feat: modernize module with CI/CD pipeline, security enhancements, and rename to terraform-aws-ec2-backup #14

Workflow file for this run

.github/workflows/terraform-lint.yml at 7105004

	name: CI/CD Pipeline

	on:
	push:
	branches: [ main, develop ]
	pull_request:
	branches: [ main, develop ]

	env:
	TF_VERSION: "1.6.0"
	NODE_VERSION: "20"

	jobs:
	##############################################################################
	# Terraform Validation and Linting
	##############################################################################
	terraform-validation:
	name: "Terraform Validation"
	runs-on: ubuntu-latest

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup Terraform
	uses: hashicorp/setup-terraform@v3
	with:
	terraform_version: ${{ env.TF_VERSION }}

	- name: Terraform Format Check
	id: fmt
	run: terraform fmt -check -recursive
	continue-on-error: true

	- name: Terraform Init
	id: init
	run: terraform init -backend=false

	- name: Terraform Validate
	id: validate
	run: terraform validate -no-color

	- name: Comment on PR - Terraform Results
	if: github.event_name == 'pull_request'
	uses: actions/github-script@v7
	with:
	script: \|
	const output = `
	### Terraform Validation Results 🚀

	#### Terraform Format and Style 🖌 \`${{ steps.fmt.outcome }}\`
	#### Terraform Initialization ⚙️ \`${{ steps.init.outcome }}\`
	#### Terraform Validation 🤖 \`${{ steps.validate.outcome }}\`

	<details><summary>Show Validation Output</summary>

	\`\`\`
	${{ steps.validate.outputs.stdout }}
	\`\`\`

	</details>
	`;

	github.rest.issues.createComment({
	issue_number: context.issue.number,
	owner: context.repo.owner,
	repo: context.repo.repo,
	body: output
	})

	##############################################################################
	# Lambda Function Testing
	##############################################################################
	lambda-testing:
	name: "Lambda Function Testing"
	runs-on: ubuntu-latest

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version: ${{ env.NODE_VERSION }}
	cache: 'npm'
	cache-dependency-path: lambda/package-lock.json

	- name: Install Lambda dependencies
	working-directory: ./lambda
	run: \|
	# Try npm ci first, fallback to npm install if lock file is out of sync
	npm ci \|\| (echo "Lock file out of sync, running npm install..." && npm install)

	- name: Run Lambda ESLint
	working-directory: ./lambda
	run: \|
	npm install eslint --save-dev
	npx eslint . --ext .js --format json --output-file eslint-report.json \|\| true
	continue-on-error: true

	- name: Run Lambda syntax check
	working-directory: ./lambda
	run: node -c index.js

	- name: Run Lambda unit tests (mock)
	working-directory: ./lambda
	run: \|
	# Create a simple test to verify the function loads
	cat > test.js << 'EOF'
	// Mock AWS SDK v3
	const mockSend = jest.fn();
	const mockEC2Client = jest.fn(() => ({ send: mockSend }));
	const mockCloudWatchClient = jest.fn(() => ({ send: mockSend }));

	jest.mock('@aws-sdk/client-ec2', () => ({
	EC2Client: mockEC2Client,
	DescribeInstancesCommand: jest.fn(),
	CreateImageCommand: jest.fn(),
	DescribeImagesCommand: jest.fn(),
	DeregisterImageCommand: jest.fn(),
	DescribeSnapshotsCommand: jest.fn(),
	DeleteSnapshotCommand: jest.fn()
	}));

	jest.mock('@aws-sdk/client-cloudwatch', () => ({
	CloudWatchClient: mockCloudWatchClient,
	PutMetricDataCommand: jest.fn()
	}));

	// Mock environment variables
	process.env.backup_tag = 'TestBackup';
	process.env.backup_retention = '7';
	process.env.AWS_LAMBDA_FUNCTION_NAME = 'test-function';

	// Test that the module can be loaded
	test('Lambda function loads without errors', () => {
	expect(() => {
	require('./index.js');
	}).not.toThrow();
	});
	EOF

	npm install jest --save-dev
	npx jest test.js \|\| echo "Tests completed with warnings"

	- name: Check package vulnerabilities
	working-directory: ./lambda
	run: npm audit --audit-level high

	##############################################################################
	# Security Scanning
	##############################################################################
	security-scan:
	name: "Security Scanning"
	runs-on: ubuntu-latest

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Run tfsec
	uses: aquasecurity/tfsec-action@v1.0.3
	with:
	format: json
	soft_fail: true

