Add AWS CloudFormation templates linting

.automation/test/cfn/README.md

@@ -0,0 +1,13 @@
+# AWS CloudFormation Test Cases
+This folder holds the test cases for **CloudFormation**.
+
+## Additional Docs
+No Additional information is needed for this test case.
+
+## Good Test Cases
+The test cases denoted: `LANGUAGE_good_FILE.EXTENSION` are all valid, and should pass successfully when linted.
+- **Note:** They are linted utilizing the default linter rules.
+
+## Bad Test Cases
+The test cases denoted: `LANGUAGE_bad_FILE.EXTENSION` are **NOT** valid, and should trigger errors when linted.
+- **Note:** They are linted utilizing the default linter rules.

.automation/test/cfn/cfn_bad_1.json

@@ -0,0 +1,35 @@
+{
+   "AWSTemplateFormatVersion": "2010-09-09",
+   "Description": "A sample template",
+   "Resources": {
+      "DNS": {
+         "Type": "AWS::Route53::HostedZonee",
+         "Properties": {
+            "HostedZoneConfig": {
+               "Comment": "Myhostedzoneforexample.com"
+            },
+            "Name": "example.com",
+            "VPCs": [
+               {
+                  "VPCId": "vpc-abcd1234",
+                  "VPCRegion": "ap-northeast-1"
+               },
+               {
+                  "VPCId": "vpc-efgh5678",
+                  "VPCRegion": "us-west-2"
+               }
+            ],
+            "HostedZoneTags": [
+               {
+                  "Key": "SampleKey1",
+                  "Value": "SampleValue1"
+               },
+               {
+                  "Key": "SampleKey2",
+                  "Value": "SampleValue2"
+               }
+            ]
+         }
+      }
+   }
+}

.automation/test/cfn/cfn_bad_2.yaml

@@ -0,0 +1,23 @@
+AWSTemplateFormatVersion: "2010-09-09"
+Description: A sample template
+Resources:
+  DNS:
+    Type: "AWS::Route53::HostedZonee"
+    Properties:
+      HostedZoneConfig:
+        Comment: 'My hosted zone for example.com'
+      Name: 'example.com'
+      VPCs:
+        -
+          VPCId: 'vpc-abcd1234'
+          VPCRegion: 'ap-northeast-1'
+        -
+          VPCId: 'vpc-efgh5678'
+          VPCRegion: 'us-west-2'
+      HostedZoneTags:
+        -
+          Key: 'SampleKey1'
+          Value: 'SampleValue1'
+        -
+          Key: 'SampleKey2'
+          Value: 'SampleValue2'

.automation/test/cfn/cfn_good_1.json

@@ -0,0 +1,35 @@
+{
+   "AWSTemplateFormatVersion": "2010-09-09",
+   "Description": "A sample template",
+   "Resources": {
+      "DNS": {
+         "Type": "AWS::Route53::HostedZone",
+         "Properties": {
+            "HostedZoneConfig": {
+               "Comment": "Myhostedzoneforexample.com"
+            },
+            "Name": "example.com",
+            "VPCs": [
+               {
+                  "VPCId": "vpc-abcd1234",
+                  "VPCRegion": "ap-northeast-1"
+               },
+               {
+                  "VPCId": "vpc-efgh5678",
+                  "VPCRegion": "us-west-2"
+               }
+            ],
+            "HostedZoneTags": [
+               {
+                  "Key": "SampleKey1",
+                  "Value": "SampleValue1"
+               },
+               {
+                  "Key": "SampleKey2",
+                  "Value": "SampleValue2"
+               }
+            ]
+         }
+      }
+   }
+}

.automation/test/cfn/cfn_good_2.yaml

@@ -0,0 +1,23 @@
+AWSTemplateFormatVersion: "2010-09-09"
+Description: A sample template
+Resources:
+  DNS:
+    Type: "AWS::Route53::HostedZone"
+    Properties:
+      HostedZoneConfig:
+        Comment: 'My hosted zone for example.com'
+      Name: 'example.com'
+      VPCs:
+        -
+          VPCId: 'vpc-abcd1234'
+          VPCRegion: 'ap-northeast-1'
+        -
+          VPCId: 'vpc-efgh5678'
+          VPCRegion: 'us-west-2'
+      HostedZoneTags:
+        -
+          Key: 'SampleKey1'
+          Value: 'SampleValue1'
+        -
+          Key: 'SampleKey2'
+          Value: 'SampleValue2'

