security-scan.yml

name: Security Scan

on:
  pull_request:
    branches:
      - '*'

jobs:
  python-scan:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - {python-version: '3.9' }
          - {python-version: '3.12' }
    steps:
      - name: Git clone the repository
        uses: actions/checkout@v3
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install Python Modules
        run: |
          python -m pip install --upgrade pip
          pip install -U bandit pip-audit setuptools .
      - name: Bandit Scan
        run: |
          bandit -r .
      - name: Install cid-cmd
        run: |
          pip install -U .
      - name: Pip Audit
        run: |
          # GHSA-wfm5-v35h-vwf4  gitpython is a dependency of pip-audit not cid-cmd
          # GHSA-cwvm-v4w8-q58c  gitpython is a dependency of pip-audit not cid-cmd
          pip-audit --ignore-vuln GHSA-wfm5-v35h-vwf4 --ignore-vuln GHSA-cwvm-v4w8-q58c

  python-pylint-cid:
    runs-on: ubuntu-latest
    steps:
      - name: Git clone the repository
        uses: actions/checkout@v3
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.11'
      - name: Install cfn-lint
        run: |
          pip install pylint
      - name: PyLint
        run: |
          pylint ./cid/

  cfn-scan-cid:
    runs-on: ubuntu-latest
    steps:
      - name: Git clone the repository
        uses: actions/checkout@v3
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.10'
      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.1'
      - name: Install CFN tools
        run: |
          gem install cfn-nag
      - name: CFN Nag scan
        run: |
          cfn_nag_scan --input-path  ./cfn-templates/cid-cfn.yml
      - name: Install cfn-lint
        run: |
          pip install cfn-lint
      - name: CFN Lint
        run: |
          cfn-lint ./cfn-templates/cid-cfn.yml

  cfn-scan-cid-admin-policies:
    runs-on: ubuntu-latest
    steps:
      - name: Git clone the repository
        uses: actions/checkout@v3
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.10'
      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.1'
      - name: Install CFN tools
        run: |
          gem install cfn-nag
      - name: CFN Nag scan
        run: |
          cfn_nag_scan --input-path  ./cfn-templates/cid-admin-policies.yaml
      - name: Install cfn-lint
        run: |
          pip install cfn-lint
      - name: CFN Lint
        run: |
          cfn-lint ./cfn-templates/cid-admin-policies.yaml

  cfn-scan-cur-aggregation:
    runs-on: ubuntu-latest
    steps:
      - name: Git clone the repository
        uses: actions/checkout@v3
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.10'
      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.1'
      - name: Install CFN tools
        run: |
          gem install cfn-nag
      - name: CFN Nag scan
        run: |
          cfn_nag_scan --input-path  ./cfn-templates/cur-aggregation.yaml
      - name: Install cfn-lint
        run: |
          pip install cfn-lint
      - name: CFN Lint
        run: |
          cfn-lint ./cfn-templates/cur-aggregation.yaml

  terraform-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Git clone the repository
        uses: actions/checkout@v3
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.11'
      - name: Install checkov
        run: |
          pip install -U schema checkov
      - name: Checkov scan
        run: |
          checkov --directory  ./terraform-modules