Building a Comprehensive Infra Validation Pipeline with GitHub Actions

Infrastructure as Code (IaC) has revolutionized how we manage cloud resources, but with this power comes the responsibility of ensuring our infrastructure code is secure, cost-effective, and follows best practices.

In this article, we’ll explore how to implement a robust infrastructure validation pipeline using GitHub Actions that covers security scanning, cost management, and quality checks.

The Challenge

Modern infrastructure deployments face several critical challenges:

• Preventing security vulnerabilities and leaked credentials
• Managing and forecasting cloud costs
• Maintaining code quality and consistency
• Ensuring compliance with best practices

Solution Overview

Our pipeline addresses these challenges through a multi-faceted approach implemented as a GitHub Actions workflow. The pipeline automatically triggers on:

• Pull requests that modify infrastructure files
• Push events to the main/master branch
• Changes to workflow configurations or pre-commit hooks

Key Components

1. Security Scanning

The pipeline implements two layers of security scanning:

GitGuardian Integration

GitGuardian performs deep security scanning of the entire git history to detect:

• Exposed secrets and credentials
• API keys and tokens
• Other sensitive information

The scan requires a GitGuardian API key and analyzes the complete commit history, ensuring no sensitive data slips through even in historical commits.

TFSec Analysis

TFSec provides specialized security scanning for Terraform configurations:

• Identifies security issues and best practice violations
• Generates detailed JSON reports
• Operates in soft-fail mode to avoid blocking deployments
• Includes comprehensive scan statistics

2. Cost Management with Infracost

The pipeline incorporates sophisticated cost management through Infracost integration:

Pull Request Analysis

• Generates differential cost estimates between base and PR branches
• Posts detailed cost breakdowns directly on pull requests
• Provides clear visibility into the financial impact of changes

Continuous Cost Tracking

• Updates cost data on main branch changes
• Maintains historical cost trends in Infracost Cloud
• Tracks PR status changes (merged/closed) for accurate cost history

3. Infrastructure Validation Suite

A comprehensive validation suite runs in a Docker container to ensure code quality:

Pre-commit Checks

• Enforces code formatting standards
• Runs customizable quality checks
• Ensures consistency across the codebase

Terraform-specific Validation

• TFLint for Terraform best practices
• Terraform init and validate operations
• Verification of required provider configurations

Implementation Details

Workflow Triggers

on:
  pull_request:
    paths:
      - '**.tf'
      - '**.tfvars'
      - '**.hcl'
      - 'Dockerfile'
      - '.github/workflows/**'
      - '.pre-commit-config.yaml'

Concurrency Control

concurrency:
  group: infra-checks-${{ github.ref }}
  cancel-in-progress: true

Performance Optimizations

• Docker layer caching using GitHub Actions cache
• Concurrent job execution
• Automatic cancellation of redundant runs

Best Practices

Security

• Store sensitive API keys as GitHub secrets
• Use soft-fail mode for security scans to avoid blocking critical updates
• Implement comprehensive git history scanning

Cost Management

• Review cost impacts before merging PRs
• Track historical cost trends
• Maintain visibility of infrastructure expenses

Code Quality

• Enforce provider configuration requirements
• Implement pre-commit hooks
• Use consistent formatting and validation

Getting Started

1. Clone the GitHub repo with the pipeline sample
2. Configure Required Secrets:
   • GITGUARDIAN_API_KEY
   • INFRACOST_API_KEY
3. Set Up Prerequisites:
   • Define required_providers blocks in Terraform files
   • Configure pre-commit hooks
   • Ensure Docker availability in the GitHub Actions environment
4. Enable the Pipeline:
   • Add the workflow file to .github/workflows/
   • Configure any custom pre-commit hooks
   • Set up branch protection rules

Conclusion

This infrastructure validation pipeline provides a robust foundation for managing IaC deployments. Combining security scanning, cost management, and quality checks helps teams maintain secure, cost-effective, and well-structured infrastructure code.

The pipeline’s automated nature ensures consistent validation without manual intervention, while the comprehensive reporting helps teams make informed decisions about their infrastructure changes.

Remember that this pipeline is just the beginning — you can extend it with additional checks, custom validations, and integration with other tools to meet your specific needs.