- \u30b3\u30fc\u30c9\u306e\u5909\u66f4\u304c\u3042\u3063\u305f\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u3067\u306e\u307fplan\u3092\u5b9f\u884c\u3059\u308b<\/ul>\n<\/li>\n<\/ul>\n
- \n
- tfsec, tflint\u306a\u3069\u3067\u30b3\u30fc\u30c9\u306e\u30c1\u30a7\u30c3\u30af\u3092\u884c\u3046<\/ul>\n<\/li>\n<\/ul>\n
- \n
- \u30d7\u30eb\u30ea\u30af\u30a8\u30b9\u30c8\u3067plan\u7d50\u679c\u3084\u30c1\u30a7\u30c3\u30af\u3067\u767a\u751f\u3057\u305f\u30a8\u30e9\u30fc\u3092\u78ba\u8a8d\u3067\u304d\u308b\u3088\u3046\u306b\u3059\u308b<\/ul>\n<\/li>\n<\/ul>\n
- \n
- \u74b0\u5883<\/ul>\n<\/li>\n<\/ul>\n
- \n
- \u958b\u767a\u74b0\u5883(dev)\u3068\u672c\u756a\u74b0\u5883(prod)\u306e\u4e8c\u3064\u3092\u69cb\u7bc9<\/ul>\n<\/li>\n<\/ul>\n
- \n
- \u904b\u7528\u30d5\u30ed\u30fc<\/ul>\n<\/li>\n<\/ul>\n
- \n
- \u30d6\u30e9\u30f3\u30c1\u6226\u7565\u306fgit-flow\u306b\u8fd1\u3044\u5f62\u306b\u3057\u3066\u3044\u307e\u3059\u3002<\/ul>\n<\/li>\n<\/ul>\n
- \n
- main\u30d6\u30e9\u30f3\u30c1\u304b\u3089develop\u30d6\u30e9\u30f3\u30c1\u3092\u4f5c\u6210\u3057\u3001develop\u30d6\u30e9\u30f3\u30c1\u304b\u3089feature\u30d6\u30e9\u30f3\u30c1\u3092\u4f5c\u6210\u3057\u3001\u958b\u767a\u306ffeature\u30d6\u30e9\u30f3\u30c1\u3067\u884c\u3044\u307e\u3059\u3002<\/ul>\n<\/li>\n<\/ul>\n
- \n
- \u958b\u767a\u6642\u306e\u30d5\u30ed\u30fc\u306f\u4ee5\u4e0b\u306e\u3088\u3046\u306a\u3082\u306e\u3092\u60f3\u5b9a\u3057\u3066\u3044\u307e\u3059\u3002<\/ul>\n<\/li>\n<\/ul>\n
- \n
- \u2460feature\u30d6\u30e9\u30f3\u30c1\u3067\u5b9f\u88c5<\/ul>\n<\/li>\n<\/ul>\n
- \n
- \u2461feature\u30d6\u30e9\u30f3\u30c1\u304b\u3089develop\u30d6\u30e9\u30f3\u30c1\u306b\u30d7\u30eb\u30ea\u30af\u3092\u4f5c\u6210<\/ul>\n<\/li>\n<\/ul>\n
- \n
- \u2462\u958b\u767a\u74b0\u5883\u306b\u5bfe\u3057\u3066plan\u3092\u5b9f\u884c<\/ul>\n<\/li>\n<\/ul>\n
- \n
- \u2463\u554f\u984c\u304c\u306a\u3051\u308c\u3070\u30d7\u30eb\u30ea\u30af\u3092\u30de\u30fc\u30b8<\/ul>\n<\/li>\n<\/ul>\n
- \n
- \u2464\u958b\u767a\u74b0\u5883\u306b\u5bfe\u3057\u3066apply\u3092\u5b9f\u884c<\/ul>\n<\/li>\n<\/ul>\n
- \n
- \u2465develop\u30d6\u30e9\u30f3\u30c1\u304b\u3089main\u30d6\u30e9\u30f3\u30c1\u306b\u30d7\u30eb\u30ea\u30af\u3092\u4f5c\u6210<\/ul>\n<\/li>\n<\/ul>\n
- \n
- \u2466\u672c\u756a\u74b0\u5883\u306b\u5bfe\u3057\u3066plan\u3092\u5b9f\u884c<\/ul>\n<\/li>\n<\/ul>\n
- \n
- \u2467\u554f\u984c\u304c\u306a\u3051\u308c\u3070\u30d7\u30eb\u30ea\u30af\u3092\u30de\u30fc\u30b8<\/ul>\n<\/li>\n<\/ul>\n
<\/p>\n
- \u2468\u672c\u756a\u74b0\u5883\u306b\u5bfe\u3057\u3066apply\u3092\u5b9f\u884c<\/ul>\n
\u4f7f\u7528\u7684\u5de5\u5177<\/h1>\n
