analysis-tfsec-to-github-security.yml

name: "[Analysis] TFSec"

on:
  push:
    branches: [ main, master ]
    paths:
      - "**.tf"
  schedule:
    # 7am every wednesday
    - cron: '0 7 * * 3'

permissions:
  security-events: write
  actions: read
  checks: read
  contents: none
  deployments: none
  issues: none
  packages: none
  repository-projects: none
  statuses: none

jobs:
  tfsec:
    name: TFSec Static analysis
    runs-on: ubuntu-latest
    steps:
      - name: Clone repo
        uses: actions/checkout@v3
      - name: Run tfsec
        uses: tfsec/tfsec-sarif-action@v0.1.4
        with:
          sarif_file: tfsec.sarif
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: tfsec.sarif