config.yml

version: 2.1
orbs:
  tfsec: mycodeself/tfsec@1.1.0

jobs:
  plan:
    docker:
      - image: hashicorp/terraform:1.1.5
    steps:
      - checkout
      - run:
          name: Set up Terraform
          # https://discuss.circleci.com/t/create-separate-steps-jobs-for-pr-forks-versus-branches/13419/2
          command: |
            cd terraform
            if [[ $(echo "$CIRCLE_BRANCH" | grep -c "pull") -gt 0 ]]; then
              echo "This is from a fork."
              terraform init -backend=false -input=false
            else
              terraform init -backend-config=backend.tfvars -input=false
            fi
      - run:
          name: Validate Terraform config
          command: |
            cd terraform
            if [[ $(echo "$CIRCLE_BRANCH" | grep -c "pull") -gt 0 ]]; then
              echo "This is from a fork."
              terraform validate
            else
              terraform plan -input=false
            fi

      - persist_to_workspace:
          root: .
          paths:
            - ./terraform/*

  tfsec:
    executor: tfsec/default
    steps:
      - checkout
      - tfsec/scan:
          directory: .
          #exclude-checks: ''

  checkov:
     docker:
       - image: circleci/python:latest
     steps:
       - checkout
       - run:
           name: Install checkov
           command: pip install checkov
       - run:
           name: Run checkov
           command: checkov -d ./terraform/ --skip-check CKV2_AWS_61,CKV_AWS_273,CKV_AWS_289,CKV_AWS_40,CKV_AWS_355,CKV_AWS_290,CKV2_AWS_6,CKV_AWS_33,CKV2_AWS_23,CKV2_AWS_39,CKV2_AWS_38,CKV2_AWS_62,CKV_AWS_18,CKV_AWS_144,CKV_AWS_145,
           # TODO resolve /docs/checkov.md errors to remove skipped checks or skip checks inline where appropriate

  apply:
    docker:
      - image: hashicorp/terraform:1.1.5
    steps:
      - attach_workspace:
          at: .

      - run:
          name: Deploy the full environment
          command: cd terraform && terraform apply -input=false -auto-approve

  validate:
    docker:
      - image: python:3.9-alpine
    steps:
      - checkout
      - run:
          name: Install dependencies
          command: pip install -r requirements.txt
      - run:
          name: Run validations
          command: pytest tests

workflows:
  version: 2

  validate_and_deploy:
    jobs:
      - plan
      - tfsec
      - checkov
      - apply:
          filters:
            branches:
              only: main
          requires:
            - plan
      - validate:
          filters:
            branches:
              only: main
          requires:
            - apply

experimental:
  notify:
    branches:
      only:
        - main