github-action-tfsec

Issues | Pull Requests | https://github.com/suzuki-shunsuke/github-action-tfsec/compare/v0.1.9...v1.0.0

#642 update Node.js 16 to 20

https://github.blog/changelog/2023-09-22-github-actions-transitioning-from-node-16-to-node-20/#for-actions-maintainers

#658 Fix a bug that action succeeds even if tfsec fails

This bug was caused by a bug of reviewdog.

• https://github.com/reviewdog/reviewdog/issues/1408

Issues | Pull Requests | https://github.com/suzuki-shunsuke/github-action-tfsec/compare/v0.1.8...v0.1.9

Features

#618 #620 Support tfsec v1.28.2. Parse the output of tfsec properly

As of tfsec v1.28.2, tfsec outputs the transition message to the standard output.

• https://github.com/aquasecurity/tfsec/pull/2067

e.g.

======================================================
tfsec is joining the Trivy family

tfsec will continue to remain available
for the time being, although our engineering
attention will be directed at Trivy going forward.

You can read more here:
https://github.com/aquasecurity/tfsec/discussions/1994
======================================================
{
  "results": []
}

Because of this message, this action couldn't parse the output as JSON.

Parsing tfsec result
Error: Unexpected token = in JSON at position 1

This release enables to parse the output properly by removing the transition message before parsing the output as JSON.

Pull Requests | https://github.com/suzuki-shunsuke/github-action-tfsec/compare/v0.1.7...v0.1.8

Features

#612 Add an input ignore_hcl_errors

This option is disabled by default.

If this is enabled, tfsec's --ignore-hcl-errors is enabled.

tfsec v0.40.0 (Jun 9, 2021) supports --ignore-hcl-errors.

• https://github.com/aquasecurity/tfsec/issues/2070#issuecomment-1669056215

Pull Requests | https://github.com/suzuki-shunsuke/github-action-tfsec/compare/v0.1.6...v0.1.7

Bug Fixes

#103 Fix links to tfsec document

Pull Requests | https://github.com/suzuki-shunsuke/github-action-tfsec/compare/v0.1.5...v0.1.6

Bug Fixes

#92 Support tfsec's CRITICAL severity type

Thanks to kei711

Pull Requests | https://github.com/suzuki-shunsuke/github-action-tfsec/compare/v0.1.4...v0.1.5

Bug Fixes

#49 Make working_directory optional

Pull Requests | https://github.com/suzuki-shunsuke/github-action-tfsec/compare/v0.1.3...v0.1.4

Feature

#31 Support Notification with github-comment

e.g.

- uses: suzuki-shunsuke/github-action-tfsec@main
  with:
    github_token: ${{ secrets.GITHUB_TOKEN }}
    working_directory: tests
    github_comment: true # Enable github-comment notification

Pull Requests | https://github.com/suzuki-shunsuke/github-action-tfsec/compare/v0.1.3...v0.1.4-0

Feature

#31 Support Notification with github-comment

e.g.

- uses: suzuki-shunsuke/github-action-tfsec@main
  with:
    github_token: ${{ secrets.GITHUB_TOKEN }}
    working_directory: tests
    github_comment: true # Enable github-comment notification

Pull Requests | https://github.com/suzuki-shunsuke/github-action-tfsec/compare/v0.1.2...v0.1.3

Feature

#16 Change Reviewdog format from checkstyle to Reviewdog Diagnostic Format

Rewrite the composite action to Javascript Action.

TO BE (RDFormat)

The tfsec's rule id and link to the document are added.

Pull Requests | https://github.com/suzuki-shunsuke/github-action-tfsec/compare/v0.1.1...v0.1.2

#4

• Make inputs optional
• Refactor
• Improve README
• Add test

Pull Requests | https://github.com/suzuki-shunsuke/github-action-tfsec/compare/v0.1.0...v0.1.1

#3

• Set reviewdog's -filter-mode=nofilter
• Even if event isn't pull_request, run reviewdog