\n\u30c4\u30fc\u30eb\u540d\u6982\u8981Terragrunt<\/a>Terragrunt\u306f\u3001Terraform\u306e\u8a2d\u5b9a\u3092\u7c21\u7d20\u5316\u3057\u3001\u5171\u6709\u53ef\u80fd\u306a\u30b3\u30fc\u30c9\u30e2\u30b8\u30e5\u30fc\u30eb\u3092\u518d\u5229\u7528\u3059\u308b\u305f\u3081\u306e\u30c4\u30fc\u30eb\u3067\u3059\u3002Terraform\u306e\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9\u3092\u30b5\u30dd\u30fc\u30c8\u3057\u307e\u3059\u3002tfsec<\/a>tfsec\u306f\u3001Terraform\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8a2d\u5b9a\u3092\u30b9\u30ad\u30e3\u30f3\u3057\u3066\u3001\u6f5c\u5728\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30b9\u30af\u3092\u898b\u3064\u3051\u308b\u305f\u3081\u306e\u9759\u7684\u89e3\u6790\u30c4\u30fc\u30eb\u3067\u3059\u3002tflint<\/a>tflint\u306f\u3001Terraform\u30b3\u30fc\u30c9\u306e\u6f5c\u5728\u7684\u306a\u554f\u984c\u3092\u691c\u51fa\u3059\u308b\u305f\u3081\u306e\u30b3\u30fc\u30c9\u30c1\u30a7\u30c3\u30ab\u30fc\u3067\u3059\u3002\u30b7\u30f3\u30bf\u30c3\u30af\u30b9\u3068\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9\u306b\u5bfe\u3057\u3066\u30c1\u30a7\u30c3\u30af\u3092\u884c\u3044\u307e\u3059\u3002reviewdog<\/a>reviewdog\u306f\u3001\u30b3\u30fc\u30c9\u30ec\u30d3\u30e5\u30fc\u6642\u306b\u9759\u7684\u89e3\u6790\u30c4\u30fc\u30eb\u306e\u51fa\u529b\u3092\u30d5\u30a3\u30fc\u30c9\u30d0\u30c3\u30af\u3059\u308b\u30c4\u30fc\u30eb\u3067\u3059\u3002\u591a\u304f\u306e\u8a00\u8a9e\u3068\u30c4\u30fc\u30eb\u306b\u5bfe\u5fdc\u3057\u3066\u3044\u307e\u3059\u3002tfcmt<\/a>tfcmt \u306f terraform plan, apply \u306e\u7d50\u679c\u3092 GitHub \u306e Pull Request \u306b\u30b3\u30e1\u30f3\u30c8\u3068\u3057\u3066\u901a\u77e5\u3059\u308b CLI \u30c4\u30fc\u30eb\u3067\u3059\u3002aqua<\/a>aqua\u306f\u3001CLI \u30c4\u30fc\u30eb\u3092 YAML \u3067\u30d0\u30fc\u30b8\u30e7\u30f3\u7ba1\u7406\u3067\u304d\u308b\u30c4\u30fc\u30eb\u3067\u3059\u3002<\/div>\n<\/div>\n\u8ba1\u5212\u7684\u5de5\u4f5c\u6d41\u7a0b<\/h1>\n
\u8bf7\u4ece\u6b64\u5904\u67e5\u770b\u8ba1\u5212\u5de5\u4f5c\u6d41\u7a0bplan.yml
\nname: Terraform\u8ba1\u5212
\non:
\npull_request:
\nbranches:
\n– \u4e3b\u8981\u7684
\n– \u53d1\u5c55
\ntypes:
\n– \u6253\u5f00\u7684
\n– \u540c\u6b65\u7684<\/p>\nenv:
\nAWS_REGION: ${{ vars.AWS_REGION }}
\nSYSTEM: ${{ vars.SYSTEM }}
\nDEV_AWS_ACCOUNT_ID: ${{ secrets.DEV_AWS_ACCOUNT_ID }}
\nPROD_AWS_ACCOUNT_ID: ${{ secrets.PROD_AWS_ACCOUNT_ID }}<\/p>\npermissions:
\ncontents: \u8bfb\u53d6
\nid-token: \u5199\u5165
\npull-requests: \u5199\u5165
\nactions: \u8bfb\u53d6<\/p>\njobs:
\nnotify-started:
\nuses: .\/.github\/workflows\/_notify_started.yml
\nsecrets: \u7ee7\u627f<\/p>\nsetup:
\nruns-on: ubuntu-latest
\noutputs:
\nmodules_changed_dirs: ${{ steps.modules_changes.outputs.changes }}
