Skip to content

Commit e096b31

Browse files
zodilibzodilib
committed
[PFMENG-2716] fix v2 for dualstack
1 parent 1eb4e7e commit e096b31

File tree

1 file changed

+292
-3
lines changed

1 file changed

+292
-3
lines changed

‎.github/workflows/terraform.yaml

Lines changed: 292 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ env:
113113

114114
jobs:
115115
fmt-validate:
116-
if: github.ref_name != 'main' && inputs.enable_format == true
116+
if: github.ref_name != 'main' && inputs.enable_format == true && inputs.runner_label != 'platform-eng-ent-v2-dual'
117117
name: Format and Validate
118118
runs-on:
119119
- ${{ inputs.default_runner_override_label }}
@@ -212,7 +212,7 @@ jobs:
212212

213213
lint:
214214
name: Linting
215-
if: github.ref_name != 'main' && inputs.enable_lint == true
215+
if: github.ref_name != 'main' && inputs.enable_lint == true && inputs.runner_label != 'platform-eng-ent-v2-dual'
216216
runs-on:
217217
- ${{ inputs.default_runner_override_label }}
218218
- ${{ inputs.runner_label }}
@@ -340,7 +340,7 @@ jobs:
340340
#steps.tflint.outcome check for outcome
341341
security:
342342
name: Security Checks
343-
if: github.ref_name != 'main' && inputs.enable_security_check == true
343+
if: github.ref_name != 'main' && inputs.enable_security_check == true && inputs.runner_label != 'platform-eng-ent-v2-dual'
344344
runs-on:
345345
- ${{ inputs.default_runner_override_label }}
346346
- ${{ inputs.runner_label }}
@@ -402,3 +402,292 @@ jobs:
402402
uses: github/codeql-action/upload-sarif@v3
403403
with:
404404
sarif_file: 'results.sarif'
405+
406+
fmt-validate_on_dualstack:
407+
if: github.ref_name != 'main' && inputs.enable_format == true && inputs.runner_label == 'platform-eng-ent-v2-dual'
408+
name: Format and Validate
409+
runs-on:
410+
- ${{ inputs.runner_label }}
411+
steps:
412+
- name: Checkout
413+
uses: actions/checkout@v4
414+
with:
415+
fetch-depth: 1
416+
submodules: ${{ inputs.enable_submodules }}
417+
418+
- uses: actions/setup-python@v5
419+
with:
420+
python-version: '3.11'
421+
422+
- run: mkdir -p "${TF_PLUGIN_CACHE_DIR}"
423+
- name: Cache Terraform
424+
uses: actions/cache@v4
425+
with:
426+
path: ${{ env.TF_PLUGIN_CACHE_DIR }}
427+
key: ${{ runner.os }}-terraform-${{ hashFiles('**/.terraform.lock.hcl') }}
428+
- name: Cache TFLint plugin dir
429+
uses: actions/cache@v4
430+
with:
431+
path: ~/.tflint.d/plugins
432+
key: ${{ runner.os }}-tflint-${{ hashFiles('**/.tflint.hcl') }}
433+
434+
- name: Setup Node only for self-hosted runners
435+
uses: actions/setup-node@v4
436+
if: ${{ inputs.runner_label == 'platform-eng-ent-v2-dual' }}
437+
with:
438+
node-version: 18
439+
440+
- name: Setup Terraform
441+
uses: hashicorp/setup-terraform@v3
442+
with:
443+
terraform_version: latest
444+
cli_config_credentials_token: ${{ secrets.TFE_TOKEN }}
445+
446+
- name: Setup Helm
447+
uses: azure/setup-helm@v4
448+
with:
449+
version: 'latest'
450+
token: ${{ secrets.GITHUB_TOKEN }}
451+
452+
- name: Pre-init Hook
453+
run: ${{ inputs.pre_init_hook }}
454+
455+
- name: Precommit Skips
456+
id: precommit_skips
457+
run: |
458+
SKIPS="shellcheck,tflint,terraform_tflint,markdown-link-check,terraform_docs,terraform_tfsec,checkov,terraform_checkov"
459+
if [ "${branch}" == "${main_branch}" ];then
460+
SKIPS="${SKIPS},no-commit-to-branch"
461+
fi
462+
if [ "${{inputs.skip_precommit}}" != "" ]; then
463+
SKIPS="${SKIPS},${{inputs.skip_precommit}}"
464+
fi
465+
466+
echo "${SKIPS}"
467+
echo "skips=${SKIPS}" >> "${GITHUB_OUTPUT}"
468+
env:
469+
branch: ${{ github.ref_name }}
470+
main_branch: ${{ inputs.main_branch }}
471+
472+
- name: precommit run hooks
473+
id: precommit_run_hooks #Run on all PRs from the same repo, fork repos to run all
474+
if: inputs.pre_commit_run_all == false
475+
env:
476+
