feat: Updates to CI configurations for pre-commit and GHA #154
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -0,0 +1,18 @@ | |||
| name: Generate terraform docs | |||
Check failure
Code scanning / checkov
Ensure top-level permissions are not set to write-all Error
There was a problem hiding this comment.
@kylesomers checkov doing GHA scans as well. Doesn't like our top-level writes.
CKV_GHA_7: "The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty."
There was a problem hiding this comment.
Noted. Impacts CI and not the project resources directly so approving. We can create an issue to get this addressed with input vars.
|
@kylesomers check this out. |
- Added config directory for storing CLI tooling configuration files - Adjusted pre-commit to leverage config files for terraform-docs and checkov - Switched to using standard terraform-docs-go and checkov precommit hooks and GHA - Removed pre-commit CI. Will leverage GHA instead. - Added terraform docs GHA
| output: cli | ||
| quiet: true | ||
| skip-check: | ||
| - CKV_AWS_91 # "Elastic Load Balancing | Ensure the ELBv2 (Application/Network) has access logging enabled" |
There was a problem hiding this comment.
- These should be configurable input vars for users. Add to backlog?
There was a problem hiding this comment.
What do you mean? This config is used by pre-commit and our GHA - if end users don't want to leverage our checkov configuration they can simply remove the file.
There was a problem hiding this comment.
Or are you suggesting that access logging is configurable? It is.
Issue number:
NA
Summary
Maintenance of CI processes.
Changes
See above.
User experience
Checklist
If your change doesn't seem to apply, please leave them unchecked.
Is this a breaking change?
Acknowledgment
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.
Disclaimer: We value your time and bandwidth. As such, any pull requests created might not be successful.