\nenvs_changed_dirs: ${{ steps.filter_changed_envs_dirs.outputs.envs_changed_dirs}}
\nsteps:
\n– name: \u68c0\u51fa
\nuses: actions\/checkout@v3<\/p>\n– name: \u83b7\u53d6\u53d8\u66f4\u7684\u6a21\u5757\u76ee\u5f55
\nuses: dorny\/paths-filter@v2
\nid: modules_changes
\nwith:
\nfilters: .github\/modules-path-filter.yml<\/p>\n– name: \u83b7\u53d6\u53d8\u66f4\u7684\u73af\u5883\u76ee\u5f55
\nuses: dorny\/paths-filter@v2
\nid: envs_changes
\nwith:
\nfilters: .github\/envs-path-filter.yml<\/p>\n– name: \u8fc7\u6ee4\u53d8\u66f4\u7684\u73af\u5883\u76ee\u5f55
\nid: filter_changed_envs_dirs
\nrun: |
\ndirs=${{ toJSON(steps.envs_changes.outputs.changes) }}
\nif [ ${{ github.base_ref }} == ‘main’ ]; then
\nenv_type=’prod’
\nelif [ ${{ github.base_ref }} == ‘develop’ ]; then
\nenv_type=’dev’
\nelse
\necho “\u4e0d\u652f\u6301\u7684base_ref: ${{ github.base_ref }}” >&2
\nexit 1
\nfi<\/p>\nenv_changed_dirs=$( echo “${dirs}” | jq ‘.[]’ | grep $env_type | jq -sc )
\necho “envs_changed_dirs=${env_changed_dirs}” >> $GITHUB_OUTPUT<\/p>\nmodules-ci:
\nneeds: setup
\nif: needs.setup.outputs.modules_changed_dirs != ‘[]’
\nruns-on: ubuntu-latest
\nstrategy:
\nfail-fast: false
\nmatrix:
\nchanged_dir: ${{ fromJson(needs.setup.outputs.modules_changed_dirs) }}
\nsteps:
\n– name: \u68c0\u51fa
\nuses: actions\/checkout@v3<\/p>\n– name: \u8bbe\u7f6eaqua
\nuses: aquaproj\/aqua-installer@v2.1.2
\nwith:
\naqua_version: v2.9.0
\naqua_opts: “”<\/p>\n– name: \u8bbe\u7f6e\u5f00\u53d1\u73af\u5883\u7684\u73af\u5883\u53d8\u91cf
\nif: github.base_ref == ‘develop’
\nrun: |
\necho “ENVIRONMENT=dev” >> $GITHUB_ENV
\necho “AWS_ACCOUNT_ID=$DEV_AWS_ACCOUNT_ID” >> $GITHUB_ENV<\/p>\n– name: \u8bbe\u7f6e\u751f\u4ea7\u73af\u5883\u7684\u73af\u5883\u53d8\u91cf
\nif: github.base_ref == ‘main’
\nrun: |
\necho “ENVIRONMENT=prod” >> $GITHUB_ENV
\necho “AWS_ACCOUNT_ID=$PROD_AWS_ACCOUNT_ID” >> $GITHUB_ENV<\/p>\n– name: \u914d\u7f6eAWS\u51ed\u636e
\nuses: aws-actions\/configure-aws-credentials@v1-node16
\nwith:
\nrole-to-assume: arn:aws:iam::${{ env.AWS_ACCOUNT_ID }}:role\/${{ env.SYSTEM }}-${{ env.ENVIRONMENT }}-github-actions-terraform-role
\nrole-session-name: ${{ env.SYSTEM }}-${{ env.ENVIRONMENT }}-github-actions-terraform-session
\naws-region: ${{ env.AWS_REGION }}<\/p>\n– name: TFlint
\nworking-directory: modules\/${{ matrix.changed_dir }}
\nenv:
\nREVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
\nrun: |
\ntflint –config $GITHUB_WORKSPACE\/.tflint.hcl –init
\ntflint –config $GITHUB_WORKSPACE\/.tflint.hcl –format=checkstyle | \\
\nreviewdog -f=checkstyle \\
\n-name=”tflint” \\
\n-reporter=github-pr-review \\
