$  gcloud iam service-accounts create github-action-gcp --display-name "github-action-gcp"
$ gcloud projects add-iam-policy-binding <Procject-ID> \
            --member='serviceAccount:github-action-gcp@<Procject-ID>.iam.gserviceaccount.com' \
            --role='roles/editor'

name: 'Terraform-infra'

# Runs your workflow when you push a commit
on:
  push:
    branches: [ "main" ]
  pull_request:

permissions:
  contents: read

jobs:
  tflint-checks: # TFLint tool for linter

  tfsec-checks: # tfsec for security vulnerabilities

  checkov-checks: # static analysis tool

  terraform-infra: # workflow to provison the structure 
                   # Assuming this is already defined.

terraform {
  required_version = ">= 1.0"
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 4.69.1"
    }
  }
}

provider "google" {
  project = var.project_id
  region  = var.region
}

variable "project_id" {
  # type    = string #### Enable after TFLint 
  default = "gcp-project-390708"
}

variable "region" {
  # type    = string #### Enable after TFLint
  default = "europe-west2"
}

terraform {
  backend "gcs" {
    bucket = "github-action-gcp-bucket"
    prefix = "GithubAction"
  }
}

# Reaource: create Bucket Creation 
resource "google_storage_bucket" "Cloud_function_bucket" {
  name                        = "github-action-with-terraform-${var.project_id}"
  location                    = var.region
  project                     = var.project_id
  force_destroy               = true
  uniform_bucket_level_access = true
}


# Reaource: create VPC using module
module "vpc" {
  source       = "terraform-google-modules/network/google"
  version      = "7.1.0"
  project_id   = var.project_id
  network_name = "github-action-terraform-vpc"
  routing_mode = "REGIONAL" #REGIONAL/GLOBAL

  subnets = [
    {
      subnet_name      = "eu-west-subnet"
      subnet_ip        = "10.10.10.0/24"
      subnet_region    = var.region
      # subnet_flow_logs = "true"  #### Enable after tfsec
    }
  ]
}

name: 'Terraform-infra'

# Runs your workflow when you push a commit
on:
  push:
    branches: [ "main" ]
  pull_request:

permissions:
  contents: read

jobs:
  terraform-infra:
    name: 'Terraform-infra'
    runs-on: ubuntu-latest
    environment: dev
    # needs: checkov-checks
    # if: ${{ needs.checkov-checks.outputs.checkov-passed == 'true' }}

    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest
    defaults:
      run:
        shell: bash

    steps:
    # Checkout the repository to the GitHub Actions runner
    - name: Checkout
      uses: actions/checkout@v3


    # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token
    # reference - https://github.com/hashicorp/setup-terraform
    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v2
      with:
        cli_config_credentials_token: ${{ secrets.TERROFORM_TOKEN }}

    # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
    - name: Terraform Init
      run: terraform init
      env:
        GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_CREDENTIALS }} 

    # Checks that all Terraform configuration files adhere to a canonical format
    - name: Terraform Format
      run: terraform fmt -check

    # Generates an execution plan for Terraform
    - name: Terraform Plan
      run: terraform plan -input=false
      env:
        GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_CREDENTIALS }} 

      # On push to "main", build or change infrastructure according to Terraform configuration files
      # Note: It is recommended to set up a required "strict" status check in your repository for "Terraform Cloud". See the documentation on "strict" required status checks for more information: https://help.github.com/en/github/administering-a-repository/types-of-required-status-checks
    - name: Terraform Apply
      if: github.ref == 'refs/heads/main' && github.event_name == 'push'
      run: terraform apply -auto-approve -input=false
      env:
        GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_CREDENTIALS }}

# Reference: https://github.com/terraform-linters/tflint
# GCP Reference: https://github.com/terraform-linters/tflint-ruleset-google
# On local to initialize a configuration file for TFLint in your Terraform project: tflint --init
plugin "google" {
    enabled = true
    version = "0.24.0"
    source  = "github.com/terraform-linters/tflint-ruleset-google"
}

jobs:
  tflint-checks:
    name: 'tflint-checks'
    runs-on: ubuntu-latest
    environment: dev

