Skip to content

Commit 32c193f

Browse files
author
Anket Satbhai
authored
fix: rename security-stf-checks.yml to stf-checks.yml (#322)
1 parent 53128e9 commit 32c193f

4 files changed

Lines changed: 202 additions & 4 deletions

File tree

.github/workflows/security-stf-checks.yml renamed to .github/workflows/stf-checks.yml

File renamed without changes.

‎README.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -128,10 +128,10 @@ Above example is just a simple example to call workflow from github shared workf
128128
129129
| Category | Count | Workflows |
130130
|----------|-------|-----------|
131-
| **Terraform** | 9 | Checks, Lint, Workflow, Drift, PR Checks, Smurf, Monorepo Tag Release |
131+
| **Terraform** | 9 | Checks, Lint, Workflow, Drift, PR Checks, Smurf, Monorepo Tag Release, STF Checks |
132132
| **Docker** | 4 | Build Push, Scanner, Scout, Smurf Helm |
133133
| **PR Automation** | 7 | Auto Assignee, Auto Merge, Checks, Claude Review, Gemini Review, Gitleaks, Lock, Stale |
134-
| **Security** | 5 | Checkov, Prowler, Powerpipe, TFSec, STF Checks |
134+
| **Security** | 5 | Checkov, Prowler, Powerpipe, TFSec |
135135
| **AWS** | 3 | Prowler, SSM Send Command, Remote SSH Command |
136136
| **CloudFormation** | 3 | Deploy, Deploy StackSet, Lint |
137137
| **Release** | 3 | Tag, Changelog, Changelog Internal |
@@ -193,6 +193,7 @@ Above example is just a simple example to call workflow from github shared workf
193193
* [Example for terraform checks with azure cloud](./docs/tf-checks.md#example-for-terraform-checks-with-azure-cloud)
194194
* [Example for terraform checks with aws cloud](./docs/tf-checks.md#example-for-terraform-checks-with-aws-cloud)
195195
* [Example for terraform checks with digitalocean cloud](./docs/tf-checks.md#example-for-terraform-checks-with-digitalocean-cloud)
196+
- [Terraform Smurf Checks](./docs/stf-checks.md)
196197
- [Terraform Drift Workflow](./docs/tf-drift.md)
197198
- [Terraform Lint Workflow](./docs/tf-lint.md)
198199
- [Terraform Monorepo Tag Release Workflow](./docs/tf-monorepo-tag-release.md)
@@ -280,7 +281,7 @@ Please review our [Security Policy](./.github/SECURITY.md) before reporting secu
280281
<summary><b>☁️ Infrastructure as Code</b> - Deploy with confidence</summary>
281282
282283
- [Terraform Workflow](./docs/tf-workflow.md) - Full Terraform lifecycle management
283-
- [Terraform Checks](./docs/tf-checks.md) - Validation and testing
284+
- [Terraform Smurf Checks](./docs/stf-checks.md) - Validation and testing
284285
- [CloudFormation Deploy](./docs/cf-deploy.md) - AWS CloudFormation deployment
285286
286287
</details>

‎WORKFLOW_CATALOG.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ Complete index of all available workflows organized by category and use case.
2424
| Workflow | Description | Use Case |
2525
|----------|-------------|----------|
2626
| [tf-checks.yml](./.github/workflows/tf-checks.yml) | Validate, format, init, plan | Pre-commit validation |
27+
| [stf-checks.yml](./.github/workflows/stf-checks.yml) | Validate, format, init, plan | Pre-commit validation |
2728
| [tf-workflow.yml](./.github/workflows/tf-workflow.yml) | Full lifecycle (plan, apply, destroy) | Infrastructure deployment |
2829
| [tf-lint.yml](./.github/workflows/tf-lint.yml) | Lint Terraform code | Code quality checks |
2930
| [tf-drift.yml](./.github/workflows/tf-drift.yml) | Detect infrastructure drift | Compliance checking |
@@ -61,7 +62,6 @@ Complete index of all available workflows organized by category and use case.
6162
| [security-prowler.yml](./.github/workflows/security-prowler.yml) | Cloud security assessment | Multi-cloud security |
6263
| [security-powerpipe.yml](./.github/workflows/security-powerpipe.yml) | Compliance checking | Regulatory compliance |
6364
| [security-tfsec.yml](./.github/workflows/security-tfsec.yml) | Terraform security scanner | Terraform security |
64-
| [security-stf-checks.yml](./.github/workflows/security-stf-checks.yml) | STF security checks | Additional security |
6565