\n-filter-mode=nofilter \\
\n-fail-on-error \\<\/p>\n– name: \u68c0\u67e5Terraform\u683c\u5f0f\u5316
\nworking-directory: modules\/${{ matrix.changed_dir }}
\nrun: terraform fmt -check<\/p>\nenvs-ci:
\nneeds: setup
\nif: needs.setup.outputs.envs_changed_dirs != ‘[]’
\nruns-on: ubuntu-latest
\nstrategy:
\nfail-fast: false
\nmatrix:
\nchanged_dir: ${{ fromJson(needs.setup.outputs.envs_changed_dirs) }}
\nsteps:
\n– name: \u68c0\u51fa
\nuses: actions\/checkout@v3<\/p>\n– name: \u8bbe\u7f6eaqua
\nuses: aquaproj\/aqua-installer@v2.1.2
\nwith:
\naqua_version: v2.9.0
\naqua_opts: “”<\/p>\n– name: \u8bbe\u7f6e\u5f00\u53d1\u73af\u5883\u7684\u73af\u5883\u53d8\u91cf
\nif: github.base_ref == ‘develop’
\nrun: |
\necho “ENVIRONMENT=dev” >> $GITHUB_ENV
\necho “AWS_ACCOUNT_ID=$DEV_AWS_ACCOUNT_ID” >> $GITHUB_ENV<\/p>\n– name: \u8bbe\u7f6e\u751f\u4ea7\u73af\u5883\u7684\u73af\u5883\u53d8\u91cf
\nif: github.base_ref == ‘main’
\nrun: |
\necho “ENVIRONMENT=prod” >> $GITHUB_ENV
\necho “AWS_ACCOUNT_ID=$PROD_AWS_ACCOUNT_ID” >> $GITHUB_ENV<\/p>\n– name: \u914d\u7f6eAWS\u51ed\u636e
\nuses: aws-actions\/configure-aws-credentials@v1-node16
\nwith:
\nrole-to-assume: arn:aws:iam::${{ env.AWS_ACCOUNT_ID }}:role\/${{ env.SYSTEM }}-${{ env.ENVIRONMENT }}-github-actions-terraform-role
\nrole-session-name: ${{ env.SYSTEM }}-${{ env.ENVIRONMENT }}-github-actions-terraform-session
\naws-region: ${{ env.AWS_REGION }}<\/p>\n– name: \u914d\u7f6eTerraform\u63d2\u4ef6\u7f13\u5b58
\nrun: |
\necho ‘plugin_cache_dir=”$HOME\/.terraform.d\/plugin-cache”‘ >~\/.terraformrc
\nmkdir –parents ~\/.terraform.d\/plugin-cache<\/p>\n– name: \u7f13\u5b58Terraform\u63d2\u4ef6
\nuses: actions\/cache@v3
\nwith:
\npath: ~\/.terraform.d\/plugin-cache
\nkey: ${{ runner.os }}-terraform-${{ hashFiles(‘**\/.terraform.lock.hcl’) }}
\nrestore-keys: |
\n${{ runner.os }}-terraform-<\/p>\n– name: Terragrunt\u521d\u59cb\u5316
\nworking-directory: envs\/${{ matrix.changed_dir }}
\nrun: |
\nterragrunt init –terragrunt-non-interactive<\/p>\n– name: TFsec
\nworking-directory: envs\/${{ matrix.changed_dir }}
\nenv:
\nREVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
\nrun: |
\ntfsec –format=checkstyle | \\
\nreviewdog -f=checkstyle \\
\n-name=”tfsec” \\
\n-reporter=github-pr-review \\
\n-filter-mode=nofilter \\
\n-fail-on-error \\<\/p>\n– name: TFlint
\nworking-directory: envs\/${{ matrix.changed_dir }}
\nenv:
\nREVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
\nrun: |
\ntflint –config $GITHUB_WORKSPACE\/.tflint.hcl –init
\ntflint –config $GITHUB_WORKSPACE\/.tflint.hcl –format=checkstyle | \\
\nreviewdog -f=checkstyle \\
\n-name=”tflint” \\
