security-tfsec.yml

---
name: 🛡️ tfsec
on:
  workflow_call:
    inputs:
      working_directory:
        description: 'Directory where main.tf exist of the module.'
        required: false
        type: string
        default: './examples/'
    secrets:
      GITHUB:
        required: true
        description: 'PAT of the user to run the jobs.'

jobs:
  tfsec:
    name: 🧪 tfsec SARIF Report
    runs-on: ubuntu-latest

    steps:
      - name: 📦 Checkout Repository
        uses: actions/checkout@master

      - name: 🔍 Run tfsec
        uses: aquasecurity/tfsec-sarif-action@v0.1.4
        with:
          sarif_file: tfsec.sarif
          working_directory: ${{ inputs.working_directory}}
          full_repo_scan: true

      - name: 📤 Upload SARIF file
        uses: github/codeql-action/upload-sarif@v4
        with:
          # Path to SARIF file relative to the root of the repository
          sarif_file: tfsec.sarif
        continue-on-error: true

      - name: 💬 tfsec commenter for PR
        uses: tfsec/tfsec-pr-commenter-action@v1.3.1
        with:
          GITHUB_TOKEN: ${{ secrets.GITHUB}}
          working_directory: ${{ inputs.working_directory}}

      - name: 🔒 Terraform security scan Advanced
        uses: triat/terraform-security-scan@v3.2.0
        if: github.event_name == 'pull_request'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB}}
          tfsec_actions_working_dir: ${{ inputs.working_directory}}
          tfsec_actions_comment: true
          tfsec_output_format: sarif
        continue-on-error: true
...