checkov-checks.yml

name: Check ARM Templates

on:
  pull_request:
    branches:
      - master

jobs:
  validate:
    runs-on: ubuntu-latest

    steps:

    - name: Set up Python
      uses: actions/setup-python@v2
      with:
        python-version: '3.x'

    - name: Install Checkov
      run: pip install checkov
      continue-on-error: true
      
    - name: Checkout code
      uses: actions/checkout@v3
      with:
        fetch-depth: 0  # Fetch all history for all branches and tags
        
    - name: Get changed files
      id: changed-files
      uses: tj-actions/changed-files@v45
      # To compare changes between the current commit and the last pushed remote commit set `since_last_remote_commit: true`. e.g
      # with:
      #   since_last_remote_commit: true 

    - name: List all changed files
      env:
        ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
      run: |
        for file in ${ALL_CHANGED_FILES}; do
          echo "$file was changed"
          checkov -f $file
        done
      continue-on-error: true

    - name: Check with arm-ttk
      uses: microsoft/action-armttk/.github/workflows/arm-ttk@0.0.5
      with:
        glob_pattern: "templates/function-app.json"