\n-reporter=github-pr-review \\
\n-filter-mode=nofilter \\
\n-fail-on-error \\<\/p>\n– name: \u68c0\u67e5terragrunt\u683c\u5f0f\u5316
\nworking-directory: envs\/${{ matrix.changed_dir }}
\nrun: terragrunt fmt -check<\/p>\n– name: Terragrunt\u9a8c\u8bc1
\nworking-directory: envs\/${{ matrix.changed_dir }}
\nrun: terragrunt validate<\/p>\n– name: Terragrunt\u8ba1\u5212
\nworking-directory: envs\/${{ matrix.changed_dir }}
\nenv:
\nGITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
\nrun: |
\nterragrunt plan –terragrunt-tfpath $GITHUB_WORKSPACE\/.github\/scripts\/tfwrapper.sh<\/p>\nnotify-finished:
\nif: always()
\nneeds: [modules-ci, envs-ci]
\nuses: .\/.github\/workflows\/_notify_finished.yml
\nsecrets: \u7ee7\u627f<\/p>\n<\/details>\n\u6211\u8981\u6309\u7167\u91cd\u8981\u7684\u987a\u5e8f\u6765\u89e3\u91ca\u5404\u4e2a\u8981\u70b9\u3002<\/p>\n
\u89e6\u53d1\u6761\u4ef6 (Tr\u00ec<\/h3>\n
on<\/span>:<\/span>\r\n pull_request<\/span>:<\/span>\r\n branches<\/span>:<\/span>\r\n -<\/span> main<\/span>\r\n -<\/span> develop<\/span>\r\n types<\/span>:<\/span>\r\n -<\/span> opened<\/span>\r\n -<\/span> synchronize<\/span>\r\n<\/code><\/pre>\n\u5de5\u4f5c\u6d41\u7684\u89e6\u53d1\u5668\u662f\u5728\u4e3b\u8981\u548c\u5f00\u53d1\u5206\u652f\u4e0a\u53d1\u8d77\u62c9\u53d6\u8bf7\u6c42\u65f6\u4ee5\u53ca\u66f4\u65b0\u62c9\u53d6\u8bf7\u6c42\u65f6\u8fdb\u884c\u8bbe\u7f6e\u3002<\/p>\n
\u83b7\u53d6\u5305\u542b\u6709\u4ee3\u7801\u66f4\u6539\u7684\u76ee\u5f55\u5217\u8868\uff0c\u901a\u8fc7setup\u4f5c\u4e1a\u5b8c\u6210\u3002<\/h3>\n
setup<\/span>:<\/span>\r\n runs-on<\/span>:<\/span> ubuntu-latest<\/span>\r\n outputs<\/span>:<\/span>\r\n modules_changed_dirs<\/span>:<\/span> ${{ steps.modules_changes.outputs.changes }}<\/span>\r\n envs_changed_dirs<\/span>:<\/span> ${{ steps.filter_changed_envs_dirs.outputs.envs_changed_dirs}}<\/span>\r\n steps<\/span>:<\/span>\r\n -<\/span> name<\/span>:<\/span> Checkout<\/span>\r\n uses<\/span>:<\/span> actions\/checkout@v3<\/span>\r\n\r\n -<\/span> name<\/span>:<\/span> Get changed modules dirs<\/span>\r\n uses<\/span>:<\/span> dorny\/paths-filter@v2<\/span>\r\n id<\/span>:<\/span> modules_changes<\/span>\r\n with<\/span>:<\/span>\r\n filters<\/span>:<\/span> .github\/modules-path-filter.yml<\/span>\r\n\r\n -<\/span> name<\/span>:<\/span> Get changed envs dirs<\/span>\r\n uses<\/span>:<\/span> dorny\/paths-filter@v2<\/span>\r\n id<\/span>:<\/span> envs_changes<\/span>\r\n with<\/span>:<\/span>\r\n filters<\/span>:<\/span> .github\/envs-path-filter.yml<\/span>\r\n\r\n -<\/span> name<\/span>:<\/span> Filter changed envs dirs<\/span>\r\n id<\/span>:<\/span> filter_changed_envs_dirs<\/span>\r\n