wc-conftest-verify.yaml

---
name: conftest verify
on:
  workflow_call:
    inputs:
      ref:
        required: false
        type: string
    secrets:
      gh_app_id:
        required: false
      gh_app_private_key:
        required: false
env:
  GH_COMMENT_SHA1: ${{inputs.ref}}
jobs:
  conftest-verify:
    timeout-minutes: 30
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          ref: ${{inputs.ref}}

      - id: generate_token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
        with:
          app_id: ${{secrets.gh_app_id}}
          private_key: ${{secrets.gh_app_private_key}}
          # pull_requests:write - Post comments
          permissions: >-
            {"pull_requests": "write"}
          repositories: >-
            ["${{github.event.repository.name}}"]

      - uses: aquaproj/aqua-installer@6ce1f8848ec8e61f14d57bd5d7597057a6dd187c # v3.0.1
        with:
          aqua_version: v2.31.0
        env:
          AQUA_GITHUB_TOKEN: ${{steps.generate_token.outputs.token}}

      - run: github-comment exec -- conftest verify --no-color -p policy/terraform
        env:
          GITHUB_TOKEN: ${{steps.generate_token.outputs.token}}