jinugasachio/terraform-workspace-type

terraform-workspace-type's Issues

renovateのアシストコミットの自動化

circleciでやる場合はwriteableなデプロイキーの追加が必要になってくる

terraform CI用のイメージ作成

CI上でツールやバイナリをその都度インストールするのではなく
事前にインストール済みのものを用意しておき実行イメージに使用した方が良い

CircleCIでreviewdogを飼う

https://github.com/reviewdog/reviewdog

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Rate-Limited

These updates are currently rate-limited. Click on a checkbox below to force their creation now.

• Update dependency aquaproj/aqua-installer to v1.2.0
• Update dependency reviewdog/reviewdog to v0.17.1
• Update Terraform aws to v5
• Update dependency aquaproj/aqua-installer to v2
• Update dependency aquaproj/aqua-registry to v4
• Update dependency aquaproj/aqua-renovate-config to v2
• Update dependency suzuki-shunsuke/github-comment to v6
• Update dependency suzuki-shunsuke/tfcmt to v4
• Update dependency tfutils/tfenv to v3
• 🔐 Create all rate-limited PRs at once 🔐

Edited/Blocked

These updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox.

• Update dependency aquaproj/aqua-renovate-config to v0.1.10

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• Update TFLint plugin terraform-linters/tflint-ruleset-aws to v0.30.0
• Update Terraform aws to v4.67.0
• Update alpine Docker tag to v3.19.1
• Update dependency aquaproj/aqua-registry to v2.28.1
• Update dependency aquasecurity/tfsec to v1.28.5
• Update dependency gruntwork-io/terragrunt to v0.55.10
• Update dependency hashicorp/terraform to v1.7.4
• Update dependency suzuki-shunsuke/tfcmt to v3.4.2
• Update dependency terraform-linters/tflint to v0.50.3
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

circleci

.circleci/config.yml

• jinugasachio/circleci-alpine 3.15.0

dockerfile

docker/circleci/Dockerfile

• alpine 3.15.3

regex

aqua.yaml

• aquaproj/aqua-registry v2.11.1
• aquasecurity/tfsec v1.15.4
• gruntwork-io/terragrunt v0.36.6
• reviewdog/reviewdog v0.14.1
• suzuki-shunsuke/tfcmt v3.1.0
• suzuki-shunsuke/github-comment v4.5.2
• terraform-linters/tflint v0.35.0
• tfutils/tfenv v2.2.3

renovate.json

• aquaproj/aqua-renovate-config 0.1.8
• aquaproj/aqua-renovate-config 0.1.8

scripts/circleci/install_aqua.sh

• aquaproj/aqua-installer v1.0.0

terraform

sample/sub/terraform.tf

• aws 4.8.0
• hashicorp/terraform 1.1.7

terraform.tf

• aws 4.8.0
• hashicorp/terraform 1.1.7

terraform-version

.terraform-version

• hashicorp/terraform 1.1.7

tflint-plugin

.tflint.hcl

• terraform-linters/tflint-ruleset-aws 0.10.1

---

• Check this box to trigger a request for Renovate to run again on this repository

Dockerfile 見直す

FROM hashicorp/terraform:1.1.2

ARG GLIBC_VER=2.34-r0
ARG TFCMT_VER=2.1.0
ARG TFLINT_VER=0.34.0 # 常にterraformとのバージョンの互換性があるか確認する必要があるので注意 https://github.com/terraform-linters/tflint/blob/master/docs/user-guide/compatibility.md
ARG TFSEC_VER=0.63.1
RUN apk update \
  && apk --no-cache add bash curl jq \
  # awscli
  && curl -sL https://alpine-pkgs.sgerrand.com/sgerrand.rsa.pub -o /etc/apk/keys/sgerrand.rsa.pub \
  && curl -sLO https://github.com/sgerrand/alpine-pkg-glibc/releases/download/${GLIBC_VER}/glibc-${GLIBC_VER}.apk \
  && curl -sLO https://github.com/sgerrand/alpine-pkg-glibc/releases/download/${GLIBC_VER}/glibc-bin-${GLIBC_VER}.apk \
  && apk add --no-cache glibc-${GLIBC_VER}.apk glibc-bin-${GLIBC_VER}.apk \
  && curl -sL https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip -o awscliv2.zip \
  && unzip awscliv2.zip \
  && aws/install \
  # tfcmt
  && curl -sL https://github.com/suzuki-shunsuke/tfcmt/releases/download/v${TFCMT_VER}/tfcmt_linux_amd64.tar.gz -o tfcmt.tar.gz \
  && tar -C /usr/local/bin -xzf ./tfcmt.tar.gz \
  # tflint
  && curl -sL https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VER}/tflint_linux_amd64.zip -o tflint.zip \
  && unzip tflint.zip \
  && mv tflint /usr/local/bin/tflint \
  # tfsec
  && curl -sLO https://github.com/aquasecurity/tfsec/releases/download/v${TFSEC_VER}/tfsec-linux-amd64 \
  && chmod +x tfsec-linux-amd64 \
  && mv tfsec-linux-amd64 /usr/local/bin/tfsec \
  # remove unnecesary files
  && rm -rf \
      awscliv2.zip \
      aws \ 
      /usr/local/aws-cli/v2/current/dist/aws_completer \
      /usr/local/aws-cli/v2/current/dist/awscli/data/ac.index \
      /usr/local/aws-cli/v2/current/dist/awscli/examples \
      glibc-*.apk \
      tfcmt.tar.gz \
      /usr/local/bin/LICENSE \
      /usr/local/bin/README.md \
      tflint.zip \
  && find /usr/local/aws-cli/v2/current/dist/awscli/botocore/data -name examples-1.json -delete \
  && rm -rf /var/cache/apk/*

CMD ["/bin/bash"]
ENTRYPOINT [""]

aquaを入れる

https://aquaproj.github.io/

CircleCiでアカウントを分ける

https://hack.nikkei.com/blog/advent20201216/

CircleCI で assume role

GAはAWS側でOIDC対応してるのでめちゃクソ楽

• https://github.com/jinugasachio/advanced-ecs-on-fargate/blob/bf7b66fc1eedf41bf7412c0ee2583d4035bf1dd9/.github/workflows/terraform_plan.yaml#L39-L44
• https://dev.classmethod.jp/articles/github-actions-configure-aws-credentials-oidc/

github commentを入れる

https://github.com/suzuki-shunsuke/github-comment