static_analysis.yml

name: Static Analysis

on:
  push:

jobs:
  static_analysis:
    runs-on: ubuntu-latest

    steps:
      # from https://github.com/actions/checkout/commits/main
      - uses: actions/checkout@1f9a0c22da41e6ebfa534300ef656657ea2c6707

      - name: init_terraform_folders
        env:
          FOLDERS: >
            src/core
            src/.template-app
            src/.template-common
            src/aks-platform
            src/domains/citizen-auth-app
            src/domains/citizen-auth-common
            src/domains/messages-app
            src/domains/messages-common
            src/domains/payments-app
            src/domains/payments-common
            src/domains/profile-app
            src/domains/profile-common
            src/domains/sign
        run: |
          pids=()

          TAG=$(cat .terraform-version)
          for f in $FOLDERS; do
            pushd "$(pwd)/${f}"
              sed -i -e 's/  backend "azurerm" {}//g' 99_main.tf # use local backend
              docker run -v $(pwd):/tmp -w /tmp hashicorp/terraform:$TAG init &
              pids+=($!)
            popd
          done

          # Wait for each specific process to terminate.
          # Instead of this loop, a single call to 'wait' would wait for all the jobs
          # to terminate, but it would not give us their exit status.
          #
          for pid in "${pids[@]}"; do
            #
            # Waiting on a specific PID makes the wait command return with the exit
            # status of that process. Because of the 'set -e' setting, any exit status
            # other than zero causes the current shell to terminate with that exit
            # status as well.
            #
            wait "$pid"
          done

      - name: run_pre_commit_terraform
        run: |
          TAG="v1.80.0@sha256:840b08605df81e6e1cdd443adce13e7ed2de4345345705411a0656eda760c84e"
          docker run -v $(pwd):/lint -w /lint ghcr.io/antonbabenko/pre-commit-terraform:$TAG run -a