main.yml

on:
  push:
  pull_request:

jobs:
  test-lambda:
    name: Test AWS lambda
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2

      - name: Set up Python 3.8
        uses: actions/setup-python@v1
        with:
          python-version: 3.8

      - name: Install dependencies
        run: |
          cd lambda
          python -m pip install --upgrade pip
          python -m pip install --upgrade pipenv
          pipenv install --dev --skip-lock

      - name: Test
        run: |
          make -C lambda coverage

      - uses: codecov/codecov-action@v1
        with:
          file: lambda/coverage.xml
          flags: unittests
          name: codecov-umbrella
          fail_ci_if_error: false

  lint-lambda:
    name: Lint AWS lambda
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2

      - name: Set up Python 3.8
        uses: actions/setup-python@v1
        with:
          python-version: 3.8

      - name: Install dependencies
        run: |
          cd lambda
          python -m pip install --upgrade pip
          python -m pip install --upgrade pipenv
          pipenv install --dev --skip-lock

      - name: Lint
        run: |
          make -C lambda lint

  terraform:
    name: Lint Terraform
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2

      - name: Install dependencies
        run: |
          curl -L https://releases.hashicorp.com/terraform/1.1.8/terraform_1.1.8_linux_amd64.zip -o terraform.zip
          unzip terraform.zip
          mv terraform /usr/local/bin

      - name: Lint Terraform
        run: |
          terraform fmt -check -diff

  ggshield:
    name: Check for secrets with ggshield
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
        with:
          fetch-depth: 0 # fetch all history so multiple commits can be scanned

      - name: GitGuardian scan
        uses: GitGuardian/gg-shield/actions/secret@main
        env:
          GITHUB_PUSH_BEFORE_SHA: ${{ github.event.before }}
          GITHUB_PUSH_BASE_SHA: ${{ github.event.base }}
          GITHUB_PULL_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          GITHUB_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}

  ggshield-iac:
    name: Check for iac vulnerabilities with ggshield
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2

      - name: GitGuardian iac scan test
        uses: GitGuardian/gg-shield/actions/iac@main
        with:
          args: ./
        env:
          GITHUB_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}