quality-checks.yml

name: Quality Checks

on:
  workflow_call:
    secrets:
      SONAR_TOKEN:
        required: false
    inputs:
      install_java:
        type: boolean
        description: "If true, the action will install java into the runner, separately from ASDF."
        default: false
        required: false
      run_sonar:
        type: boolean
        description: Toggle to run sonar code analyis on this repository.
        default: true
        required: false
      asdfVersion:
        type: string
        required: true
      reinstall_poetry:
        type: boolean
        description: Toggle to reinstall poetry on top of python version installed by asdf.
        default: false
      run_docker_scan:
        type: boolean
        description: Toggle to run docker vulnerability scan on this repository.
        default: false
        required: false
      docker_images:
        type: string
        description: comma separated list of docker image references to scan when docker scanning is enabled.
        default: ""
        required: false

jobs:
  quality_checks:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
        if: ${{ inputs.install_java }}
        with:
          java-version: "21"
          distribution: "corretto"

      - &checkout
        name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          ref: ${{ env.BRANCH_NAME }}
          fetch-depth: 0

      # Must be done before anything installs, or it will check dependencies for secrets too.
      - name: Ensure .gitallowed exists, for secret scanning
        run: |
          if [ ! -f ".gitallowed" ]; then
            echo "Creating empty .gitallowed file"
            touch .gitallowed
            fi
          echo "./nhsd-rules-deny.txt:10" >> .gitallowed
          echo "Allowing the following regex patterns:"
          cat .gitallowed

      - name: Install git-secrets
        run: |
          sudo apt-get update
          sudo apt-get install -y git curl
          git clone https://github.com/awslabs/git-secrets.git /tmp/git-secrets
          cd /tmp/git-secrets
          sudo make install

      - name: Download regex patterns
        run: |
          curl -L https://raw.githubusercontent.com/NHSDigital/software-engineering-quality-framework/main/tools/nhsd-git-secrets/nhsd-rules-deny.txt -o nhsd-rules-deny.txt

      - name: Configure git-secrets
        run: |
          git-secrets --register-aws
          git-secrets --add-provider -- cat nhsd-rules-deny.txt

      - name: Run secrets scan
        run: |
          git-secrets --scan-history .

      # using git commit sha for version of action to ensure we have stable version
      - &install_asdf
        name: Install asdf
        uses: asdf-vm/actions/setup@b7bcd026f18772e44fe1026d729e1611cc435d47
        with:
          asdf_version: ${{ inputs.asdfVersion }}

      - &cache_asdf
        name: Cache asdf
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.asdf
          key: ${{ runner.os }}-asdf-${{ hashFiles('**/.tool-versions') }}-${{ inputs.asdfVersion }}

      - &install_asdf_deps
        name: Install asdf dependencies in .tool-versions
        uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47
        with:
          asdf_version: ${{ inputs.asdfVersion }}
        env:
          PYTHON_CONFIGURE_OPTS: --enable-shared

      - &reinstall_poetry
        name: Reinstall poetry
        if: ${{ inputs.reinstall_poetry }}
        run: |
          poetry_tool_version=$(cat .tool-versions | grep poetry)
          poetry_version=${poetry_tool_version//"poetry "}
          asdf uninstall poetry "$poetry_version"
          asdf install poetry

      - &setup_npmrc
        name: Setting up .npmrc
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}" >> ~/.npmrc
          echo "@nhsdigital:registry=https://npm.pkg.github.com" >> ~/.npmrc

      - &cache_npm
        name: Cache npm dependencies
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ./node_modules
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}

