terrascan.yaml

name: Terrascan

on:
  push:
    paths:
     - 'chart/k8gb/**'
  pull_request:
    branches:
      - master
    paths:
     - 'chart/k8gb/**'
permissions:
  contents: read
  security-events: write # To upload sarif file

jobs:
  terrascan:
    runs-on: ubuntu-24.04
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

    - name: Checkout repository
      uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
    - name: Run Terrascan
      id: terrascan
      uses: accurics/terrascan-action@a4b0f7ec5fb3c4c66b8e76d824d958002f6ce12c
      with:
        iac_type: helm
        iac_version: v3
        only_warn: false
        verbose: true
        sarif_upload: true
        iac_dir: chart/k8gb
    - name: Upload SARIF file
      uses: github/codeql-action/upload-sarif@6db8d6351fd0be61f9ed8ebd12ccd35dcec51fea # v3.26.11
      with:
        sarif_file: terrascan.sarif