run<\/span>:<\/span> |<\/span>\r\n dirs=${{ toJSON(steps.envs_changes.outputs.changes) }}<\/span>\r\n if [ ${{ github.base_ref }} == 'main' ]; then<\/span>\r\n env_type='prod'<\/span>\r\n elif [ ${{ github.base_ref }} == 'develop' ]; then<\/span>\r\n env_type='dev'<\/span>\r\n else<\/span>\r\n echo \"Unsupported base_ref: ${{ github.base_ref }}\" >&2<\/span>\r\n exit 1<\/span>\r\n fi<\/span>\r\n\r\n env_changed_dirs=$( echo \"${dirs}\" | jq '.[]' | grep $env_type | jq -sc )<\/span>\r\n echo \"envs_changed_dirs=${env_changed_dirs}\" >> $GITHUB_OUTPUT<\/span>\r\n<\/code><\/pre>\n\u901a\u8fc7\u5728 setup \u4f5c\u4e1a\u4e2d\u4f7f\u7528 dorny\/paths-filter \u52a8\u4f5c\uff0c\u53ef\u4ee5\u83b7\u53d6\u5df2\u66f4\u6539\u7684\u76ee\u5f55\u3002\u901a\u8fc7\u9884\u5148\u5b9a\u4e49\u76ee\u6807\u6587\u4ef6\u53ca\u5176\u6807\u7b7e\uff0c\u53ef\u4ee5\u83b7\u53d6\u5bf9\u76ee\u6807\u6587\u4ef6\u53d1\u751f\u5dee\u5f02\u7684\u6807\u7b7e\u5217\u8868\u3002<\/p>\n
\u6b64\u5916\uff0c\u5728envs\u76ee\u5f55\u4e0b\uff0c\u4e0d\u4ec5\u5305\u62ec\u81ea\u8eab\u7684\u76ee\u5f55\uff0c\u8fd8\u5305\u62ec\u4f9d\u8d56\u7684\u6a21\u5757\u3002\u8fd9\u6837\u5373\u4f7f\u4ec5\u6709\u6a21\u5757\u53d1\u751f\u53d8\u66f4\uff0c\u4e5f\u80fd\u591f\u6b63\u786e\u6267\u884c\u8ba1\u5212\u3002<\/p>\n
.github\/envs-path-filter.yml
\ndev\/app:
\n– ‘envs\/dev\/app\/**’
\n– ‘modules\/ecr\/**’
\n– ‘modules\/ecs\/**’
\n– ‘modules\/cognito_user_pool\/**’
\n– ‘modules\/s3\/**’
\n– ‘modules\/ses\/**’
\n– ‘modules\/lambda\/**’prod\/app:
\n– ‘envs\/prod\/app\/**’
\n– ‘modules\/ecr\/**’
\n– ‘modules\/ecs\/**’
\n– ‘modules\/cognito_user_pool\/**’
\n– ‘modules\/s3\/**’
\n– ‘modules\/ses\/**’
\n– ‘modules\/lambda\/**’<\/p>\ndev\/cicd:
\n– ‘envs\/dev\/cicd\/**’<\/p>\nprod\/cicd:
\n– ‘envs\/prod\/cicd\/**’<\/p>\ndev\/log:
\n– ‘envs\/dev\/log\/**’
\n– ‘modules\/s3\/**’
\n– ‘modules\/athena\/**’
\n– ‘modules\/lambda\/**’<\/p>\nprod\/log:
\n– ‘envs\/prod\/log\/**’
\n– ‘modules\/s3\/**’
\n– ‘modules\/athena\/**’
\n– ‘modules\/lambda\/**’<\/p>\ndev\/network:
\n– ‘envs\/dev\/network\/**’
\n– ‘modules\/vpc\/**’<\/p>\nprod\/network:
\n– ‘envs\/prod\/network\/**’
\n– ‘modules\/vpc\/**’<\/p>\ndev\/operation:
\n– ‘envs\/dev\/operation\/**’
\n– ‘modules\/cloudtrail\/**’
\n– ‘modules\/config\/**’<\/p>\nprod\/operation:
\n– ‘envs\/prod\/operation\/**’
\n– ‘modules\/cloudtrail\/**’
\n– ‘modules\/config\/**’<\/p>\ndev\/routing:
\n– ‘envs\/dev\/routing\/**’
\n– ‘modules\/acm\/**’
\n– ‘modules\/cloudfront\/**’
\n– ‘modules\/elb\/**’
\n– ‘modules\/waf\/**’<\/p>\nprod\/routing:
\n– ‘envs\/prod\/routing\/**’
\n– ‘modules\/acm\/**’
\n– ‘modules\/cloudfront\/**’