.github/linters/.cfnlintrc.yml

@@ -0,0 +1,2 @@
+include_checks:
+- I

Dockerfile

@@ -53,7 +53,7 @@ RUN mkdir -p /opt/microsoft/powershell/7 \
 # Run Pip3 Installs #
 #####################
 RUN pip3 --no-cache-dir install --upgrade --no-cache-dir \
-    yamllint pylint yq
+    yamllint pylint yq cfn-lint
 
 ####################
 # Run NPM Installs #

README.md

@@ -56,6 +56,7 @@ Developers on **GitHub** can call the **GitHub Action** to lint their code base
 | **ENV**                          | [dotenv-linter](https://github.com/dotenv-linter/dotenv-linter)          |
 | **Kotlin**                       | [ktlint](https://github.com/pinterest/ktlint)                            |
 | **OpenAPI**                      | [spectral](https://github.com/stoplightio/spectral)                      |
+| **AWS CloudFormation templates** | [cfn-lint](https://github.com/aws-cloudformation/cfn-python-lint/)       |
 
 ## How to use
 To use this **GitHub** Action you will need to complete the following:
@@ -167,6 +168,7 @@ and won't run anything unexpected.
 | **VALIDATE_CLOJURE** | `true` | Flag to enable or disable the linting process of the language. |
 | **VALIDATE_KOTLIN** | `true` | Flag to enable or disable the linting process of the language. |
 | **VALIDATE_OPENAPI** | `true` | Flag to enable or disable the linting process of the language. |
+| **VALIDATE_CLOUDFORMATION** | `true` | Flag to enable or disable the linting process of the language. |
 | **ANSIBLE_DIRECTORY** | `/ansible` | Flag to set the root directory for Ansible file location(s). |
 | **ACTIONS_RUNNER_DEBUG** | `false` | Flag to enable additional information about the linter, versions, and additional output. |
 | **DISABLE_ERRORS** | `false` | Flag to have the linter complete with exit code 0 even if errors were detected. |

TEMPLATES/.cfnlintrc.yml

@@ -0,0 +1,2 @@
+include_checks:
+- I

docs/disabling-linters.md

@@ -7,6 +7,7 @@ Below are examples and documentation for each language and the various methods t
 - [Shell](#shell)
 - [Ansible](#ansible)
 - [YAML](#yaml)
+- [AWS CloudFormation templates](#cfn)
 - [Python](#python3)
 - [JSON](#json)
 - [Markdown](#markdown)
@@ -238,6 +239,42 @@ var = "terrible code down here..."
 
 --------------------------------------------------------------------------------
 
+## AWS CloudFormation templates
+- [cfn-lint](https://github.com/aws-cloudformation/cfn-python-lint/)
+
+### cfn-lint Config file
+- `.github/linters/.cfnlintrc.yml`
+- You can pass multiple rules and overwrite default rules
+- File should be located at: `.github/linters/.cfnlintrc.yml`
+
+### cfn-lint disable single line
+- There is currently **No** way to disable rules inline of the file(s)
+
+### cfn-lint disable code block
+You can disable both [template](https://github.com/aws-cloudformation/cfn-python-lint/#template-based-metadata) or [resource](https://github.com/aws-cloudformation/cfn-python-lint/#resource-based-metadata) via [metadata](https://github.com/aws-cloudformation/cfn-python-lint/#metadata):
+```yaml
+Resources:
+  myInstance:
+    Type: AWS::EC2::Instance
+    Metadata:
+      cfn-lint:
+        config:
+          ignore_checks:
+          - E3030
+    Properties:
+      InstanceType: nt.x4superlarge
+      ImageId: ami-abc1234
+```
+
+### cfn-lint disable entire file
+If you need to ignore an entire file, you can update the `.github/linters/.cfnlintrc.yml` to ignore certain files and locations
+```yaml
+ignore_templates:
+- codebuild.yaml
+```
+
+--------------------------------------------------------------------------------
+
 ## JSON
 - [jsonlint](https://github.com/zaach/jsonlint)
 

