This message was deleted.
# atlantis-communitys
Slackbot
03/08/2023, 2:00 PMThis message was deleted.
r
RB
03/08/2023, 2:01 PMYes
RB
03/08/2023, 2:01 PMtflint, tfsec, tf-summarize
s
Sarath S Kumar
03/08/2023, 2:01 PMcan you give more context about the flow
r
RB
03/08/2023, 2:07 PMCustom container
Install tools
Custom workflow
init
tflint
tfsec
then plan and apply steps
s
Sarath S Kumar
03/08/2023, 2:11 PMSo this scan will do only the updated file in the PR or entire code?
r
RB
03/08/2023, 2:12 PMIt depends on the flags
RB
03/08/2023, 2:13 PMHere is a container i use and customize. It may not be up to date tho
https://github.com/nitrocode/atlantis-terraform-module
c
Chastity Blackwell
03/08/2023, 2:13 PMI have tflint etc in a pre-commit hook and then just run that as a separate validate step in a github action
š 2
r
RB
03/08/2023, 2:13 PMThat's probably the best way to do it! :)
RB
03/08/2023, 2:13 PM(referring to the separate gh action)
s
Sarath S Kumar
03/08/2023, 2:20 PM@Chastity Blackwell Are you trigger the github action from the pre_commit_hook?
c
Chastity Blackwell
03/08/2023, 2:22 PMNo, the hook is triggered via a push to a PR
Chastity Blackwell
03/08/2023, 2:23 PMActually, I think I stole it from a previous employer's public repo š
s
Sarath S Kumar
03/08/2023, 2:24 PMCould you please paste it here for a reference š
c
Chastity Blackwell
03/08/2023, 2:24 PMThis is what I have here:
Copy code
name: validate
on:
push:
branches:
- master
pull_request:
branches:
- master
# Pre-commit checking code was cribbed from trussworks/shared-actions
jobs:
validate:
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@v3
- name: Set up homebrew
uses: Homebrew/actions/setup-homebrew@master
- name: Install prereqs for checks
run: |
eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
brew install terraform-docs
brew install gh
pip install pre-commit
- name: Cache
uses: actions/cache@v3
with:
path: ~/.cache/pre-commit
key: pre-commit-dot-cache-{{ hashFiles('.pre-commit-config.yaml') }}
- name: Pre-commit checks
run: |
eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
pre-commit run --all-files --show-diff-on-failureš 1
Chastity Blackwell
03/08/2023, 2:25 PMI think that one is only running terraform-docs and terraform fmt
Chastity Blackwell
03/08/2023, 2:25 PMthe .pre-commit-config.yaml looks like this:
Copy code
repos:
- repo: <https://github.com/pre-commit/pre-commit-hooks>
rev: v3.4.0
hooks:
- id: trailing-whitespace
- repo: <https://github.com/antonbabenko/pre-commit-terraform>
rev: v1.47.0
hooks:
- id: terraform_fmt
- id: terraform_docs
# - id: terraform_validate
- repo: <https://github.com/igorshubovych/markdownlint-cli>
rev: v0.32.2
hooks:
- id: markdownlintš 1
Chastity Blackwell
03/08/2023, 2:26 PMI can't remember why I'm not running validate, I need to probably take another look at that
Chastity Blackwell
03/08/2023, 2:26 PMBut you should be able to do something pretty similar to add tflint or whatever else you want to add
w
wby
03/08/2023, 3:07 PMWe run these kinds of things in a CI pipeline (and also in pre-commit though that only works if people enable it)
c
Chastity Blackwell
03/08/2023, 3:07 PMYeah. Using precommit makes it easy to just throw it in a pipeline too though
w
wby
03/08/2023, 3:08 PMFor us, the pipeline is a lot more complex, but yeah.
wby
03/08/2023, 3:10 PMwby
03/08/2023, 3:11 PMnote: Aqua is pushing folks from
tfsectrivyc
Chastity Blackwell
03/08/2023, 3:11 PMtfsec always drove me nuts because it scanned modules I pulled in from the registry
š 2
w
wby
03/08/2023, 3:12 PM@Chastity Blackwell I had that problem too.
trivytfsecc
Chastity Blackwell
03/08/2023, 3:13 PMblerg
w
wby
03/08/2023, 3:13 PMwith tfsec, it at least seems to be smart enough to follow the chain of whatās actually included (most of the time).
trivywby
03/08/2023, 3:13 PMin CI, also have something that will auto run
tf fmtwby
03/08/2023, 3:14 PMand also added some simple checks for non-snake-case resource names
š 1
c
Chastity Blackwell
03/08/2023, 3:19 PMCare to share? š
s
Sarath S Kumar
03/08/2023, 3:21 PMhttps://github.com/marketplace/actions/run-tfsec-with-sarif-upload
any idea how this sarif works?
w
wby
03/08/2023, 3:36 PMAbsolutely. Itās dead simple, but is working pretty well so far. This is a Circle config, but the basic commands should work anywhere.
thankyou 1
wby
03/08/2023, 3:42 PMI do something basically like this for the validate / init / tflint bits (in a project with a bunch of directories which are basically all terraform states) (first bit is specific to Circleās parallel test splitting, but you could use a similar approach without it)
wby
03/08/2023, 3:42 PM@Chastity Blackwell if you had issues w/ validate on the pre-commit hook before, maybe try with
- --hook-config=--retry-once-with-cleanup=trueš 1
c
Chastity Blackwell
03/08/2023, 3:45 PMI'll give that a shot.
w
wby
03/08/2023, 3:49 PMIt deals with the issue where if the .terraform directory is stale, validation fails. Or something like that.
c
Chastity Blackwell
03/08/2023, 3:53 PMah...that might fix my issue then. Thanks!
w
wby
03/08/2023, 6:00 PMto the OPās original question: Iāve normally used the CI provider to run the checks, and then relied on the VCS providerās required checks combined with things like Atlantisās āmergeableā requirement to enforce them. I donāt know of many cases where people are using atlantis to run / enforce those checks directly.
it might be possible with some kind of custom workflow, but I think the other way is most typical, if itās usable for you
āļø 1