pull_request.yaml

name: Pull Request Workflow

on:
  pull_request:
    branches:
      - main
      - develop

jobs:
  validate-template-code:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install AWS SAM CLI
        run: |
          pip install --user aws-sam-cli

      - name: Validate SAM Templates
        run: |
          find . -path "./.github" -prune -o \( -name "*.yaml" -o -name "*.yml" \) -print0 | while IFS= read -r -d '' template; do
           echo "Validating template: $template"
           sam validate --template-file "$template" --region us-east-2 --lint
          done        
        shell: bash

  security:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Run CFN Nag Security Checks
        uses: stelligent/cfn_nag@master
        with:
          input_path: .
          extra_args: -o sarif
          output_path: cfn_nag.sarif
      - name: Upload CFN Nag SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: cfn_nag.sarif    
          category: security