fix: requirements.txt to reduce vulnerabilities #134
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # The GitHub Actions docs (https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#on) | |
| # describe other options for 'on', 'pull_request' is a good default. | |
| on: [pull_request] | |
| env: | |
| # If you use private modules you'll need this env variable to use | |
| # the same ssh-agent socket value across all jobs & steps. | |
| SSH_AUTH_SOCK: /tmp/ssh_agent.sock | |
| jobs: | |
| infracost: | |
| name: Infracost | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| env: | |
| TF_ROOT: infra/ | |
| # If you're using Terraform Cloud/Enterprise and have variables or private modules stored | |
| # on there, specify the following to automatically retrieve the variables: | |
| # INFRACOST_TERRAFORM_CLOUD_TOKEN: ${{ secrets.TFC_TOKEN }} | |
| # INFRACOST_TERRAFORM_CLOUD_HOST: app.terraform.io # Change this if you're using Terraform Enterprise | |
| steps: | |
| # If you use private modules, add an environment variable or secret | |
| # called GIT_SSH_KEY with your private key, so Infracost can access | |
| # private repositories (similar to how Terraform/Terragrunt does). | |
| # - name: add GIT_SSH_KEY | |
| # run: | | |
| # ssh-agent -a $SSH_AUTH_SOCK | |
| # mkdir -p ~/.ssh | |
| # echo "${{ secrets.GIT_SSH_KEY }}" | tr -d '\r' | ssh-add - | |
| # ssh-keyscan github.com >> ~/.ssh/known_hosts | |
| - name: Setup Infracost | |
| uses: infracost/actions/setup@v2 | |
| # See https://github.com/infracost/actions/tree/master/setup for other inputs | |
| # If you can't use this action, see Docker images in https://infracost.io/cicd | |
| with: | |
| api-key: ${{ secrets.INFRACOST_API_KEY }} | |
| # Checkout the base branch of the pull request (e.g. main/master). | |
| - name: Checkout base branch | |
| uses: actions/checkout@v3 | |
| with: | |
| ref: '${{ github.event.pull_request.base.ref }}' | |
| # Generate Infracost JSON file as the baseline. | |
| - name: Generate Infracost cost estimate baseline | |
| run: | | |
| infracost breakdown --path=${TF_ROOT} \ | |
| --format=json \ | |
| --out-file=/tmp/infracost-base.json | |
| # Checkout the current PR branch so we can create a diff. | |
| - name: Checkout PR branch | |
| uses: actions/checkout@v3 | |
| # Generate an Infracost diff and save it to a JSON file. | |
| - name: Generate Infracost diff | |
| run: | | |
| infracost diff --path=${TF_ROOT} \ | |
| --format=json \ | |
| --compare-to=/tmp/infracost-base.json \ | |
| --out-file=/tmp/infracost.json | |
| # Posts a comment to the PR using the 'update' behavior. | |
| # This creates a single comment and updates it. The "quietest" option. | |
| # The other valid behaviors are: | |
| # delete-and-new - Delete previous comments and create a new one. | |
| # hide-and-new - Minimize previous comments and create a new one. | |
| # new - Create a new cost estimate comment on every push. | |
| # See https://www.infracost.io/docs/features/cli_commands/#comment-on-pull-requests for other options. | |
| - name: Post Infracost comment | |
| run: | | |
| infracost comment github --path=/tmp/infracost.json \ | |
| --repo=$GITHUB_REPOSITORY \ | |
| --github-token=${{github.token}} \ | |
| --pull-request=${{github.event.pull_request.number}} \ | |
| --behavior=update |