terrascan-pipeline.yml

trigger: none
pr: none

pool:
  vmImage: 'ubuntu-latest'

stages:
- stage: QualityCheckStage
  displayName: Quality Check Stage
  jobs:
    - job: TerraScanJob
      displayName: Run TerraScan Scan
      steps:
      - script: | 
          mkdir TerraScanReport
          docker pull accurics/terrascan
          docker run \
            --rm \
            --volume $(System.DefaultWorkingDirectory)/Infrastructure-Source-Code/terraform/azure:/iac \
            --workdir /iac \
            accurics/terrascan:latest scan \
              --iac-type terraform \
              --policy-type all \
              --verbose \
              --output xml > $(System.DefaultWorkingDirectory)/TerraScanReport/TerraScan-Report.xml
          
          docker run \
            --rm \
            --volume $(System.DefaultWorkingDirectory)/Infrastructure-Source-Code/terraform/azure:/iac \
            --workdir /iac \
            accurics/terrascan:latest scan \
              --iac-type terraform \
              --policy-type all \
              --verbose
        displayName: 'Accurics TerraScan Code Analysis'
      
      - script: |
          cd $(System.DefaultWorkingDirectory)/TerraScanReport
          ls -la
        displayName: 'DIR Contents'
        condition: always()
      
      # Publish the TerraScan report as an artifact to Azure Pipelines
      - task: PublishBuildArtifacts@1
        displayName: 'Publish Artifact: Terrascan Report'
        condition: succeededOrFailed()
        inputs:
          PathtoPublish: '$(System.DefaultWorkingDirectory)/TerraScanReport'
          ArtifactName: TerrascanReport

      - task: PublishTestResults@2
        displayName: Publish Terrascan Test Results
        condition: succeededOrFailed()
        inputs:
          testResultsFormat: 'JUnit' # Options JUnit, NUnit, VSTest, xUnit, cTest
          testResultsFiles: '**/*TerraScan-Report.xml'
          searchFolder: '$(System.DefaultWorkingDirectory)/TerraScanReport'
          mergeTestResults: false
          testRunTitle: Terrascan Scan
          failTaskOnFailedTests: false
          publishRunAttachments: true