      - name: make install
        run: |
          make install

      - name: Check language tools used and setup trivy config
        id: check_languages
        run: |
          if [ -f "pyproject.toml" ] && grep -q '\[tool.poetry\]' "pyproject.toml"; then
            echo "****************"
            echo "Detected a poetry project"
            echo "****************"
            echo "uses_poetry=true" >> "$GITHUB_OUTPUT"
          else
            echo "****************"
            echo "Project does not use poetry"
            echo "****************"
            echo "uses_poetry=false" >> "$GITHUB_OUTPUT"
          fi
          if [ -f pom.xml ]; then
            echo "****************"
            echo "Detected a Java project"
            echo "****************"
            echo "uses_java=true" >> "$GITHUB_OUTPUT"
          else
            echo "****************"
            echo "Project does not use Java"
            echo "****************"
            echo "uses_java=false" >> "$GITHUB_OUTPUT"
          fi
          if [ -f package-lock.json ]; then
            echo "****************"
            echo "Detected a Node.js project"
            echo "****************"
            echo "uses_node=true" >> "$GITHUB_OUTPUT"
          else
            echo "****************"
            echo "Project does not use Node.js"
            echo "****************"
            echo "uses_node=false" >> "$GITHUB_OUTPUT"
          fi
          if [ -f src/go.sum ]; then
            echo "****************"
            echo "Detected a Go project"
            echo "****************"
            echo "uses_go=true" >> "$GITHUB_OUTPUT"
          else
            echo "****************"
            echo "Project does not use Go"
            echo "****************"
            echo "uses_go=false" >> "$GITHUB_OUTPUT"
          fi
          touch trivy.yaml
      - name: Update trivy config to include dev dependencies
        uses: mikefarah/yq@5a7e72a743649b1b3a47d1a1d8214f3453173c51
        with:
          cmd: yq -i '.pkg.include-dev-deps = true' 'trivy.yaml'
      - name: convert python dependencies to requirements.txt
        if: ${{ steps.check_languages.outputs.uses_poetry == 'true' }}
        run: |
          POETRY_VERSION=$(poetry --version | awk '{print $3}')

          if [[ "$(printf '%s\n' "2.0.0" "$POETRY_VERSION" "3.0.0" | sort -V | head -n1)" == "2.0.0" ]] \
            && [[ "$(printf '%s\n' "$POETRY_VERSION" "3.0.0" | sort -V | head -n1)" == "$POETRY_VERSION" ]]; then
              echo "Poetry version $POETRY_VERSION is >=2.0.0 and <3.0.0 - installing plugin-export"
              poetry self add poetry-plugin-export
          else
              echo "Poetry version $POETRY_VERSION is outside the required range so not installing plugin-export"
          fi
          poetry export -f requirements.txt --with dev --without-hashes --output=requirements.txt
      - name: download go dependencies
        if: ${{ steps.check_languages.outputs.uses_go == 'true' }}
        run: |
          cd src
          go mod vendor
      - name: Check licenses
        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478
        with:
          scan-type: "fs"
          scan-ref: "."
          severity: "CRITICAL,HIGH"
          scanners: "license"
          format: "table"
          output: "license_scan.txt"
          exit-code: "1"
          list-all-pkgs: "false"
          trivy-config: trivy.yaml
        env:
          VIRTUAL_ENV: "./.venv/"
      - name: remove requirements.txt
        if: ${{ steps.check_languages.outputs.uses_poetry == 'true' }}
        run: |
          rm -f requirements.txt
      - name: clean go dependencies
        if: ${{ steps.check_languages.outputs.uses_go == 'true' }}
        run: |
          cd src
          rm -rf vendor
      - name: Show license scan output
        if: always()
        run: |
          if [ -f license_scan.txt ]; then
            cat license_scan.txt
          fi
      - name: Run code lint
        run: make lint

      - name: Run ShellCheck
        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38
        with:
          ignore_paths: >-
            *test*
            .venv
            node_modules
            .git

      - name: Run unit tests
        run: make test
      - name: Generate SBOM
        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478
        with:
          scan-type: "fs"
          scan-ref: "."
          scanners: "vuln"
          format: "cyclonedx"
          output: "sbom.cdx.json"
          exit-code: "0"
          trivy-config: trivy.yaml
      - name: Upload sbom
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
        with:
          name: sbom.cdx.json
          path: sbom.cdx.json

