feat: GitHub Actions で静的チェックを実行する #8
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| # push / PR のたびに IaC の静的チェックと構成図生成を検証するワークフロー。 | ||
| # | ||
| # 安全対策: | ||
| # - AWS credentials は一切使わない (GitHub Secrets にも設定しない) | ||
| # - 実行するのは validate / lint / 図生成のみで、AWS へは接続しない | ||
| name: validate | ||
|
|
||
| on: | ||
| push: | ||
| branches: [main] | ||
| pull_request: | ||
|
|
||
| # リポジトリの読み取りだけできれば十分 | ||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| check: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| # このジョブは認証済み Git 操作をしないため GITHUB_TOKEN を保持しない | ||
| persist-credentials: false | ||
|
|
||
| # mise.toml に固定したツール (terraform / tflint / checkov / cfn-lint / cfn-dia) を導入 | ||
| - uses: jdx/mise-action@v2 | ||
|
|
||
| # SAM CLI (mise 管理外なので公式 action で導入) | ||
| - uses: aws-actions/setup-sam@v2 | ||
| with: | ||
| use-installer: true | ||
|
|
||
| # 構成図生成用の Graphviz | ||
| - name: Install Graphviz | ||
| run: sudo apt-get update -qq && sudo apt-get install -y -qq graphviz | ||
|
|
||
| # InfraMap はバイナリ配布が無いため Go でソースからインストールする | ||
| # (macOS ローカルでは brew install inframap でよい) | ||
| - uses: actions/setup-go@v5 | ||
| with: | ||
| go-version: stable | ||
| cache: false | ||
| - name: Install InfraMap | ||
| run: | | ||
| go install github.com/cycloidio/inframap@v0.8.1 | ||
| echo "$HOME/go/bin" >> "$GITHUB_PATH" | ||
|
|
||
| # ローカルの学習サイクルと同じ一括チェックを実行する | ||
| - name: Run make check | ||
| run: make check | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,12 @@ | ||
| # プロジェクトで使うツールとバージョンの固定 (mise install で一括導入)。 | ||
| # CI (GitHub Actions) でも同じ定義を使うため、"latest" ではなく明示的に固定する | ||
| [tools] | ||
| terraform = "1.15.8" | ||
| tflint = "0.64.0" | ||
| "pipx:checkov" = "3.3.9" | ||
| "pipx:cfn-lint" = "1.54.0" | ||
| # fast-xml-parser@4.5.7 は provenance 無しのため mise の trust policy に検出されるが、 | ||
| # npm tarball と GitHub の v4.5.7 タグのソース一致・公開者が 4.x 系従来のメンテナ本人 | ||
| # であることを確認済み (5.x のみ trusted publishing を使う運用のため)。この 1 バージョン | ||
| # だけを検証済みとして除外する | ||
| "npm:@mhlabs/cfn-diagram" = { version = "1.1.40", trust_policy_excludes = ["fast-xml-parser@4.5.7"] } |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -27,6 +27,17 @@ Resources: | |
| # AWS がランタイムを管理してくれる標準的な形。まずはこちらが基本 | ||
| HelloFunction: | ||
| Type: AWS::Serverless::Function | ||
| Metadata: | ||
| # checkov が指摘する下記 3 点は本来設計すべき項目だが、学習用プレースホルダの | ||
| # ため理由を明記した上でスキップする。本実装では各項目を設計判断すること | ||
| checkov: | ||
| skip: | ||
| - id: CKV_AWS_115 # 同時実行数制限: 暴走や下流サービス保護のための上限設定 | ||
| comment: "learning placeholder" | ||
| - id: CKV_AWS_116 # DLQ: 失敗イベントを退避して調査・再処理できるようにする | ||
| comment: "learning placeholder" | ||
| - id: CKV_AWS_117 # VPC 配置: プライベートリソースへ安全にアクセスするため | ||
| comment: "learning placeholder" | ||
|
Comment on lines
+30
to
+40
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
tmp="$(mktemp)"
trap 'rm -f "$tmp"' EXIT
set +e
mise exec -- checkov \
--directory sam \
--check CKV_AWS_115,CKV_AWS_116,CKV_AWS_117 \
--compact >"$tmp" 2>&1
status=$?