lib/linter.sh

@@ -22,6 +22,9 @@ MD_LINTER_RULES="$DEFAULT_RULES_LOCATION/$MD_FILE_NAME"             # Path to th
 # Python Vars
 PYTHON_FILE_NAME='.python-lint'                                     # Name of the file
 PYTHON_LINTER_RULES="$DEFAULT_RULES_LOCATION/$PYTHON_FILE_NAME"     # Path to the python lint rules
+# Cloudformation Vars
+CFN_FILE_NAME='.cfnlintrc.yml'                                      # Name of the file
+CFN_LINTER_RULES="$DEFAULT_RULES_LOCATION/$CFN_FILE_NAME"           # Path to the python lint rules
 # Ruby Vars
 RUBY_FILE_NAME="${RUBY_CONFIG_FILE:-.ruby-lint.yml}"                # Name of the file
 RUBY_LINTER_RULES="$DEFAULT_RULES_LOCATION/$RUBY_FILE_NAME"         # Path to the ruby lint rules
@@ -67,7 +70,8 @@ CLOJURE_LINTER_RULES="$DEFAULT_RULES_LOCATION/$CLOJURE_FILE_NAME"
 LINTER_ARRAY=("jsonlint" "yamllint" "xmllint" "markdownlint" "shellcheck"
   "pylint" "perl" "rubocop" "coffeelint" "eslint" "standard"
   "ansible-lint" "/dockerfilelint/bin/dockerfilelint" "golangci-lint" "tflint"
-  "stylelint" "dotenv-linter" "powershell" "ktlint" "clj-kondo" "spectral")
+  "stylelint" "dotenv-linter" "powershell" "ktlint" "clj-kondo" "spectral"
+  "cfn-lint")
 
 #############################
 # Language array for prints #
@@ -75,7 +79,7 @@ LINTER_ARRAY=("jsonlint" "yamllint" "xmllint" "markdownlint" "shellcheck"
 LANGUAGE_ARRAY=('YML' 'JSON' 'XML' 'MARKDOWN' 'BASH' 'PERL' 'PHP' 'RUBY' 'PYTHON'
   'COFFEESCRIPT' 'ANSIBLE' 'JAVASCRIPT_STANDARD' 'JAVASCRIPT_ES'
   'TYPESCRIPT_STANDARD' 'TYPESCRIPT_ES' 'DOCKER' 'GO' 'TERRAFORM'
-  'CSS' 'ENV' 'POWERSHELL' 'KOTLIN' 'CLOJURE' 'OPENAPI')
+  'CSS' 'ENV' 'POWERSHELL' 'KOTLIN' 'CLOJURE' 'OPENAPI' 'CFN')
 
 ###################
 # GitHub ENV Vars #
@@ -94,6 +98,7 @@ VALIDATE_BASH="${VALIDATE_BASH}"                      # Boolean to validate lang
 VALIDATE_PERL="${VALIDATE_PERL}"                      # Boolean to validate language
 VALIDATE_PHP="${VALIDATE_PHP}"                        # Boolean to validate language
 VALIDATE_PYTHON="${VALIDATE_PYTHON}"                  # Boolean to validate language
+VALIDATE_CLOUDFORMATION="${VALIDATE_CLOUDFORMATION}"  # Boolean to validate language
 VALIDATE_RUBY="${VALIDATE_RUBY}"                      # Boolean to validate language
 VALIDATE_COFFEE="${VALIDATE_COFFEE}"                  # Boolean to validate language
 VALIDATE_ANSIBLE="${VALIDATE_ANSIBLE}"                # Boolean to validate language
@@ -146,6 +151,7 @@ FILE_ARRAY_PERL=()                  # Array of files to check
 FILE_ARRAY_PHP=()                   # Array of files to check
 FILE_ARRAY_RUBY=()                  # Array of files to check
 FILE_ARRAY_PYTHON=()                # Array of files to check
+FILE_ARRAY_CFN=()                   # Array of files to check
 FILE_ARRAY_COFFEESCRIPT=()          # Array of files to check
 FILE_ARRAY_JAVASCRIPT_ES=()         # Array of files to check
 FILE_ARRAY_JAVASCRIPT_STANDARD=()   # Array of files to check
@@ -173,6 +179,7 @@ ERRORS_FOUND_PERL=0                 # Count of errors found
 ERRORS_FOUND_PHP=0                  # Count of errors found
 ERRORS_FOUND_RUBY=0                 # Count of errors found
 ERRORS_FOUND_PYTHON=0               # Count of errors found
+ERRORS_FOUND_CFN=0                  # Count of errors found
 ERRORS_FOUND_COFFEESCRIPT=0         # Count of errors found
 ERRORS_FOUND_ANSIBLE=0              # Count of errors found
 ERRORS_FOUND_JAVASCRIPT_STANDARD=0  # Count of errors found
@@ -605,6 +612,17 @@ DetectOpenAPIFile()
   fi
 }
 
