terrascan.yaml

name: Terrascan

on:
  push:
    paths:
     - 'chart/k8gb/**'
  pull_request:
    branches:
      - master
    paths:
     - 'chart/k8gb/**'
permissions:
  contents: read
  security-events: write # To upload sarif file

jobs:
  terrascan:
    runs-on: ubuntu-22.04
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@951b48540b429070694bc8abd82fd6901eb123ca
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

    - name: Checkout repository
      uses: actions/checkout@6d193bf28034eafb982f37bd894289fe649468fc
    - name: Run Terrascan
      id: terrascan
      uses: accurics/terrascan-action@a4b0f7ec5fb3c4c66b8e76d824d958002f6ce12c
      with:
        iac_type: helm
        iac_version: v3
        only_warn: false
        verbose: true
        sarif_upload: true
        iac_dir: chart/k8gb
    - name: Upload SARIF file
      uses: github/codeql-action/upload-sarif@d8b1697e9a833a1f8cd88c642a6bd8685d3ee856
      with:
        sarif_file: terrascan.sarif