cfn-nag.yml

name: Cfn-nag check
'on':
  pull_request: {}
  workflow_dispatch: {}
jobs:
  cfn-nag:
    runs-on: ubuntu-latest
    env:
      CI: 'true'
    steps:
      - name: Checkout
        uses: actions/checkout@v2
        with:
          ref: '${{ github.event.pull_request.head.ref }}'
          repository: '${{ github.event.pull_request.head.repo.full_name }}'
      - uses: actions/setup-node@v2
        with:
          node-version: '16'
          cache: yarn
      - name: Install dependencies
        run: |
          yarn install --check-files --frozen-lockfile
          npx projen
      - name: synth
        run: npx cdk synth -c EnableDashboardCustomDomain=true --json -q
      - uses: stelligent/cfn_nag@master
        with:
          input_path: cdk.out/
          extra_args: >-
            --template-pattern ..*.template.json --fail-on-warnings -b
            .cfn-nag-ignore-lists.yml --print-suppression
      - name: synth
        run: npx cdk synth -c TargetPartition=aws-cn --json --output cn -q
      - uses: stelligent/cfn_nag@master
        with:
          input_path: cn/
          extra_args: >-
            --template-pattern ..*.template.json --fail-on-warnings -b
            .cfn-nag-ignore-lists.yml --print-suppression
      - name: synth
        run: npx cdk synth --json --output default -q
      - uses: stelligent/cfn_nag@master
        with:
          input_path: default/
          extra_args: >-
            --template-pattern ..*.template.json --fail-on-warnings -b
            .cfn-nag-ignore-lists.yml --print-suppression