├── LICENSE
├── README.md
├── action.yml
├── install.sh
└── run.sh
/LICENSE:
--------------------------------------------------------------------------------
1 | MIT License
2 |
3 | Copyright (c) 2020 terraform-compliance
4 |
5 | Permission is hereby granted, free of charge, to any person obtaining a copy
6 | of this software and associated documentation files (the "Software"), to deal
7 | in the Software without restriction, including without limitation the rights
8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 |
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 |
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # terraform-compliance GitHub Action
2 |
3 | 
terraform-compliance
4 |
5 |
25 |
26 |
27 |
28 | ---
29 |
30 |
31 | `terraform-compliance` is a lightweight, security and compliance focused test framework against terraform to enable negative testing capability for your infrastructure-as-code.
32 |
33 |
34 | - __compliance:__ Ensure the implemented code is following security standards, your own custom standards
35 | - __behaviour driven development:__ We have BDD for nearly everything, why not for IaC ?
36 | - __portable:__ just install it from `pip` or run it via `docker`. See [Installation](https://terraform-compliance.com/pages/installation/)
37 | - __pre-deploy:__ it validates your code before it is deployed
38 | - __easy to integrate:__ it can run in your pipeline (or in git hooks) to ensure all deployments are validated.
39 | - __segregation of duty:__ you can keep your tests in a different repository where a separate team is responsible.
40 | - __why ?:__ why not ?
41 |
42 | You can use this action in order to run [terraform-compliance](https://terraform-compliance.com) in your GitHub Actions pipeline. For more information about the tool itself, you can have a look on https://terraform-compliance.com
43 |
44 | # How to use this action ?
45 |
46 | 1. [Enable and Configure](https://help.github.com/en/actions/configuring-and-managing-workflows/configuring-a-workflow) GitHub actions within your respository.
47 | 2. Use `terraform-compliance/github-action@main`
48 | 3. Supply `plan` and `features` required parameters
49 | 4. Supply optional other parameters
50 |
51 |
52 | `terraform-compliance` requires to have access to 2 things in order to execute properly
53 |
54 | 1. terraform plan output (preferably converted to `json` format via `terraform show -json` command)
55 | 2. compliance tests that will run against your terraform plan.
56 |
57 | # Examples
58 |
59 | An example CI pipeline for a terraform might look like this ;
60 |
61 | ```yml
62 | jobs:
63 | terraform:
64 | name: terraform CI
65 | runs-on: ubuntu-latest
66 |
67 | steps:
68 | - uses: actions/checkout@v2
69 | - uses: hashicorp/setup-terraform@v1
70 |
71 | - name: terraform plan
72 | id: plan
73 | run: |
74 | terraform init && terraform plan -out=plan.out && terraform show -json plan.out > plan.out.json
75 |
76 | - name: terraform-compliance
77 | uses: terraform-compliance/github_action@main
78 | with:
79 | plan: plan.out.json
80 | features: ssh://git@github.com/terraform-compliance/user-friendly-features.git
81 | ```
82 |
83 | .. or if you want to install `terraform-compliance` in the beginning of the steps and re-use it every time via `run` directive ;
84 |
85 | ```yml
86 | jobs:
87 | terraform:
88 | name: terraform CI
89 | runs-on: ubuntu-latest
90 |
91 | steps:
92 | - uses: actions/checkout@v2
93 | - uses: hashicorp/setup-terraform@v1
94 | - uses: terraform-compliance/github_action@main
95 |
96 | - name: terraform plan
97 | id: plan
98 | run: |
99 | terraform init && terraform plan -out=plan.out && terraform show -json plan.out > plan.out.json
100 |
101 | - name: terraform-compliance
102 | id: terraform-compliance from remote repo
103 | run: |
104 | terraform-compliance -p /path/to/plan.out.json -f git:ssh://git@github.com/terraform-compliance/user-friendly-features.git
105 |
106 | - name: terraform-compliance
107 | id: terraform-compliance from local
108 | run: |
109 | terraform-compliance -p /path/to/plan.out.json -f /path/to/local
110 | ```
111 |
112 | Additionaly, in case you want to publish the plan output to the related Pull Request, you can also use this action provided by GitHub as well ;
113 |
114 | ```yml
115 | - uses: actions/github-script@0.9.0
116 | if: github.event_name == 'pull_request'
117 | env:
118 | PLAN: "terraform\n${{ steps.plan.outputs.stdout }}"
119 | with:
120 | github-token: ${{ secrets.GITHUB_TOKEN }}
121 | script: |
122 | GitHub Plan
123 |
124 | \`\`\`${process.env.PLAN}\`\`\`
125 |
126 | 
9 |
10 |
11 |
12 |
13 | 
14 |
15 |
16 |
17 |
18 | 
19 |
20 |
21 |
22 |