mozilla / tf-actions

Mozilla Terraform Composite Action for Github Actions

Mozilla Terraform GitHub Actions

This repository contains GitHub Actions Composite Actions used for Terraform Automation.

Desired CI Workflow

1. Discover each Terraform module or project directory & if it has changed & iterate rest of steps on this;
2. Terraform init --backend=false, format, validate checks;
3. Required metadata checks: i. terraform.required_version (if Terraform instantiation code) exists; i. terraform.backend.gcs.prefix (if Terraform instantiation code) is same as that Terraform’s directory name;
4. Required files & documentation checks; i. Has README.md (though not necessarily that the README matches a terraform-docs output, to allow for edits); i. Warning if .terraform-version doesn’t exist; i. Warning if .terraform.lock.hcl doesn’t exist;
5. Security checks: i. secrets scanning; i. approved providers & modules only being used (maybe via checkov or conftest);
6. (someday goal) tflint run with cloud provider support;
7. (someday goal) Terratest style Terraform configuration unit tests demoed at least.

Matrixify

The mozilla/tf-actions/matrixify action will return a list of directories that contain a versions.tf & where there has been a change in the latest git commit(s). This is useful for running a set of commands in each Terraform root directory under a given project.

Inputs:

• default_branch: The default branch of the repository. Defaults to main. Used for first commit on a new branch diffs.
• filter_file: Files to filter for as a representation of a Terraform module or project direcotry. Defaults to "version.tf".
• ignore_dir: Directories to filter out of the resulting matrix. Defaults to "ignoreme".
• ignore_path: Filepaths to filter out of the resulting matrix. Defaults to "*.ignore".

jobs:
  matrixify:
    name: Matrixify
    runs-on: ubuntu-latest

    steps:
    - name: Get Changed Terraform directories
      id: search
      uses: mozilla/tf-actions/matrixify@main
    - name: Outputs
      run: echo "${{ steps.search.outputs.matrix }}"

CI

The mozilla/tf-actions/ci action will run stateless Terraform automated checks on a given Terraform root directory.

Inputs:

• tfpath: The directory of the Terraform project or module to run the checks on. Defaults to ".".
• tfmodule: Whether or not the Terrform checks are running on a module. Matches on "true" or "false". Defaults to "false".
• workspace: The Terraform workspace to run the checks on. Defaults to "default".

jobs:
  terraform-ci:
    name: Terraform CI on "${{ matrix.directory }}"
    needs: matrixify
    runs-on: ubuntu-latest
    strategy:
        matrix: ${{fromJson(needs.matrixify.outputs.matrix)}}

    steps:
    - id: terraform-checks
      name: Terraform Checks
      uses: mozilla/tf-actions/ci@main
      with:
        tfpath: ${{ matrix.directory }}