terragrunt-quality.yml

on:
  workflow_call:
    inputs:
      workdir:
        required: false
        type: string
        default: .
      modules_path:
        required: false
        type: string
        default: modules
      checkov_enabled:
        required: false
        type: boolean
        default: true
      checkov_skip_path:
        required: false
        type: string
      checkov_baseline:
        required: false
        type: string

name: terragrunt-quality
jobs:
  terragrunt-lint:
    runs-on: ubuntu-latest
    env:
      GITHUB_ACTIONS: true
    steps:
      - name: checkout
        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
      - name: Setup TF and TG (via tenv)
        run: |
          VERSION=$(curl --silent https://api.github.com/repos/tofuutils/tenv/releases/latest | jq -r .tag_name)
          curl -O -L "https://github.com/tofuutils/tenv/releases/latest/download/tenv_${VERSION}_amd64.deb"
          sudo dpkg -i "tenv_${VERSION}_amd64.deb"
          tenv terraform install latest
          tenv terragrunt install latest
          tenv update-path
      - name: terraform fmt of directory ${{ inputs.modules_path }}
        run: terraform fmt -check -recursive -diff ${{ inputs.modules_path }}
      - name: terragrunt fmt of directory ${{ inputs.workdir }}
        run: terragrunt hclfmt --check --diff ${{ inputs.workdir }}
      - name: guacamole code quality checks
        id: guacamole
        uses: padok-team/guacamole-action@1cd4678ecf3f391ec25980769f1565ddd5cc6a4c # v1.3.1
        with:
          path: ${{ inputs.workdir }}
          verbose: true
  terragrunt-security:
    runs-on: ubuntu-latest
    if: inputs.checkov_enabled
    steps:
      - name: checkout
        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
      - name: checkov of ${{ inputs.modules_path }}
        uses: bridgecrewio/checkov-action@master
        with:
          directory: ${{ inputs.modules_path }}
          framework: terraform
          download_external_modules: false
          quiet: true
          skip_path: ${{ inputs.checkov_skip_path }}
          baseline: ${{ inputs.checkov_baseline }}