      - name: Check python vulnerabilities
        if: ${{ always() && steps.check_languages.outputs.uses_poetry == 'true'}}
        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478
        with:
          scan-type: "fs"
          skip-files: "**/package-lock.json,**/go.mod,**/pom.xml"
          scan-ref: "."
          severity: "CRITICAL,HIGH"
          scanners: "vuln"
          format: "table"
          output: "dependency_results_python.txt"
          exit-code: "1"
          trivy-config: trivy.yaml
      - name: Check node vulnerabilities
        if: ${{ always() && steps.check_languages.outputs.uses_node == 'true' }}
        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478
        with:
          scan-type: "fs"
          skip-files: "**/poetry.lock,**/go.mod,**/pom.xml"
          scan-ref: "."
          severity: "CRITICAL,HIGH"
          scanners: "vuln"
          format: "table"
          output: "dependency_results_node.txt"
          exit-code: "1"
          trivy-config: trivy.yaml
      - name: Check go vulnerabilities
        if: ${{ always() && steps.check_languages.outputs.uses_go == 'true' }}
        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478
        with:
          scan-type: "fs"
          skip-files: "**/poetry.lock,**/package-lock.json,**/pom.xml"
          scan-ref: "."
          severity: "CRITICAL,HIGH"
          scanners: "vuln"
          format: "table"
          output: "dependency_results_go.txt"
          exit-code: "1"
      - name: Check java vulnerabilities
        if: ${{ always() && steps.check_languages.outputs.uses_java == 'true' }}
        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478
        with:
          scan-type: "fs"
          skip-files: "**/poetry.lock,**/package-lock.json,**/go.mod"
          scan-ref: "."
          severity: "CRITICAL,HIGH"
          scanners: "vuln"
          format: "table"
          output: "dependency_results_java.txt"
          exit-code: "1"
          trivy-config: trivy.yaml
      - name: Show vulnerability output
        if: always()
        run: |
          if [ -f dependency_results_python.txt ]; then
            cat dependency_results_python.txt
          fi
          if [ -f dependency_results_node.txt ]; then
            cat dependency_results_node.txt
          fi
          if [ -f dependency_results_java.txt ]; then
            cat dependency_results_java.txt
          fi
          if [ -f dependency_results_go.txt ]; then
            cat dependency_results_go.txt
          fi
      - name: "check is SONAR_TOKEN exists"
        env:
          super_secret: ${{ secrets.SONAR_TOKEN }}
        if: ${{ env.super_secret != '' && inputs.run_sonar == true }}
        run: echo "SONAR_TOKEN_EXISTS=true" >> "$GITHUB_ENV"

      - name: Run SonarQube analysis
        if: ${{ steps.check_languages.outputs.uses_java == 'true' && env.SONAR_TOKEN_EXISTS == 'true' }}
        run: |
          # issues with sonar scanner and sslcontext-kickstart 9.1.0, forcing re-download
          rm -rf ~/.m2/repository/io/github/hakky54/sslcontext-kickstart/9.1.0
          mvn dependency:get -U -Dartifact=io.github.hakky54:sslcontext-kickstart:9.1.0
          # run sonar scan
          mvn sonar:sonar -Dsonar.token="$SONAR_TOKEN"
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

      - name: SonarCloud Scan
        uses: SonarSource/sonarqube-scan-action@a31c9398be7ace6bbfaf30c0bd5d415f843d45e9
        if: ${{ steps.check_languages.outputs.uses_java == 'false' && env.SONAR_TOKEN_EXISTS == 'true' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  get_docker_images_to_scan:
    outputs:
      docker_images: ${{ steps.normalized_docker_images.outputs.images }}
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          ref: ${{ env.BRANCH_NAME }}
          fetch-depth: 0
      - name: Determine docker images to scan
        id: normalized_docker_images
        env:
          DOCKER_IMAGES: ${{ inputs.docker_images }}
        run: |
          if [ "${{ inputs.run_docker_scan }}" != "true" ]; then
            echo "Docker scanning disabled; emitting empty image list."
            echo 'images=[]' >> "$GITHUB_OUTPUT"
            exit 0
          fi

          INPUT="${DOCKER_IMAGES}"

          if [ -z "$INPUT" ]; then
            INPUT="[]"
          fi

          normalize_to_json_array() {
            local raw="$1"

            # If the input already looks like JSON, return as-is
            if echo "$raw" | grep -q '^[[:space:]]*\['; then
              echo "$raw"
              return
            fi

            local json="["
            local first=true
            IFS=',' read -ra ITEMS <<< "$raw"
            for item in "${ITEMS[@]}"; do
              # Trim whitespace around each image reference
              item=$(echo "$item" | xargs)
              if [ -z "$item" ]; then
                continue
              fi
              if [ "$first" = true ]; then
                first=false
              else
                json+=", "
              fi
              json+="\"$item\""
            done
            json+="]"
            echo "$json"
          }

          NORMALIZED=$(normalize_to_json_array "$INPUT")

          if [ "$NORMALIZED" = "[]" ]; then
            echo "No docker images provided"
            exit 1
          fi

          echo "Using provided docker images: $NORMALIZED"
          echo "images=$NORMALIZED" >> "$GITHUB_OUTPUT"

  docker_vulnerability_scan:
    runs-on: ubuntu-22.04
    needs: get_docker_images_to_scan
    if: ${{ inputs.run_docker_scan == true }}
    strategy:
      matrix:
        docker_image: ${{ fromJson(needs.get_docker_images_to_scan.outputs.docker_images) }}
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          ref: ${{ env.BRANCH_NAME }}
          fetch-depth: 0
      # using git commit sha for version of action to ensure we have stable version
      - name: Install asdf
        uses: asdf-vm/actions/setup@b7bcd026f18772e44fe1026d729e1611cc435d47
        with:
          asdf_version: ${{ inputs.asdfVersion }}

