terrascan.yaml

# https://github.com/marketplace/actions/terrascan-iac-scanner
name: Terrascan

on:
  pull_request:
  push:
    branches: [main]


permissions: read-all

jobs:
  terrascan:
    runs-on: ubuntu-latest
    name: terrascan
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Run Terrascan
        id: terrascan
        uses: tenable/terrascan-action@a4b0f7ec5fb3c4c66b8e76d824d958002f6ce12c # main
        with:
          iac_type: 'terraform'
          iac_version: 'v14'
          policy_type: 'aws'
          only_warn: true
          sarif_upload: true
          #non_recursive:
          #iac_dir:
          #policy_path:
          #skip_rules:
          #config_path:
          #webhook_url:
          #webhook_token:
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@17a820bf2e43b47be2c72b39cc905417bc1ab6d0 # v3.28.6
        with:
          sarif_file: terrascan.sarif