feat(terragrunt): checks

.github/workflows/terragrunt-quality.yml

@@ -0,0 +1,62 @@
+on:
+  workflow_call:
+    inputs:
+      workdir:
+        required: false
+        type: string
+        default: .
+      checkov_enabled:
+        required: false
+        type: boolean
+        default: true
+      checkov_skip_path:
+        required: false
+        type: string
+      checkov_baseline:
+        required: false
+        type: string
+
+name: terragrunt-quality
+jobs:
+  terragrunt-lint:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ${{ inputs.workdir }}
+    steps:
+      - name: checkout
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
+      - uses: tofuutils/tenv-github-action@3e0c27a3e1131f756e3973e064ffcca2c139e010
+        with:
+          tool_name: terraform
+      - uses: tofuutils/tenv-github-action@3e0c27a3e1131f756e3973e064ffcca2c139e010
+        with:
+          tool_name: terragrunt
+      - name: terraform fmt of directory modules
+        run: terraform fmt -check -recursive -diff modules
+      - name: terragrunt fmt of directory layers
+        run: terragrunt hclfmt --terragrunt-check --terragrunt-diff layers
+      - name: guacamole code quality checks
+        id: guacamole
+        uses: padok-team/[email protected]
+        with:
+          path: ${{ inputs.workdir }}
+          verbose: true
+  terragrunt-security:
+    runs-on: ubuntu-latest
+    if: inputs.checkov_enabled
+    defaults:
+      run:
+        working-directory: ${{ inputs.workdir }}
+    steps:
+      - name: checkout
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
+      - name: checkov of modules
+        uses: bridgecrewio/checkov-action@master
+        with:
+          directory: modules
+          framework: terraform
+          download_external_modules: false
+          quiet: true
+          skip_path: ${{ inputs.checkov_skip_path }}
+          baseline: ${{ inputs.checkov_baseline }}