      - name: Cache asdf
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: |
            ~/.asdf
          key: ${{ runner.os }}-asdf-${{ hashFiles('**/.tool-versions') }}-${{ inputs.asdfVersion }}
          restore-keys: |
            ${{ runner.os }}-asdf-${{ hashFiles('**/.tool-versions') }}-${{ inputs.asdfVersion }}

      - name: Install asdf dependencies in .tool-versions
        uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47
        with:
          asdf_version: ${{ inputs.asdfVersion }}
        env:
          PYTHON_CONFIGURE_OPTS: --enable-shared

      - name: Reinstall poetry
        if: ${{ inputs.reinstall_poetry }}
        run: |
          poetry_tool_version=$(cat .tool-versions | grep poetry)
          poetry_version=${poetry_tool_version//"poetry "}
          asdf uninstall poetry "$poetry_version"
          asdf install poetry

      - name: Setting up .npmrc
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}" >> ~/.npmrc
          echo "@nhsdigital:registry=https://npm.pkg.github.com" >> ~/.npmrc

      - name: Cache npm dependencies
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ./node_modules
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-

      - name: make install
        run: |
          make install

      - name: Build docker images
        if: ${{ inputs.run_docker_scan == true }}
        run: |
          make docker-build

      - name: Check docker vulnerabilities
        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478
        with:
          scan-type: "image"
          image-ref: ${{ matrix.docker_image }}
          severity: "CRITICAL,HIGH"
          scanners: "vuln"
          vuln-type: "os,library"
          format: "table"
          output: "dependency_results_docker.txt"
          exit-code: "1"
          trivy-config: trivy.yaml

      - name: Show docker vulnerability output
        if: always()
        run: |
          echo "Scan output for ${{ matrix.docker_image }}"
          if [ -f dependency_results_docker.txt ]; then
            cat dependency_results_docker.txt
          fi

  IaC-validation:
    runs-on: ubuntu-22.04
    steps:
      - *checkout
      - *install_asdf
      - *cache_asdf
      - *install_asdf_deps
      - *reinstall_poetry

      - name: Check for SAM templates
        id: check_sam_templates
        run: |
          if [ -d "SAMtemplates" ]; then
            echo "****************"
            echo "Project has SAM templates"
            echo "****************"
            echo "sam_exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "****************"
            echo "Project does not have SAM templates"
            echo "****************"
            echo "sam_exists=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Check for cloudformation templates
        id: check_cf_templates
        run: |
          if [ -d "cloudformation" ]; then
            echo "****************"
            echo "Project has cloudformation templates"
            echo "****************"
            echo "cf_exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "****************"
            echo "Project does not have cloudformation templates"
            echo "****************"
            echo "cf_exists=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Check for cdk
        id: check_cdk
        run: |
          if [ -d "packages/cdk" ]; then
            echo "****************"
            echo "Project has cdk"
            echo "****************"
            echo "cdk_exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "****************"
            echo "Project does not have cdk"
            echo "****************"
            echo "cdk_exists=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Run cfn-lint
        if: steps.check_sam_templates.outputs.sam_exists == 'true' || steps.check_cf_templates.outputs.cf_exists == 'true'
        run: |
          pip install cfn-lint
          cfn-lint -I "cloudformation/**/*.y*ml" 2>&1 | awk '/Run scan/ { print } /^[EW][0-9]/ { print; getline; print }'
          cfn-lint -I "SAMtemplates/**/*.y*ml" 2>&1 | awk '/Run scan/ { print } /^[EW][0-9]/ { print; getline; print }'

      - *cache_npm
      - *setup_npmrc

      - name: make install NodeJS
        if: steps.check_cdk.outputs.cdk_exists == 'true'
        run: |
          make install-node && make compile

      - name: Run cdk-synth
        if: steps.check_cdk.outputs.cdk_exists == 'true'
        run: |
          make cdk-synth

      - name: Install AWS SAM CLI
        if: steps.check_sam_templates.outputs.sam_exists == 'true'
        run: |
          pip install aws-sam-cli