SKIP: ${{ steps.precommit_skips.outputs.skips }}
477+
run: |
478+
pip install pre-commit
479+
git fetch origin
480+
if [ "$GITHUB_EVENT_NAME" == 'pull_request' ]
481+
then
482+
if [ ${{ github.event.pull_request.head.repo.full_name }} == ${{ github.repository }} ]
483+
then
484+
pre-commit run --from-ref origin/${{ github.base_ref }} --to-ref ${{ github.event.pull_request.head.sha }} --color=always --show-diff-on-failure
485+
else
486+
pre-commit run --color=always --show-diff-on-failure --all-files
487+
fi
488+
else
489+
pre-commit run --from-ref origin/${{ github.event.repository.default_branch }} --to-ref "$GITHUB_SHA" --color=always --show-diff-on-failure
490+
fi
491+
492+
- name: precommit run tflint hooks
493+
id: precommit_run_hooks_all
494+
if: inputs.pre_commit_run_all
495+
uses: pre-commit/[email protected]
496+
env:
497+
SKIP: ${{ steps.precommit_skips.outputs.skips }}
498+
with:
499+
extra_args: --color=always --show-diff-on-failure --all-files
500+
501+
- run: terraform -v
502+
503+
lint_on_dualstack:
504+
name: Linting
505+
if: github.ref_name != 'main' && inputs.enable_lint == true && inputs.runner_label == 'platform-eng-ent-v2-dual'
506+
runs-on:
507+
- ${{ inputs.runner_label }}
508+
steps:
509+
- name: Checkout
510+
uses: actions/checkout@v4
511+
with:
512+
fetch-depth: 1
513+
submodules: ${{ inputs.enable_submodules }}
514+
515+
- uses: actions/setup-python@v5
516+
with:
517+
python-version: '3.11'
518+
519+
- run: mkdir -p "${TF_PLUGIN_CACHE_DIR}"
520+
- name: Cache Terraform
521+
uses: actions/cache@v4
522+
with:
523+
path: ${{ env.TF_PLUGIN_CACHE_DIR }}
524+
key: ${{ runner.os }}-terraform-${{ hashFiles('**/.terraform.lock.hcl') }}
525+
526+
- name: Setup Terraform
527+
uses: hashicorp/setup-terraform@v3
528+
with:
529+
terraform_version: latest
530+
cli_config_credentials_token: ${{ secrets.TFE_TOKEN }}
531+
532+
- name: Setup Helm
533+
uses: azure/setup-helm@v4
534+
with:
535+
version: 'latest'
536+
537+
- name: Cache TFlint
538+
uses: actions/cache@v4
539+
with:
540+
path: /home/runner/.tflint.d/plugins
541+
key: ${{ runner.os }}-tflint-${{ hashFiles('.tflint.hcl') }}
542+
543+
- name: Setup TFLint
544+
uses: terraform-linters/setup-tflint@v4
545+
with:
546+
tflint_version: "v0.51.1"
547+
github_token: ${{ secrets.GITHUB_TOKEN }}
548+
549+
- name: Setup Node only for self-hosted runners
550+
uses: actions/setup-node@v4
551+
if: ${{ inputs.runner_label == 'platform-eng-ent-v2-dual' }}
552+
with:
553+
node-version: 19
554+
555+
- name: Pre-init Hook
556+
run: ${{ inputs.pre_init_hook }}
557+
558+
- name: set PY for precommit cache
559+
run: echo "PY=$(python -VV | sha256sum | cut -d' ' -f1)" >> "$GITHUB_ENV"
560+
561+
- name: Cache Pre-commit
562+
uses: actions/cache@v4
563+
with:
564+
path: ~/.cache/pre-commit
565+
key: pre-commit|${{ env.PY }}|${{ hashFiles('.pre-commit-config.yaml') }}
566+
567+
- name: Precommit Skips
568+
id: precommit_skips
569+
run: |
570+
SKIPS="shellcheck,terraform_fmt,terraform_providers_lock,markdown-link-check,terraform_docs,terraform_tfsec,checkov,terraform_checkov,terraform_checkov"
571+
if [ "${branch}" == "${main_branch}" ];then
572+
SKIPS="${SKIPS},no-commit-to-branch"
573+
fi
574+
if [ "${{inputs.skip_precommit}}" != "" ]; then
575+
SKIPS="${SKIPS},${{inputs.skip_precommit}}"
576+
fi
577+
578+
echo "${SKIPS}"
579+
echo "skips=${SKIPS}" >> "${GITHUB_OUTPUT}"
580+
env:
581+
branch: ${{ github.ref_name }}
582+
main_branch: ${{ inputs.main_branch }}
583+
584+
- name: precommit run tflint hooks for only changed files
585+
id: precommit_run_hooks #Run on all PRs from the same repo, fork repos to run all
586+
if: inputs.pre_commit_run_all == false
587+
continue-on-error: ${{ inputs.skip_tflint_warn_for_changed_files }}
588+
env:
589+
SKIP: ${{ steps.precommit_skips.outputs.skips }}
