-sgr on ALB security
  group — ALB must accept public HTTP(S) traffic by design

* fix(ci): regenerate checkov baseline to cover new terraform files from upstream merge

---------

Co-authored-by: irefavor15-dotcom <irefavor15@gmail.com>

Author: Moonwalker-rgb

.github/workflows/terraform-scan.yml

@@ -0,0 +1,83 @@
+name: Terraform Security Scan
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - 'infrastructure/terraform/**'
+  push:
+    branches: [main]
+    paths:
+      - 'infrastructure/terraform/**'
+  workflow_dispatch:
+
+# Cancel any previous in-progress run for the same ref so superseded
+# commits on a PR don't waste runner minutes.
+concurrency:
+  group: terraform-scan-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  TF_WORKING_DIR: infrastructure/terraform
+
+jobs:
+  # -------------------------------------------------------------------------
+  # tfsec – static analysis of Terraform templates for security
+  # misconfigurations.  Reads .tfsec.yml from the working directory to
+  # determine minimum severity (HIGH / CRITICAL).
+  # -------------------------------------------------------------------------
+  tfsec:
+    name: tfsec
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run tfsec
+        uses: aquasecurity/tfsec-action@v1.0.3
+        with:
+          working_directory: ${{ env.TF_WORKING_DIR }}
+          # soft_fail: false causes the step to exit with code 1 (and fail the
+          # job) when any finding at or above the configured severity exists.
+          soft_fail: false
+          # The .tfsec.yml config in the working directory enforces a
+          # minimum_severity of HIGH, so only HIGH/CRITICAL issues gate CI.
+          # Valid formats: default, json, sarif, csv, checkstyle, junit, text.
+          format: text
+
+  # -------------------------------------------------------------------------
+  # checkov – comprehensive policy-as-code scanner covering CIS benchmarks,
+  # HIPAA, GDPR, and hundreds of built-in Terraform / K8s rules.
+  # -------------------------------------------------------------------------
+  checkov:
+    name: checkov
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run checkov
+        uses: bridgecrewio/checkov-action@v12
+        with:
+          directory: ${{ env.TF_WORKING_DIR }}
+          framework: terraform
+          # soft_fail: false causes the step to exit with code 1 when
+          # checkov finds any FAILED evaluation not already in the
+          # baseline (skipped / passed checks do not affect the exit code).
+          soft_fail: false
+          # Baseline file acknowledges pre-existing findings so CI only
+          # fails on new regressions, not the 85+ known issues.
+          # .checkov.baseline is auto-generated via `checkov --create-baseline`
+          # and committed to the repo so CI compares against known issues.
+          # Path is relative to the workspace root (checkout directory).
+          baseline: ${{ env.TF_WORKING_DIR }}/.checkov.baseline
+          # Only display failed checks in the action log for a cleaner
+          # scan summary.
+          quiet: true
+          # Use CLI output for a human-readable scan summary in the action log.
+          output_format: cli