main.yml

name: Terraform validation

on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]

env:
  TERRAFORM_DOCS_VERSION: "v0.15.0"
  TFLINT_VERSION: "v0.25.0"
  TFSEC_VERSION: "v0.39.6"

jobs:
  terraform-validation:
    runs-on: ubuntu-20.04

    steps:
      - uses: actions/setup-python@v2
        name: "SETUP: Python"

      - uses: actions/cache@v2.0.0
        id: cache-terraform-docs
        name: "CACHE: terraform-docs"
        with:
          path: |
            ~/terraform-docs/bin/
          key: ${{ runner.os }}-terraform_docs-${{ env.TERRAFORM_DOCS_VERSION }}
          restore-keys: |
            ${{ runner.os}}-terraform_docs-

      - shell: bash
        name: "INSTALL: terraform-docs"
        if: steps.cache-terraform-docs.output.cache-hit != 'true'
        run: |
          wget https://github.com/terraform-docs/terraform-docs/releases/download/${{ env.TERRAFORM_DOCS_VERSION }}/terraform-docs-${{ env.TERRAFORM_DOCS_VERSION }}-linux-amd64.tar.gz
          tar xvzf terraform-docs-${{ env.TERRAFORM_DOCS_VERSION }}-linux-amd64.tar.gz
          mkdir -p ~/terraform-docs/bin/
          install terraform-docs ~/terraform-docs/bin/

      - shell: bash
        name: "SETUP: terraform-docs path"
        run: echo '~/terraform-docs/bin/' >> $GITHUB_PATH

      - uses: actions/checkout@v2
        name: Checkout source code

      - uses: actions/cache@v2
        id: cache-pre-commit-dependencies
        name: "CACHE: pip and pre-commit dependencies"
        with:
          path: |
            ~/.cache/pre-commit
            ~/.cache/pip
          key: ${{ runner.os }}-pip-pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pip-pre-commit-

      - uses: actions/cache@v2
        id: cache-tflint
        name: "CACHE: tflint"
        with:
          path: |
            ~/tflint/bin/
          key: ${{ runner.os }}-tflint-${{ env.TFLINT_VERSION }}
          restore-keys: |
            ${{ runner.os }}-tflint-

      - shell: bash
        name: "INSTALL: detect-secrets"
        run: |
          pip install detect-secrets

      - shell: bash
        name: "INSTALL: tflint"
        if: steps.cache-tflint.outputs.cache-hit != 'true'
        run: |
          wget https://github.com/terraform-linters/tflint/releases/download/${{ env.TFLINT_VERSION }}/tflint_linux_amd64.zip
          unzip tflint_linux_amd64.zip
          mkdir -p ~/tflint/bin/
          install tflint ~/tflint/bin/

      - shell: bash
        name: "SETUP: tflint path"
        run: echo '~/tflint/bin/' >> $GITHUB_PATH

      - uses: actions/cache@v2
        id: cache-tfsec
        name: "CACHE: tfsec"
        with:
          path: |
            ~/tfsec/bin/
          key: ${{ runner.os }}-tfsec-${{ env.TFSEC_VERSION }}
          restore-keys: |
            ${{ runner.os }}-tfsec-

      - shell: bash
        name: "INSTALL: tfsec"
        if: steps.cache-tfsec.outputs.cache-hit != 'true'
        run: |
          wget https://github.com/tfsec/tfsec/releases/download/${{ env.TFSEC_VERSION }}/tfsec-linux-amd64
          mkdir -p ~/tfsec/bin/
          install tfsec-linux-amd64 ~/tfsec/bin/

      - shell: bash
        name: "SETUP: tfsec path"
        run: echo '~/tfsec/bin/' >> $GITHUB_PATH

      - uses: pre-commit/action@v2.0.0
        name: "RUN: pre-commit"
        env:
          AWS_DEFAULT_REGION: "eu-central-1"