This reusable workflow runs TFSec to scan Terraform code for security misconfigurations. It supports GitHub's security dashboard via SARIF upload and adds PR comments with security findings.
TFSec is a static analysis security scanner for Terraform code that identifies security misconfigurations and compliance issues. This workflow integrates TFSec scanning with GitHub's security features and provides PR feedback.
- ✅ Reusable workflow_call - Modular implementation for easy integration
- 📄 SARIF Upload - Results appear in GitHub Security tab
- 💬 PR Comments - Automatic comments on pull requests with security findings
- 🔍 Full Repository Scan - Scans entire repository or specified directory
- 🛡️ Advanced Security Scan - Additional Terraform security scanning with PR comments
name: Security Scan
on:
pull_request:
branches: [master, main]
types: [opened, synchronize]
jobs:
tfsec-scan:
uses: clouddrove/github-shared-workflows/.github/workflows/security-tfsec.yml@v2
secrets:
GITHUB: ${{ secrets.GITHUB_TOKEN }}name: Security Scan
on:
pull_request:
branches: [master]
jobs:
tfsec-scan:
uses: clouddrove/github-shared-workflows/.github/workflows/security-tfsec.yml@v2
secrets:
GITHUB: ${{ secrets.GITHUB_TOKEN }}
with:
working_directory: './terraform/'| Input | Description | Required | Default |
|---|---|---|---|
working_directory |
Directory where Terraform files exist | No | ./examples/ |
| Secret | Description | Required |
|---|---|---|
GITHUB |
GitHub Personal Access Token (PAT) with appropriate permissions | Yes |
- Clone Repository - Checks out the repository code
- Run TFSec - Scans Terraform files for security issues
- Upload SARIF - Uploads results to GitHub Security tab
- PR Comment - Adds comment to PR with security findings
- Advanced Scan - Runs additional Terraform security scan (on PRs only)
The workflow uploads SARIF results to GitHub's Security tab, where you can:
- View all security findings in one place
- Track security issues over time
- Integrate with GitHub Advanced Security features
When run on pull requests, the workflow automatically:
- Adds comments summarizing security findings
- Highlights specific issues in the code
- Provides recommendations for fixing issues
- Run on PRs - Catch security issues before merging
- Use PAT - Ensure GITHUB secret has appropriate permissions
- Review Findings - Regularly check GitHub Security tab
- Fix Issues - Address security findings promptly
- Security Checkov - IaC security scanning with Checkov
- Security Prowler - Cloud security assessment
- Security Powerpipe - Compliance checking