	- name: Run Checkov
	uses: bridgecrewio/checkov-action@master
	with:
	directory: .
	framework: terraform
	output_format: json
	soft_fail: true

	##############################################################################
	# Terraform Plan Test
	##############################################################################
	terraform-plan:
	name: "Terraform Plan Test"
	runs-on: ubuntu-latest
	if: github.event_name == 'pull_request'

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup Terraform
	uses: hashicorp/setup-terraform@v3
	with:
	terraform_version: ${{ env.TF_VERSION }}

	- name: Create test configuration
	run: \|
	# Create a separate test directory to avoid conflicts
	mkdir -p test-deployment
	cd test-deployment

	cat > main.tf << 'EOF'
	terraform {
	required_version = ">= 1.0"
	required_providers {
	aws = {
	source = "hashicorp/aws"
	version = ">= 4.0"
	}
	}
	}

	provider "aws" {
	region = "us-east-1"
	# Skip credentials for plan-only test
	skip_credentials_validation = true
	skip_metadata_api_check = true
	skip_region_validation = true
	skip_requesting_account_id = true
	}

	module "backup_test" {
	source = "../"

	name = "ci-test-backup"
	environment = "test"
	region = "us-east-1"
	schedule_expression = "cron(0 2 * * ? *)"

	# Optional parameters
	backup_tag = "CITestBackup"
	backup_retention = 7
	enable_monitoring = true

	default_tags = {
	Environment = "ci-test"
	Module = "terraform-aws-ec2-backup"
	Testing = "github-actions"
	}
	}
	EOF

	- name: Terraform Init
	working-directory: ./test-deployment
	run: terraform init

	- name: Terraform Plan
	id: plan
	working-directory: ./test-deployment
	run: terraform plan -no-color -input=false
	continue-on-error: true

	- name: Comment on PR - Plan Results
	uses: actions/github-script@v7
	with:
	script: \|
	const output = `
	### Terraform Plan Results 📋

	#### Terraform Plan 📖 \`${{ steps.plan.outcome }}\`

	<details><summary>Show Plan Output</summary>

	\`\`\`terraform
	${{ steps.plan.outputs.stdout }}
	\`\`\`

	</details>

	Pushed by: @${{ github.actor }}, Action: \`${{ github.event_name }}\`
	`;

	github.rest.issues.createComment({
	issue_number: context.issue.number,
	owner: context.repo.owner,
	repo: context.repo.repo,
	body: output
	})

	##############################################################################
	# Documentation Validation
	##############################################################################
	docs-validation:
	name: "Documentation Validation"
	runs-on: ubuntu-latest

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Validate README links
	run: \|
	# Check for broken markdown links (basic validation)
	if grep -n "](http" *.md; then
	echo "✅ Found external links in documentation"
	fi

	# Check for required sections
	if grep -q "## Usage" README.md; then
	echo "✅ Usage section found"
	else
	echo "❌ Usage section missing"
	exit 1
	fi

	- name: Check for CHANGELOG
	run: \|
	if [ -f "CHANGELOG.md" ]; then
	echo "✅ CHANGELOG.md exists"
	else
	echo "⚠️ Consider adding CHANGELOG.md for better version tracking"
	fi

	##############################################################################
	# Final Status Check
	##############################################################################
	status-check:
	name: "Final Status Check"
	runs-on: ubuntu-latest
	needs: [terraform-validation, lambda-testing, security-scan, terraform-plan, docs-validation]
	if: always()

	steps:
	- name: Check all job results
	run: \|
	echo "Terraform Validation: ${{ needs.terraform-validation.result }}"
	echo "Lambda Testing: ${{ needs.lambda-testing.result }}"
	echo "Security Scan: ${{ needs.security-scan.result }}"
	echo "Terraform Plan: ${{ needs.terraform-plan.result }}"
	echo "Documentation: ${{ needs.docs-validation.result }}"

	if [[ "${{ needs.terraform-validation.result }}" == "failure" ]]; then
	echo "❌ Terraform validation failed"
	exit 1
	fi

	if [[ "${{ needs.lambda-testing.result }}" == "failure" ]]; then
	echo "❌ Lambda testing failed"
	exit 1
	fi

	echo "✅ All critical checks passed!"

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: modernize module with CI/CD pipeline, security enhancements, and rename to terraform-aws-ec2-backup #14

Workflow file

feat: modernize module with CI/CD pipeline, security enhancements, and rename to terraform-aws-ec2-backup #14

Uh oh!

Jobs

Run details

Workflow file for this run