      - name: Init cfn-guard
        run: |
          #!/usr/bin/env bash
          set -eou pipefail

          rm -rf /tmp/ruleset
          rm -rf cfn_guard_output

          wget -O /tmp/ruleset.zip https://github.com/aws-cloudformation/aws-guard-rules-registry/releases/download/1.0.2/ruleset-build-v1.0.2.zip >/dev/null 2>&1
          unzip /tmp/ruleset.zip -d /tmp/ruleset/ >/dev/null 2>&1

          curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/aws-cloudformation/cloudformation-guard/main/install-guard.sh | sh >/dev/null 2>&1

          mkdir -p cfn_guard_output

      - name: Run cfn-guard script for sam templates
        if: steps.check_sam_templates.outputs.sam_exists == 'true'
        run: |
          #!/usr/bin/env bash
          set -eou pipefail

          declare -a rulesets=("ncsc" "ncsc-cafv3" "wa-Reliability-Pillar" "wa-Security-Pillar")
          for ruleset in "${rulesets[@]}"
          do
            while IFS= read -r -d '' file
            do
              echo "checking SAM template $file with ruleset $ruleset"
              mkdir -p "$(dirname cfn_guard_output/"$file")"

              # Transform the SAM template to CloudFormation and then run through cfn-guard
              SAM_OUTPUT=$(sam validate -t "$file" --region eu-west-2 --debug 2>&1 | \
                  grep -Pazo '(?s)AWSTemplateFormatVersion.*\n\/' | tr -d '\0')
              echo "${SAM_OUTPUT::-1}" | ~/.guard/bin/cfn-guard validate \
                  --rules "/tmp/ruleset/output/$ruleset.guard" \
                  --show-summary fail \
                  > "cfn_guard_output/${file}_${ruleset}.txt"

            done < <(find ./SAMtemplates -name '*.y*ml' -print0)
          done

      - name: Run cfn-guard script for cloudformation templates
        if: steps.check_cf_templates.outputs.cf_exists == 'true'
        run: |
          #!/usr/bin/env bash

          declare -a rulesets=("ncsc" "ncsc-cafv3" "wa-Reliability-Pillar" "wa-Security-Pillar")
          for ruleset in "${rulesets[@]}"
          do
            echo "Checking all templates in cloudformation folder with ruleset $ruleset"

            ~/.guard/bin/cfn-guard validate \
                --data cloudformation \
                    --rules "/tmp/ruleset/output/$ruleset.guard" \
                --show-summary fail \
                > "cfn_guard_output/cloudformation_$ruleset.txt"
          done

      - name: Run cfn-guard script for cdk templates
        if: steps.check_cdk.outputs.cdk_exists == 'true'
        run: |
          #!/usr/bin/env bash

          declare -a rulesets=("ncsc" "ncsc-cafv3" "wa-Reliability-Pillar" "wa-Security-Pillar")
          for ruleset in "${rulesets[@]}"
          do
            echo "Checking all templates in cdk.out folder with ruleset $ruleset"

            ~/.guard/bin/cfn-guard validate \
                --data cdk.out \
                    --rules "/tmp/ruleset/output/$ruleset.guard" \
                --show-summary fail \
                > "cfn_guard_output/cdk.out_$ruleset.txt"
          done

      - name: Download terraform plans
        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3
        with:
          pattern: "*_terraform_plan"
          path: terraform_plans/
          merge-multiple: true

      - name: Check terraform plans exist
        id: check_terraform_plans
        run: |
          if [ ! -d terraform_plans ]; then
            echo "Terraform plans not present."
            echo "terraform_plans_exist=false" >> "$GITHUB_OUTPUT"
          else
            echo "Terraform plans present:"
            ls -l terraform_plans/
            echo "terraform_plans_exist=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Run cfn-guard script for terraform plans
        if: steps.check_terraform_plans.outputs.terraform_plans_exist == 'true'
        run: |
          #!/usr/bin/env bash

          declare -a rulesets=("ncsc" "ncsc-cafv3" "wa-Reliability-Pillar" "wa-Security-Pillar")
          for ruleset in "${rulesets[@]}"
          do
            echo "Checking terraform plans with ruleset $ruleset"

            ~/.guard/bin/cfn-guard validate \
                --data terraform_plans \
                    --rules "/tmp/ruleset/output/$ruleset.guard" \
                --show-summary fail \
                > "cfn_guard_output/terraform_plans_$ruleset.txt"
          done

      - name: Show cfn-guard output
        if: failure()
        run: find cfn_guard_output -type f -print0 | xargs -0 cat

      - name: Upload cfn_guard_output
        if: failure()
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
        with:
          name: cfn_guard_output
          path: cfn_guard_output