fix(governance): make required_approvals governable and reject dead c… #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Terraform Security Scan | |
| on: | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - 'infrastructure/terraform/**' | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'infrastructure/terraform/**' | |
| workflow_dispatch: | |
| # Cancel any previous in-progress run for the same ref so superseded | |
| # commits on a PR don't waste runner minutes. | |
| concurrency: | |
| group: terraform-scan-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| env: | |
| TF_WORKING_DIR: infrastructure/terraform | |
| jobs: | |
| # ------------------------------------------------------------------------- | |
| # tfsec – static analysis of Terraform templates for security | |
| # misconfigurations. Reads .tfsec.yml from the working directory to | |
| # determine minimum severity (HIGH / CRITICAL). | |
| # ------------------------------------------------------------------------- | |
| tfsec: | |
| name: tfsec | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Run tfsec | |
| uses: aquasecurity/tfsec-action@v1.0.3 | |
| with: | |
| working_directory: ${{ env.TF_WORKING_DIR }} | |
| # soft_fail: false causes the step to exit with code 1 (and fail the | |
| # job) when any finding at or above the configured severity exists. | |
| soft_fail: false | |
| # The .tfsec.yml config in the working directory enforces a | |
| # minimum_severity of HIGH, so only HIGH/CRITICAL issues gate CI. | |
| # Valid formats: default, json, sarif, csv, checkstyle, junit, text. | |
| format: text | |
| # ------------------------------------------------------------------------- | |
| # checkov – comprehensive policy-as-code scanner covering CIS benchmarks, | |
| # HIPAA, GDPR, and hundreds of built-in Terraform / K8s rules. | |
| # ------------------------------------------------------------------------- | |
| checkov: | |
| name: checkov | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Run checkov | |
| uses: bridgecrewio/checkov-action@v12 | |
| with: | |
| directory: ${{ env.TF_WORKING_DIR }} | |
| framework: terraform | |
| # soft_fail: false causes the step to exit with code 1 when | |
| # checkov finds any FAILED evaluation not already in the | |
| # baseline (skipped / passed checks do not affect the exit code). | |
| soft_fail: false | |
| # Baseline file acknowledges pre-existing findings so CI only | |
| # fails on new regressions, not the 85+ known issues. | |
| # .checkov.baseline is auto-generated via `checkov --create-baseline` | |
| # and committed to the repo so CI compares against known issues. | |
| # Path is relative to the workspace root (checkout directory). | |
| baseline: ${{ env.TF_WORKING_DIR }}/.checkov.baseline | |
| # Only display failed checks in the action log for a cleaner | |
| # scan summary. | |
| quiet: true | |
| # Use CLI output for a human-readable scan summary in the action log. | |
| output_format: cli |