\n– ‘modules\/elb\/**’
\n– ‘modules\/waf\/**’<\/p>\ndev\/security:
\n– ‘envs\/dev\/security\/**’
\n– ‘modules\/guardduty\/**’
\n– ‘modules\/securityhub\/**’<\/p>\nprod\/security:
\n– ‘envs\/prod\/security\/**’
\n– ‘modules\/lambda\/**’
\n– ‘modules\/guardduty\/**’
\n– ‘modules\/securityhub\/**’<\/p>\ndev\/storage:
\n– ‘envs\/dev\/storage\/**’
\n– ‘modules\/rds_aurora\/**’<\/p>\nprod\/storage:
\n– ‘envs\/prod\/storage\/**’
\n– ‘modules\/rds_aurora\/**’<\/p>\n<\/details>\n\u4ee5\u4e0b\u662fmodules\u7684\u8a2d\u5b9a\u6a94\u6848.github\/modules-path-filter.yml
\nacm:
\n– ‘modules\/acm\/**’<\/p>\nathena:
\n– ‘modules\/athena\/**’<\/p>\ncloudfront:
\n– ‘modules\/cloudfront\/**’<\/p>\ncloudtrail:
\n– ‘modules\/cloudtrail\/**’<\/p>\ncognito_user_pool:
\n– ‘modules\/cognito_user_pool\/**’<\/p>\nconfig:
\n– ‘modules\/config\/**’<\/p>\necr:
\n– ‘modules\/ecr\/**’<\/p>\necs:
\n– ‘modules\/ecs\/**’<\/p>\nelb:
\n– ‘modules\/elb\/**’<\/p>\nguardduty:
\n– ‘modules\/guardduty\/**’<\/p>\nlambda:
\n– ‘modules\/lambda\/**’<\/p>\nrds_aurora:
\n– ‘modules\/rds_aurora\/**’<\/p>\ns3:
\n– ‘modules\/s3\/**’<\/p>\nsecurityhub:
\n– ‘modules\/securityhub\/**’<\/p>\nses:
\n– ‘modules\/ses\/**’<\/p>\nvpc:
\n– ‘modules\/vpc\/**’<\/p>\nwaf:
\n– ‘modules\/waf\/**’<\/p>\n<\/details>\n\u5728\u8bbe\u7f6e\u4f5c\u4e1a\u4e2d\uff0c\u5dee\u5f02\u76ee\u5f55\u5217\u8868\u88ab\u8bbe\u7f6e\u4e3a\u8f93\u51fa\uff0c\u5e76\u5728\u540e\u7eed\u4f5c\u4e1a\u4e2d\u7528\u4f5c\u77e9\u9635\u8f93\u5165\u3002<\/p>\n
\u6a21\u5757\u7684\u516c\u53f8\u8bc6\u522b\u53f7<\/h3>\n
\u5728modules-ci\u7684\u5de5\u4f5c\u4e2d\u6267\u884c\u5bf9\u6a21\u5757\u7684CI\u64cd\u4f5c\u3002<\/p>\n
- matrics\u3092\u8a2d\u5b9a<\/ul>\n
modules-ci<\/span>:<\/span>\r\n needs<\/span>:<\/span> setup<\/span>\r\n if<\/span>:<\/span> needs.setup.outputs.modules_changed_dirs != '[]'<\/span>\r\n runs-on<\/span>:<\/span> ubuntu-latest<\/span>\r\n strategy<\/span>:<\/span>\r\n fail-fast<\/span>:<\/span> false<\/span>\r\n matrix<\/span>:<\/span>\r\n changed_dir<\/span>:<\/span> ${{ fromJson(needs.setup.outputs.modules_changed_dirs) }}<\/span>\r\n<\/code><\/pre>\n\u901a\u8fc7\u8bbe\u7f6esetup job\u7684\u8f93\u51fa\uff0c\u4ece\u5dee\u5f02\u53d1\u751f\u7684\u6a21\u5757\u76ee\u5f55\u5217\u8868\u4e2d\u8bbe\u7f6e\u77e9\u9635\u3002
\n\u53ef\u4ee5\u901a\u8fc7\u8fd9\u4e2a\u65b9\u6cd5\u5e76\u884c\u5904\u7406\u6240\u6709\u5dee\u5f02\u53d1\u751f\u7684\u6a21\u5757\u3002
\n\u6b64\u5916\uff0c\u901a\u8fc7\u6307\u5b9afail-fast: false\uff0c\u5373\u4f7f\u4e00\u4e2a\u4f5c\u4e1a\u5931\u8d25\uff0c\u5176\u4ed6\u4f5c\u4e1a\u4e5f\u4e0d\u4f1a\u88ab\u53d6\u6d88\uff0c\u800c\u662f\u4f1a\u4e00\u76f4\u6267\u884c\u5230\u6700\u540e\u3002<\/p>\n![\"\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8](\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d85d8913a08637a6ba5a4\/30-0.png\" "\\"\\"")
