chore(ci): add ENVIRONMENT env var to docker execution step

Author: Wellington Gonzalez

.github/workflows/terraform-aws-security-analysis.yml

@@ -84,6 +84,7 @@ jobs:
             -e GEMINI_API_KEY="$GEMINI_API_KEY" \
             -e BRANCH_NAME="$BRANCH_NAME" \
             -e RUN_TIMESTAMP="$RUN_TIMESTAMP" \
+            -e ENVIRONMENT="develop" \
             -v "$GITHUB_WORKSPACE:/repo" \
             -v "$GITHUB_WORKSPACE/reports_output:/app/reports_output" \
             -w /repo \

README.md

@@ -157,33 +157,86 @@ on:
       - 'terraform/**'
 
 jobs:
-  analyze:
+  terraform_plan:
     runs-on: ubuntu-latest
+
+    services:
+      localstack:
+        image: localstack/localstack:latest
+        ports:
+          - 4566:4566
+        env:
+          SERVICES: s3,iam,ec2,sts,logs,events,cloudwatch,lambda,apigateway,ecs,elasticloadbalancing
+          DEBUG: "0"
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: hashicorp/setup-terraform@v3
+
+      - name: Terraform init/validate/plan against LocalStack
+        working-directory: ${{ inputs.terraform_dir }}
+        env:
+          AWS_ACCESS_KEY_ID: test
+          AWS_SECRET_ACCESS_KEY: test
+          AWS_DEFAULT_REGION: us-east-1
+          AWS_ENDPOINT_URL: http://localhost:4566
+          AWS_EC2_METADATA_DISABLED: "true"
+
+        run: |
+          terraform init -input=false -no-color -backend=false
+          terraform validate -no-color
+          terraform plan -input=false -no-color -refresh=false -out=tfplan.binary
+          terraform show -json tfplan.binary > plan.json
+
+      - name: Upload plan.json artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: terraform-plan-json
+          path: ${{ inputs.terraform_dir }}/plan.json
+          if-no-files-found: error
+
+  analyze_plan:
+    runs-on: ubuntu-latest
+    needs: terraform_plan
+
     steps:
       - uses: actions/checkout@v4
-      - name: Set up Terraform
-        uses: hashicorp/setup-terraform@v3
+
+      - uses: actions/download-artifact@v4
         with:
-          terraform_version: "1.6.0"
-      - name: Generate Plan
+          name: terraform-plan-json
+          path: artifacts_in
+
+      - run: mkdir -p reports_output
+
+      - name: Prepare execution metadata
+        id: metadata
         run: |
-          cd terraform/examples/your-example/env/dev
-          terraform init
-          terraform plan -out=tfplan.binary
-          terraform show -json tfplan.binary > ../../../../plans/tfplan.json
-      - name: Run Security Analyzer
+          echo "BRANCH_NAME=${GITHUB_REF_NAME}" >> $GITHUB_ENV
+          echo "RUN_TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")" >> $GITHUB_ENV
+
+      - name: Run analyzer (Docker)
+        env:
+          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
         run: |
-          docker build -t analyzer .
           docker run --rm \
-            -e GEMINI_API_KEY="${{ secrets.GEMINI_API_KEY }}" \
-            -v "$(pwd):/app" \
-            analyzer \
-            plans/tfplan.json
-      - name: Upload Report
+            -e GEMINI_API_KEY="$GEMINI_API_KEY" \
+            -e BRANCH_NAME="$BRANCH_NAME" \
+            -e RUN_TIMESTAMP="$RUN_TIMESTAMP" \
+            -e ENVIRONMENT="develop" \
+            -v "$GITHUB_WORKSPACE:/repo" \
+            -v "$GITHUB_WORKSPACE/reports_output:/app/reports_output" \
+            -w /repo \
+            wellingtoong/cloud-security-analyzer:1.0.1 \
+            artifacts_in/plan.json
+
+      - name: Upload HTML report artifact
         uses: actions/upload-artifact@v4
         with:
-          name: security-report
-          path: reports_output/
+          name: terraform-security-report-html
+          path: reports_output/terraform_security_report.html
+          if-no-files-found: error
 ```
 
 This pipeline generates plans, runs analysis, and publishes HTML reports as artifacts for review.