set -e
cat "$tmp"
test "$status" -eq 0
grep -q 'Suppressed Checks: 6' "$tmp"
! grep -q 'Suppress comment: learning placeholder' "$tmp"Repository: kenshin-morioka/aws-learning Length of output: 204 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- candidate files ---'
git ls-files | rg '(^|/)(template\.yaml|Makefile|mise\.toml|pyproject\.toml|requirements.*|\.checkov\.yaml|README)' || true
printf '%s\n' '--- template locations ---'
rg -n -C 5 'CKV_AWS_11[567]|learning placeholder|Hello(Function|RustFunction)|Metadata:' sam/template.yaml
printf '%s\n' '--- Checkov references ---'
rg -n -i -C 3 'checkov|CKV_AWS_11[567]|Suppressed Checks' . --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' || trueRepository: kenshin-morioka/aws-learning Length of output: 7543 🌐 Web query:
💡 Result: In Checkov, you can suppress specific policy checks like CKV_AWS_115, CKV_AWS_116, and CKV_AWS_117 in AWS CloudFormation and SAM templates using either inline comments or the resource Metadata section [1][2]. Inline Comments To suppress a check for a specific resource, add a comment directly above the resource definition using the following pattern [1][3]: # checkov:skip=<check_id>:<suppression_comment> Example: Resources: MyLambdaFunction: # checkov:skip=CKV_AWS_115:Function-level concurrent execution limit is not required # checkov:skip=CKV_AWS_116:Dead Letter Queue is not required # checkov:skip=CKV_AWS_117:Function is not inside a VPC Type: AWS::Serverless::Function Properties: Handler: index.handler Runtime: nodejs18.x Metadata Section Alternatively, you can use the Metadata section within the resource. This is often cleaner for multiple suppressions [1][2]. Example: Resources: MyLambdaFunction: Type: AWS::Serverless::Function Metadata: checkov: skip: - id: CKV_AWS_115 comment: Function-level concurrent execution limit is not required - id: CKV_AWS_116 comment: Dead Letter Queue is not required - id: CKV_AWS_117 comment: Function is not inside a VPC Properties: Handler: index.handler Runtime: nodejs18.x Global Suppression If you prefer to skip these checks across your entire project, you can use a.checkov.yml configuration file [3][4]: skip-check: - CKV_AWS_115 - CKV_AWS_116 - CKV_AWS_117 Note that AWS SAM templates are scanned using the same underlying logic as CloudFormation [5]. The Metadata approach is particularly effective when working with generated templates (such as those from AWS CDK or Serverless Framework) [6][7]. Citations:
🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- pinned tool configuration ---'
cat -n mise.toml | sed -n '1,12p'
printf '%s\n' '--- relevant template ---'
cat -n sam/template.yaml | sed -n '20,70p'
printf '%s\n' '--- local Checkov availability ---'
command -v checkov || true
python3 - <<'PY'
try:
import checkov
print("python checkov import: available")
except Exception as exc:
print(f"python checkov import: unavailable ({type(exc).__name__}: {exc})")
PY
printf '%s\n' '--- structured skip-entry count from template text ---'
python3 - <<'PY'
from pathlib import Path
text = Path("sam/template.yaml").read_text()
ids = ["CKV_AWS_115", "CKV_AWS_116", "CKV_AWS_117"]
for function in ("HelloFunction", "HelloRustFunction"):
start = text.index(f" {function}:")
end = text.find("\n ", start + 3)
block = text[start:] if end == -1 else text[start:end]
print(function)
for check_id in ids:
occurrences = block.count(f"id: {check_id}")
comments = []
for line in block.splitlines():
if f"id: {check_id}" in line:
comments.append(line)
print(f" {check_id}: entries={occurrences}, {comments}")
PYRepository: kenshin-morioka/aws-learning Length of output: 3200 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- installed Checkov wrapper/version ---'
head -n 5 /usr/local/bin/checkov 2>/dev/null || true
checkov --version
printf '%s\n' '--- targeted Checkov scan ---'
tmp="$(mktemp)"
trap 'rm -f "$tmp"' EXIT
set +e
checkov --directory sam \
--check CKV_AWS_115,CKV_AWS_116,CKV_AWS_117 \
--compact >"$tmp" 2>&1
status=$?
set -e
cat "$tmp"
printf 'checkov_exit=%s\n' "$status"
printf '%s\n' '--- corrected six-entry check ---'
python3 - <<'PY'
from pathlib import Path
text = Path("sam/template.yaml").read_text()
for function in ("HelloFunction", "HelloRustFunction"):
start = text.index(f" {function}:")
next_function = text.find("\n ", start + len(function) + 4)
block = text[start:] if next_function < 0 else text[start:next_function]
print(function)
for check_id in ("CKV_AWS_115", "CKV_AWS_116", "CKV_AWS_117"):
lines = [line.strip() for line in block.splitlines() if f"- id: {check_id}" in line]
comments = [
line.strip() for line in block.splitlines()
if line.strip().startswith("comment:")
]
print(f" {check_id}: {len(lines)} entry, comments={comments}")
PYRepository: kenshin-morioka/aws-learning Length of output: 5062 Checkov の抑制理由をチェックごとに具体化してください。
Checkov 3.3.9で 🤖 Prompt for AI Agents |
||
| Properties: | ||
| CodeUri: src/hello/ # コードの場所 (ディレクトリ) | ||
| Handler: app.lambda_handler # <ファイル名>.<関数名> | ||
|
|
@@ -40,6 +51,15 @@ Resources: | |
| Metadata: | ||
| # sam build に「cargo-lambda でビルドする」ことを伝える設定 | ||
| BuildMethod: rust-cargolambda | ||
| # HelloFunction と同じ理由で学習用プレースホルダとしてスキップ | ||
| checkov: | ||
| skip: | ||
| - id: CKV_AWS_115 | ||
| comment: "learning placeholder" | ||
| - id: CKV_AWS_116 | ||
| comment: "learning placeholder" | ||
| - id: CKV_AWS_117 | ||
| comment: "learning placeholder" | ||
| Properties: | ||
| CodeUri: src/hello-rust/ # Cargo.toml があるディレクトリ | ||
| Handler: bootstrap # カスタムランタイムでは固定値 (バイナリ名) | ||
|
|
||
Uh oh!
There was an error while loading. Please reload this page.