Adding security checks to terraform repository

.github/workflows/gosec.yml

@@ -0,0 +1,29 @@
+name: GoSec Security Check
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  gosec:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install GoSec
+        run: |
+          curl -sSL https://github.com/securego/gosec/releases/download/v2.12.0/gosec_2.12.0_linux_amd64.tar.gz | tar -xz
+          sudo mv gosec /usr/local/bin/
+
+      - name: Run GoSec Scan
+        run: gosec -fmt=sarif -out=gosec.sarif ./...
+
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: gosec.sarif

.github/workflows/tflint.yml

@@ -0,0 +1,49 @@
+name: Terraform Lint
+
+on:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - 'docs/**'
+      - '.github/**'
+      -  'scripts/**'
+      - 'gitignore'
+
+  pull_request:
+    branches:
+      - main
+    paths-ignore:
+    - 'docs/**'
+    - '.github/**'
+    -  'scripts/**'
+    - 'gitignore'
+
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Go (for installing tflint)
+        uses: actions/setup-go@v2
+        with:
+          go-version: '1.18'
+
+      - name: Install tflint
+        run: |
+          wget https://github.com/terraform-linters/tflint/releases/download/v0.44.1/tflint-linux-amd64.tar.gz
+          tar -xvzf tflint-linux-amd64.tar.gz
+          sudo mv tflint /usr/local/bin/
+
+      - name: Run tflint recursively
+        run: |
+          find . -name "*.tf" | xargs tflint > tflint.sarif
+
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: tflint.sarif

.github/workflows/tfsec.yml

@@ -0,0 +1,31 @@
+name: TFsec Security Check
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  tfsec:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install TFsec
+        run: |
+          curl -sSL https://github.com/aquasecurity/tfsec/releases/download/v1.20.0/tfsec-linux-amd64 -o tfsec
+          chmod +x tfsec
+          sudo mv tfsec /usr/local/bin/
+
+      - name: Run TFsec Scan
+        run: tfsec . --force-all-dirs > tfsec.sarif
+
+      - name: Upload SARIF file
+        uses: actions/upload-artifact@v3
+        with:
+          name: tfsec-sarif
+          path: tfsec.sarif

.github/workflows/trivy.yml

@@ -0,0 +1,30 @@
+name: Trivy Security Check
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  trivy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install Trivy
+        run: |
+          curl -sSL https://github.com/aquasecurity/trivy/releases/download/v0.22.0/trivy_0.22.0_Linux-64bit.tar.gz -o trivy_0.22.0_Linux-64bit.tar.gz
+          tar -xvzf trivy_0.22.0_Linux-64bit.tar.gz
+          sudo mv trivy /usr/local/bin/
+
+      - name: Run Trivy Scan
+        run: trivy fs . --format sarif -o trivy.sarif
+
+      - name: Upload Sarif file
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: trivy.sarif