terraform-validate:
  stage: validate
  image: hashicorp/terraform:1.8.5
  script:
    - terraform fmt -check -recursive
    - terraform init -backend=false
    - terraform validate

checkov-source-scan:
  stage: security_test
  image: bridgecrew/checkov:latest
  script:
    - checkov -d . --config-file snippets/terraform/checkov-config.yaml
  artifacts:
    when: always
    paths:
      - checkov.sarif
      - checkov-junit.xml

checkov-plan-scan:
  stage: security_test
  image: python:3.12
  before_script:
    - apt-get update && apt-get install -y jq curl unzip
    - curl -fsSL https://releases.hashicorp.com/terraform/1.8.5/terraform_1.8.5_linux_amd64.zip -o terraform.zip
    - unzip terraform.zip && mv terraform /usr/local/bin/terraform
    - pip install checkov
  script:
    - terraform init -backend=false
    - terraform plan -out tfplan.binary
    - terraform show -json tfplan.binary | jq '.' > tfplan.json
    - checkov -f tfplan.json --repo-root-for-plan-enrichment . --deep-analysis