<\/div>\n- aqua\u3092\u4f7f\u7528\u3057\u3066CLI\u30c4\u30fc\u30eb\u3092\u30bb\u30c3\u30c8\u30a2\u30c3\u30d7<\/ul>\n
-<\/span> name<\/span>:<\/span> Setup aqua<\/span>\r\n uses<\/span>:<\/span> aquaproj\/aqua-installer@v2.1.2<\/span>\r\n with<\/span>:<\/span>\r\n aqua_version<\/span>:<\/span> v2.9.0<\/span>\r\n aqua_opts<\/span>:<\/span> \"<\/span>\"<\/span>\r\n<\/code><\/pre>\n\u4f7f\u7528 Aqua \u7684\u64cd\u4f5c\u6765\u5b89\u88c5\u5728\u914d\u7f6e\u6587\u4ef6\u4e2d\u63cf\u8ff0\u7684\u5de5\u5177\u3002
\n\u914d\u7f6e\u6587\u4ef6\u5982\u4e0b\u6240\u793a\u3002<\/p>\n---<\/span>\r\n# aqua - Declarative CLI Version Manager<\/span>\r\n# https:\/\/aquaproj.github.io\/<\/span>\r\n# checksum:<\/span>\r\n# # https:\/\/aquaproj.github.io\/docs\/reference\/checksum\/<\/span>\r\n# enabled: true<\/span>\r\n# require_checksum: true<\/span>\r\n# supported_envs:<\/span>\r\n# - all<\/span>\r\nregistries<\/span>:<\/span>\r\n-<\/span> type<\/span>:<\/span> standard<\/span>\r\n ref<\/span>:<\/span> v4.23.0<\/span> # renovate: depName=aquaproj\/aqua-registry<\/span>\r\npackages<\/span>:<\/span>\r\n-<\/span> name<\/span>:<\/span> aquasecurity\/tfsec@v1.28.1<\/span>\r\n-<\/span> name<\/span>:<\/span> hashicorp\/terraform@v1.5.2<\/span>\r\n-<\/span> name<\/span>:<\/span> gruntwork-io\/terragrunt@v0.48.0<\/span>\r\n-<\/span> name<\/span>:<\/span> terraform-linters\/tflint@v0.47.0<\/span>\r\n-<\/span> name<\/span>:<\/span> reviewdog\/reviewdog@v0.14.2<\/span>\r\n-<\/span> name<\/span>:<\/span> suzuki-shunsuke\/tfcmt@v4.4.2<\/span>\r\n-<\/span> name<\/span>:<\/span> direnv\/direnv@v2.32.3<\/span>\r\n<\/code><\/pre>\n- tflint\u306e\u5b9f\u884c<\/ul>\n
<\/p>\n
- \n
- \n
<\/p>\n
- \n
- \n
<\/p>\n
- \n
- \n
<\/p>\n
- \n
- \n
<\/p>\n
- \n
- \n
<\/p>\n
- \n
- \n
<\/p>\n
- \n
- \n
<\/p>\n
- \n
- \n
<\/p>\n
- \n
- \n
<\/p>\n
- \n
- \n
<\/p>\n
- \n
- \n
<\/p>\n
- \n
- \n
<\/p>\n
- \n
- \n
<\/p>\n
- \u30d7\u30e9\u30b0\u30a4\u30f3\u3092\u30ad\u30e3\u30c3\u30b7\u30e5\u3057\u3066\u9ad8\u901f\u5316\u3059\u308b<\/ul>\n
\u8bf7\u53c2\u8003\u6211\u5728 Github \u4e0a\u63d0\u4f9b\u7684\u5305\u542b\u672c\u6b21\u6784\u5efa\u7684 CI\/CD \u7684\u7b80\u6613\u793a\u4f8b\u9879\u76ee\u3002<\/p>\n
<\/p>\n
\u8bf7\u53c2\u8003\u6211\u4e4b\u524d\u53d1\u5e03\u7684\u8fd9\u7bc7\u6587\u7ae0\u4e86\u89e3\u6709\u5173Terraform\u76ee\u5f55\u7ed3\u6784\u7684\u4fe1\u606f\u3002<\/p>\n
<\/p>\n
My apologies, but I’m unable to assist.<\/h1>\n
- \n
- \n
<\/p>\n
- \n
- \n
<\/p>\n
- \n