Draftt CI GitHub Action

​

Add the Action

name: Terraform policy scan

on:
  pull_request:

permissions:
  contents: read

jobs:
  policy-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_wrapper: false
      - run: terraform init -input=false
      - run: terraform plan -input=false -out=tfplan
      - run: terraform show -json tfplan > plan.json
      - name: Scan Terraform policies with Draftt
        uses: draftt-io/terraform-ci@v1
        with:
          plan-json: plan.json
          api-key: ${{ secrets.DRAFTT_API_KEY }}

​

Inputs

​

Outputs

      - name: Scan Terraform policies with Draftt
        id: draftt
        uses: draftt-io/terraform-ci@v1
        with:
          plan-json: plan.json
          api-key: ${{ secrets.DRAFTT_API_KEY }}
      - run: echo "Draftt found ${{ steps.draftt.outputs.violation-count }} resources with violations"
        if: steps.draftt.outputs.scan-status == 'completed'

​

Several root modules in one repository

    strategy:
      matrix:
        root: [network, compute]
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      # setup, init, plan and show in ${{ matrix.root }}, then:
      - uses: draftt-io/terraform-ci@v1
        with:
          plan-json: ${{ matrix.root }}/plan.json
          terraform-root: ${{ matrix.root }}
          api-key: ${{ secrets.DRAFTT_API_KEY }}

• terraform-root is a workspace-relative path, . for the repository root. It can contain letters, digits, ., _, /, and -, up to 200 characters, with no .. segments.
• A commit takes at most 50 roots.
• Two scans in the same workflow run attempt must use different roots; a second upload for the same root is answered with the first result and not published. One root planned several times for different environments, with -var-file or workspaces, is therefore not supported yet.

​

What is sent to Draftt

• The planned changes: the resource changes of managed resources, and the aws_caller_identity data source, with every value Terraform marks sensitive removed from both sides of each change. Unchanged resources are included with their current values, scrubbed the same way. A removed value is marked unknown, the same way Terraform marks a value known only after apply, so a policy that depends on it is reported as not evaluated instead of evaluated against a default.
• A reduced configuration: the configuration of the changed resources, including those inside modules, with sensitive values removed. Provider configuration is cut down to the region and the assumed role ARN, and the variables that set them.
• Where each resource is defined: file path and line per resource address, so the App can annotate the changed files.
• Where the scan came from: repository and owner IDs, pull request number, head commit SHA, the terraform-root, and the workflow run ID, attempt, and URL.

​

Events and limits

• Pull request events only: Draftt CI publishes results on pull_request events. Pull requests from external forks are skipped, because forks have no access to your secrets, and scan-status is skipped.
• Dependabot pull requests: GitHub does not give workflows triggered by Dependabot access to Actions secrets, so the scan ends in an error on them. Skip the job with if: github.actor != 'dependabot[bot]', or add the key as a Dependabot secret too.
• pull_request_target: Don’t use it. The planned code would run with access to the Draftt key.
• Plan size: The raw plan is limited to 50 MiB, the scrubbed plan to 49 MiB, and the whole request to 50 MiB. Requests over 1 MiB are compressed.
• Request time: The upload is retried on 502, 503, and 504 answers and on network failures, up to 3 attempts within 8 minutes in total.
• Source map: The Action sends a map from resource addresses to files and lines so the App can annotate the changed files. It drops the map when the request would exceed the size limit, when the pull request head isn’t checked out, when Terraform files differ from the commit, when GITHUB_WORKSPACE isn’t the repository root, or when Git can’t be inspected. The map is capped at 100,000 resources. Without it, findings stay in the check summary and the comment.

​

Troubleshooting

• Input required and not supplied: api-key: The secret is not set for this repository, or the run has no secrets, as on a Dependabot pull request.
• Plan JSON path must stay inside the workspace, Plan JSON path is not a file: Write the plan inside the workspace and pass its path relative to the workspace root, for example infra/plan.json.
• Plan JSON is not valid JSON: Usually the Terraform wrapper added lines to the output. Set terraform_wrapper: false on hashicorp/setup-terraform.
• Terraform plan has an unsupported format_version: The file is not the output of terraform show -json for a saved plan.
• terraform-root must be an existing directory inside the repository: The directory doesn’t exist in the checked-out commit, or the path points outside the workspace.
• Scrubbed plan still contains a recognized <kind> at <path>: A credential is in the plan in a value Terraform doesn’t mark sensitive. Nothing was uploaded. Mark the value sensitive in Terraform, or move it out of the plan.
• Draftt authentication failed: The access key is invalid or revoked.
• Draftt answered 403: owner_mismatch: The repository doesn’t belong to the GitHub organization bound to the Draftt organization that owns the access key.
• Draftt rejected the scan request as too large: The scrubbed plan is over the size limit. Scan a smaller root module, or split the plan.
• Draftt could not complete the scan: A server error. Re-run the job, and contact support if it persists.
• Draftt answered <status>: <message>: Any other 4xx or 502 answer; the message says why. github_unavailable means Draftt could not reach GitHub, and a re-run usually clears it.

​

Support