tf-security.yaml

name: Terraform Security
on:
  workflow_call:
    inputs:
      WORKING_DIRECTORY:
        type: string
        required: false
        default: "."
      ENVIRONMENT:
        type: string
        required: true

jobs:
  terraform-security:
    defaults:
      run:
        working-directory: ${{ inputs.WORKING_DIRECTORY }}
    runs-on: ubuntu-22.04
    steps:
      - name: download a build artifact
        uses: actions/download-artifact@v6.0.0
        id: download
        with:
          name: artifacts_${{inputs.ENVIRONMENT}}_${{github.sha}}
          path: ${{ inputs.WORKING_DIRECTORY }}

      - name: checkov
        uses: docker://bridgecrew/checkov:3.2.457@sha256:021af1112246ce9f6e8ba6acfd792e40efec59d60f64ca17cf7dce7825f55975
        with:
          entrypoint: checkov
          args: -f ${{ inputs.WORKING_DIRECTORY }}/test_${{inputs.ENVIRONMENT}}_${{github.sha}}.json -o cli -o junitxml --output-file-path ${{ inputs.WORKING_DIRECTORY }}/checkov.junit.xml -s

      - uses: actions/upload-artifact@v4.6.2
        with:
          name: checkov.junit.xml
          path: ${{ inputs.WORKING_DIRECTORY }}/checkov.junit.xml/results_junitxml.xml
          retention-days: 1