    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest
    defaults:
      run:
        shell: bash

    steps:
    # Checkout the repository to the GitHub Actions runner
    - name: Checkout
      uses: actions/checkout@v3

    # Reference - https://github.com/terraform-linters/setup-tflint
    # reference - https://github.com/actions/cache
    # TFLint - Terraform Check
    - uses: actions/cache@v3
      name: Cache plugin dir
      with:
        path: ~/.tflint.d/plugins
        key: ${{ matrix.os }}-tflint-${{ hashFiles('.tflint.hcl') }}

    - uses: terraform-linters/setup-tflint@v2
      name: Setup TFLint
      with:
        tflint_version: v0.44.1
      
    # Print TFLint version
    - name: Show version
      run: tflint --version

    # Install plugins
    - name: Init TFLint
      run: tflint --init

    # Run tflint command in each directory recursively # use --force if you want to continue with workflow although errors are there
    - name: Run TFLint
      run: tflint -f compact --recursive 
    
    outputs:
      tflint-passed: true


  terraform-infra:
  .
  .
  .
  ## github action workflow to provison the infra as it.

  
jobs:
  tflint-checks:
  .
  .
  .
  # github action workfow of tflint

  tfsec-checks:
    name: 'tfsec-checks'
    runs-on: ubuntu-latest
    environment: dev
    # tflint-checks need to be checked first
    needs: tflint-checks
    if: ${{ needs.tflint-checks.outputs.tflint-passed == 'true' }}

    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest
    defaults:
      run:
        shell: bash

    steps:
    # Checkout the repository to the GitHub Actions runner
    - name: Checkout
      uses: actions/checkout@v3

    # Tfsec - Security scanner for your Terraform code
    # Reference - https://github.com/aquasecurity/tfsec-action
    - name: Run Tfsec
      uses: aquasecurity/[email protected]

    outputs:
        tfsec-passed: true



  terraform-infra:
  .
  .
  .
  ## github action workflow to provison the infra as it.

    - name: Run Tfsec
      uses: aquasecurity/[email protected]
      with:
        soft_fail: true

name: 'Terraform-infra'

# Runs your workflow when you push a commit
on:
  push:
    branches: [ "main" ]
  pull_request:

permissions:
  contents: read

jobs:
  tflint-checks:
  .
  .
  .
  # github action workfow of tflint

  tfsec-checks:
  .
  .
  .
  ## github action workflow to provison the infra as it.


  checkov-checks:
    name: 'checkov-checks'
    runs-on: ubuntu-latest
    environment: dev
    needs: tfsec-checks
    if: ${{ needs.tfsec-checks.outputs.tfsec-passed == 'true' }}

    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest
    defaults:
      run:
        shell: bash

    steps:
    # Checkout the repository to the GitHub Actions runner
    - name: Checkout
      uses: actions/checkout@v3


    # Checkov - Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code
    # Reference: https://github.com/bridgecrewio/checkov
    # Reference: https://github.com/bridgecrewio/checkov-action

    - name: Checkov GitHub Action
      uses: bridgecrewio/checkov-action@v12
      with:
        # This will add both a CLI output to the console and create a results.sarif file
        output_format: cli,sarif
        output_file_path: console,results.sarif
        quiet: false # optional: display only failed checks
        soft_fail: false # optional: do not return an error code if there are failed checks
        # skip_check: CKV_TF_1,CKV_GCP_62,CKV_GCP_114,CKV_GCP_78   # optional: skip a specific check_id
        log_level: ERROR # optional: set log level. Default WARNING


    # - name: Run Checkov
    #   run: |
    #         docker run --tty --rm -v ${{ github.workspace }}:/tf --workdir /tf bridgecrew/checkov --directory /tf --skip-check CKV_TF_1 --skip-check CKV_GCP_62 --skip-check CKV_GCP_114 --skip-check CKV_GCP_78

    outputs:
      checkov-passed: true




  terraform-infra:
  .
  .
  .
  ## github action workflow to provison the infra as it.