Policy Checks in GitHub Actions

name: Policy and Security Checks

on:
  pull_request:
    branches: [ "main" ]
    # The 'paths' filter ensures this workflow only runs
    # when relevant files are changed, saving CI minutes.
    paths:
      - '**.tf'
      - '**.k8s.yaml'
      - 'policies/**'

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      # ... Policy check steps like Conftest or Checkov will go here ...

package terraform

# The 'deny' rule will contain a set of failure messages.
# The rule is satisfied if the logic inside the curly braces is true.
deny[msg] {
    # Assign the list of resource changes from the input plan to a variable.
    resource := input.resource_changes[_]
    # Check if the 'owner' tag is NOT present in the resource's 'after' state.
    not resource.change.after.tags.owner
    # If the check passes, create a descriptive error message.
    msg := sprintf("Resource '%s' is missing the required 'owner' tag.", [resource.address])
}

name: Terraform Conftest Policy Check

on:
  pull_request:
    paths:
      - '**.tf'
      - 'policies/**.rego'

jobs:
  terraform-conftest:
    runs-on: ubuntu-latest
    steps:
      # 1. Check out the repository code to the runner.
      - name: Checkout code
        uses: actions/checkout@v4

      # 2. Install and configure Terraform CLI.
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3

      # 3. Download and install the Conftest CLI.
      - name: Setup Conftest
        uses: open-policy-agent/setup-conftest@v2

      # 4. Initialize Terraform to download provider plugins.
      - name: Terraform Init
        run: terraform init

      # 5. Generate a plan file and convert it to structured JSON
      #    so it can be processed by Conftest.
      - name: Terraform Plan and Convert to JSON
        run: |
          terraform plan -out=plan.tfplan
          terraform show -json plan.tfplan > plan.json
      
      # 6. Run Conftest to test the JSON plan against all policies
      #    in the 'policies' directory. The job will fail if any 'deny'
      #    rule is triggered.
      - name: Run Conftest
        run: conftest test --policy policies/ plan.json

FAIL - plan.json - terraform.deny: Resource 'aws_s3_bucket.data' is missing the required 'owner' tag.

1 test, 0 passed, 1 failure
Error: Process completed with exit code 1.

name: IaC Security Scan with Checkov

on:
  pull_request:
    paths:
      - 'infra/**'

jobs:
  checkov-scan:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write # Required to upload SARIF results
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run Checkov
        id: checkov
        uses: bridgecrewio/checkov-action@v12
        with:
          # The directory containing your Terraform files.
          directory: ./infra
          # Specify the IaC framework being scanned.
          framework: terraform
          # Don't fail the build for LOW or MEDIUM severity issues,
          # but fail for HIGH or CRITICAL ones.
          soft_fail_on: HIGH
          # Output results in SARIF format, an industry standard for static analysis.
          output_format: sarif
          output_file_path: results.sarif

      # This step uploads the SARIF file generated by Checkov.
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v3
        # Use 'if: always()' to ensure results are uploaded even if
        # the Checkov step fails the build.
        if: always() 
        with:
          sarif_file: results.sarif