6666
### 🔄 PR Automation Workflows
6767

@@ -140,6 +140,7 @@ Complete index of all available workflows organized by category and use case.
140140
6. tf-workflow.yml # Deploy infrastructure
141141
7. helm-deploy.yml # Deploy to Kubernetes
142142
8. notify-slack.yml # Notify team
143+
9. stf-checks.yml # Smurf Terraform Validation
143144
```
144145

145146
### Security-First Pipeline

‎docs/stf-checks.md‎

Lines changed: 196 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,196 @@
1+
## [Smurf Terraform Checks Workflow](https://github.com/clouddrove/github-shared-workflows/blob/master/.github/workflows/tf-checks.yml)
2+
3+
This workflow automates smurf terraform checks including format, init, validate, and optionally plan and version compatibility testing. It utilizes the workflows defined in `.github/workflows/stf-checks.yml`
4+
5+
### Features
6+
7+
- ✅ Format checking
8+
- ✅ Terraform init and validate
9+
- ✅ Optional terraform plan
10+
- ✅ Optional min/max version compatibility testing
11+
- ✅ Support for AWS, Azure, GCP, and DigitalOcean
12+
- ✅ Configurable working directory and terraform version
13+
14+
### Usage
15+
16+
#### Basic Usage (Format, Init, Validate)
17+
18+
```yaml
19+
name: Terraform Checks
20+
on:
21+
push:
22+
branches: [ master ]
23+
pull_request:
24+
25+
jobs:
26+
terraform-checks:
27+
uses: clouddrove/github-shared-workflows/.github/workflows/stf-checks.yml@master
28+
with:
29+
working_directory: './examples/complete/'
30+
provider: 'azurerm'
31+
secrets:
32+
AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}
33+
```
34+
35+
#### With smurf stf Plan
36+
37+
```yaml
38+
name: Smurf Terraform Checks with Plan
39+
on:
40+
push:
41+
branches: [ master ]
42+
43+
jobs:
44+
terraform-checks:
45+
uses: clouddrove/github-shared-workflows/.github/workflows/stf-checks.yml@master
46+
with:
47+
working_directory: './examples/complete/'
48+
provider: 'aws'
49+
enable_plan: true
50+
var_file: 'vars/dev.tfvars'
51+
aws_region: 'us-east-1'
52+
secrets:
53+
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
54+
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
55+
GITHUB: ${{ secrets.GITHUB }}
56+
TF_API_TOKEN: ${{ secrets.TF_API_TOKEN }}
57+
```
58+
59+
#### With Version Compatibility Testing
60+
61+
```yaml
62+
name: Terraform Version Checks
63+
on:
64+
push:
65+
branches: [ master ]
66+
67+
jobs:
68+
terraform-checks:
69+
uses: clouddrove/github-shared-workflows/.github/workflows/stf-checks.yml@master
70+
with:
71+
working_directory: './examples/complete/'
72+
provider: 'aws'
73+
enable_version_check: true
74+
aws_region: 'us-east-1'
75+
secrets:
76+
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
77+
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
78+
BUILD_ROLE: ${{ secrets.BUILD_ROLE }}
79+
```
80+
81+
### Example for smurf terraform checks with azure cloud
82+
83+
```yaml
84+
name: Terraform Checks Azure
85+
on:
86+
push:
87+
branches: [ master ]
88+
89+
jobs:
90+
terraform-checks:
91+
uses: clouddrove/github-shared-workflows/.github/workflows/stf-checks.yml@master
92+
with:
93+
working_directory: './examples/complete/'
94+
provider: 'azurerm'
95+
enable_plan: true
96+
secrets:
97+
AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}
98+
GITHUB: ${{ secrets.GITHUB }}
99+
```
100+
101+
### Example for smurf terraform checks with aws cloud
102+
103+
```yaml
104+
name: Smurf Terraform Checks AWS
105+
on:
106+
push:
107+
branches: [ master ]
108+
109+
jobs:
110+
terraform-checks:
111+