590+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
591+
run: |
592+
pip install pre-commit
593+
git fetch origin
594+
if [ "$GITHUB_EVENT_NAME" == 'pull_request' ]
595+
then
596+
if [ ${{ github.event.pull_request.head.repo.full_name }} == ${{ github.repository }} ]
597+
then
598+
pre-commit run --from-ref origin/${{ github.base_ref }} --to-ref ${{ github.event.pull_request.head.sha }} --color=always --show-diff-on-failure
599+
else
600+
pre-commit run --color=always --show-diff-on-failure --all-files
601+
fi
602+
else
603+
pre-commit run --from-ref origin/${{ github.event.repository.default_branch }} --to-ref "$GITHUB_SHA" --color=always --show-diff-on-failure
604+
fi
605+
606+
- name: precommit run tflint hooks
607+
id: precommit_run_hooks_all
608+
if: inputs.pre_commit_run_all
609+
uses: pre-commit/[email protected]
610+
continue-on-error: true
611+
env:
612+
SKIP: ${{ steps.precommit_skips.outputs.skips }}
613+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
614+
with:
615+
extra_args: --color=always --show-diff-on-failure --all-files
616+
617+
- name: Check status code
618+
if: steps.precommit_run_hooks.outcome == 'failure'
619+
run: |
620+
# SKIP_WARN for skipping all warnings
621+
skip_warn="${{ inputs.skip_tflint_warn }}"
622+
if [ "$skip_warn" = true ]; then
623+
echo "TFLint warnings and errors found and skipped."
624+
else
625+
echo "TFLint errors found, expected '0'. Failing... To enable skipping please set 'skip_tflint_warn' to true in workflow file"
626+
exit 1
627+
fi
628+
629+
#steps.tflint.outcome check for outcome
630+
631+
security_on_dualstack:
632+
name: Security Checks
633+
if: github.ref_name != 'main' && inputs.enable_security_check == true && inputs.runner_label == 'platform-eng-ent-v2-dual'
634+
runs-on:
635+
- ${{ inputs.runner_label }}
636+
steps:
637+
- name: Checkout
638+
uses: actions/checkout@v4
639+
with:
640+
fetch-depth: 1
641+
submodules: ${{ inputs.enable_submodules }}
642+
643+
- name: Run Trivy vulnerability scanner in IaC mode
644+
uses: aquasecurity/[email protected]
645+
with:
646+
scan-type: 'config'
647+
hide-progress: false
648+
format: ${{ inputs.trivy_format }}
649+
output: ${{ inputs.trivy_output }}
650+
ignore-unfixed: true
651+
severity: 'CRITICAL,HIGH'
652+
653+
- name: Upload Trivy scan results to Github for inspection
654+
if: ${{ inputs.trivy_inspect_output == 'true' }}
655+
uses: actions/upload-artifact@v4
656+
with:
657+
path: ${{ inputs.trivy_output }}
658+
retention-days: 1
659+
660+
# https://github.com/aquasecurity/trivy/issues/5003
661+
- name: Remove git from url for sarif uploading
662+
if: ${{ inputs.trivy_format == 'sarif' && inputs.trivy_output != '' }}
663+
shell: bash
664+
run: |
665+
sed -i 's#git::https:/##g' ${{ inputs.trivy_output }}
666+
667+
- name: Upload Trivy scan results to GitHub Security tab
668+
if: inputs.upload_sarif == true
669+
uses: github/codeql-action/upload-sarif@v3
670+
with:
671+
sarif_file: ${{ inputs.trivy_output }}
672+
673+
- name: Get changed files
674+
id: changed-files
675+
uses: tj-actions/changed-files@v44
676+
677+
- name: Run Checkov action
678+
id: checkov
679+
uses: bridgecrewio/checkov-action@master
680+
with:
681+
output_format: sarif
682+
quiet: ${{ inputs.checkov_output_quiet }}
683+
file: ${{ steps.changed-files.outputs.all_changed_files }}
684+
skip_check: ${{ inputs.checkov_skip_check }}
685+
download_external_modules: ${{ inputs.checkov_download_external_modules }}
686+
skip_path: ${{inputs.checkov_skip_path}}
687+
skip_framework: ${{inputs.checkov_skip_framework}}
688+
689+
- name: Upload Checkov scan results to GitHub Security tab
690+
if: inputs.upload_sarif == true
691+
uses: github/codeql-action/upload-sarif@v3
692+
with:
693+
sarif_file: 'results.sarif'

0 commit comments

Comments
 (0)