build.yml

---
name: Build
'on':
  push:
    branches:
    - main
    tags:
    - "**"
  pull_request_target:
jobs:
  build:
    name: Build
    runs-on: ubuntu-22.04
    env:
      TERRAFORM_VERSION: 1.3.4
    steps:
    - name: Checkout
      uses: actions/checkout@v3
      with:
        submodules: recursive
    - name: Download Terraform
      run: "./scripts/download_terraform.sh $TERRAFORM_VERSION"
    - name: Init workspace
      run: "~/tfbin/terraform init -upgrade -input=false"
    - name: Check format
      run: "~/tfbin/terraform fmt -write=false -diff=true -check"
    - name: Run Trivy
      uses: aquasecurity/trivy-action@master
      with:
        scan-type: 'config'
        hide-progress: false
        exit-code: '1'
    - name: Check plan
      run: "~/tfbin/terraform plan -detailed-exitcode -input=false"
      env:
        AWS_ACCESS_KEY_ID: "${{ secrets.AWS_ACCESS_KEY_ID }}"
        AWS_SECRET_ACCESS_KEY: "${{ secrets.AWS_SECRET_ACCESS_KEY }}"
    - name: Post to hook-exporter
      run: "./.github/exporter.sh"
      env:
        EXPORTER_TOKEN: "${{ secrets.EXPORTER_TOKEN }}"
        JOB_STATUS: "${{ job.status }}"
      if: always() && github.ref == 'refs/heads/main'