uses: clouddrove/github-shared-workflows/.github/workflows/stf-checks.yml@master
112+
with:
113+
working_directory: './examples/complete/'
114+
provider: 'aws'
115+
enable_plan: true
116+
aws_region: 'us-east-1'
117+
secrets:
118+
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
119+
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
120+
BUILD_ROLE: ${{ secrets.BUILD_ROLE }}
121+
GITHUB: ${{ secrets.GITHUB }}
122+
```
123+
124+
### Example for smurf terraform checks with digitalocean cloud
125+
126+
```yaml
127+
name: Terraform Checks DigitalOcean
128+
on:
129+
push:
130+
branches: [ master ]
131+
132+
jobs:
133+
terraform-checks:
134+
uses: clouddrove/github-shared-workflows/.github/workflows/stf-checks.yml@master
135+
with:
136+
working_directory: './examples/complete/'
137+
provider: 'digitalocean'
138+
secrets:
139+
DIGITALOCEAN_ACCESS_TOKEN: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}
140+
GITHUB: ${{ secrets.GITHUB }}
141+
```
142+
143+
### Example for smurf terraform checks with GCP cloud
144+
145+
```yaml
146+
name: Terraform Checks GCP
147+
on:
148+
push:
149+
branches: [ master ]
150+
151+
jobs:
152+
terraform-checks:
153+
uses: clouddrove/github-shared-workflows/.github/workflows/stf-checks.yml@master
154+
with:
155+
working_directory: './examples/complete/'
156+
provider: 'gcp'
157+
enable_version_check: true
158+
project_id: 'my-gcp-project'
159+
secrets:
160+
GCP_CREDENTIALS: ${{ secrets.GCP_CREDENTIALS }}
161+
WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
162+
SERVICE_ACCOUNT: ${{ secrets.SERVICE_ACCOUNT }}
163+
```
164+
165+
### Input Parameters
166+
167+
| Parameter | Required | Default | Description |
168+
|-----------|----------|---------|-------------|
169+
| `working_directory` | No | `'./examples/complete/'` | Directory where terraform code exists |
170+
| `provider` | No | `azurerm` | Cloud provider: `azurerm`, `aws`, `gcp`, or `digitalocean` |
171+
| `aws_region` | No | `us-east-1` | AWS region for deployment |
172+
| `var_file` | No | `""` | Terraform var file directory (e.g., `vars/dev.tfvars`) |
173+
| `terraform_version` | No | Latest | Specific Terraform version to use |
174+
| `enable_version_check` | No | `false` | Enable min/max version compatibility testing |
175+
| `enable_plan` | No | `false` | Enable terraform plan step |
176+
| `role_duration_seconds` | No | `3600` | AWS role duration in seconds (900-43200) |
177+
| `project_id` | No | - | GCP project ID |
178+
| `token_format` | No | `access_token` | GCP token format (`access_token` or `id_token`) |
179+
| `access_token_lifetime` | No | `300s` | GCP access token lifetime |
180+
| `create_credentials_file` | No | `true` | Create GCP credentials file |
181+
182+
### Secrets
183+
184+
| Secret | Required | Description |
185+
|--------|----------|-------------|
186+
| `AZURE_CREDENTIALS` | No | Azure credentials JSON |
187+
| `AWS_ACCESS_KEY_ID` | No | AWS access key ID |
188+
| `AWS_SECRET_ACCESS_KEY` | No | AWS secret access key |
189+
| `AWS_SESSION_TOKEN` | No | AWS session token |
190+
| `BUILD_ROLE` | No | AWS OIDC role ARN |
191+
| `DIGITALOCEAN_ACCESS_TOKEN` | No | DigitalOcean access token |
192+
| `GITHUB` | No | GitHub PAT token |
193+
| `TF_API_TOKEN` | No | Terraform Cloud API token |
194+
| `GCP_CREDENTIALS` | No | GCP service account key JSON |
195+
| `WORKLOAD_IDENTITY_PROVIDER` | No | GCP Workload Identity Provider |
196+
| `SERVICE_ACCOUNT` | No | GCP service account email |

0 commit comments

Comments
 (0)