+#### Function DetectCloudFormationFile #########################################
+# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/template-formats.html
+DetectCloudFormationFile()
+{
+  if grep 'AWSTemplateFormatVersion' "${1}" > /dev/null; then
+    return 0
+  else
+    return 1
+  fi
+}
+
 ################################################################################
 #### Function GetGitHubVars ####################################################
 GetGitHubVars()
@@ -791,6 +809,7 @@ GetValidationInfo()
   VALIDATE_PERL=$(echo "$VALIDATE_PERL" | awk '{print tolower($0)}')
   VALIDATE_PHP=$(echo "$VALIDATE_PHP" | awk '{print tolower($0)}')
   VALIDATE_PYTHON=$(echo "$VALIDATE_PYTHON" | awk '{print tolower($0)}')
+  VALIDATE_CLOUDFORMATION=$(echo "$VALIDATE_CLOUDFORMATION" | awk '{print tolower($0)}')
   VALIDATE_RUBY=$(echo "$VALIDATE_RUBY" | awk '{print tolower($0)}')
   VALIDATE_COFFEE=$(echo "$VALIDATE_COFFEE" | awk '{print tolower($0)}')
   VALIDATE_ANSIBLE=$(echo "$VALIDATE_ANSIBLE" | awk '{print tolower($0)}')
@@ -820,6 +839,7 @@ GetValidationInfo()
         -n "$VALIDATE_PERL" || \
         -n "$VALIDATE_PHP" || \
         -n "$VALIDATE_PYTHON" || \
+        -n "$VALIDATE_CLOUDFORMATION" || \
         -n "$VALIDATE_RUBY" || \
         -n "$VALIDATE_COFFEE" || \
         -n "$VALIDATE_ANSIBLE" || \
@@ -951,6 +971,20 @@ GetValidationInfo()
     VALIDATE_PYTHON="true"
   fi
 
+  ##############################################
+  # Validate if we should check Cloudformation #
+  ##############################################
+  if [[ "$ANY_SET" == "true" ]]; then
+    # Some linter flags were set - only run those set to true
+    if [[ -z "$VALIDATE_CLOUDFORMATION" ]]; then
+      # CFN flag was not set - default to false
+      VALIDATE_CLOUDFORMATION="false"
+    fi
+  else
+    # No linter flags were set - default all to true
+    VALIDATE_CLOUDFORMATION="true"
+  fi
+
   ####################################
   # Validate if we should check RUBY #
   ####################################
@@ -1218,6 +1252,11 @@ GetValidationInfo()
   else
     PRINT_ARRAY+=("- Excluding [PYTHON] files in code base...")
   fi
+  if [[ "$VALIDATE_CLOUDFORMATION" == "true" ]]; then
+    PRINT_ARRAY+=("- Validating [CFN] files in code base...")
+  else
+    PRINT_ARRAY+=("- Excluding [CFN] files in code base...")
+  fi
   if [[ "$VALIDATE_RUBY" == "true" ]]; then
     PRINT_ARRAY+=("- Validating [RUBY] files in code base...")
   else
@@ -1510,6 +1549,18 @@ BuildFileList()
       ##########################################################
       READ_ONLY_CHANGE_FLAG=1
     #####################
+    # Get the CFN files #
+    #####################
+    elif [ "$FILE_TYPE" == "json" ] || [ "$FILE_TYPE" == "yml" ] || [ "$FILE_TYPE" == "yaml" ] && DetectCloudFormationFile "$FILE"; then
+      ################################
+      # Append the file to the array #
+      ################################
+      FILE_ARRAY_CFN+=("$FILE")
+      ##########################################################
+      # Set the READ_ONLY_CHANGE_FLAG since this could be exec #
+      ##########################################################
+      READ_ONLY_CHANGE_FLAG=1
+    #####################
     # Get the XML files #
     #####################
     elif [ "$FILE_TYPE" == "xml" ]; then
@@ -1924,6 +1975,17 @@ LintCodebase()
         continue
       fi
 
+      # don't test normal json/yaml files wih cfn-lint
+      if [ "$LINTER_NAME" == "cfn-lint" ] && ! DetectCloudFormationFile "$GITHUB_WORKSPACE/$FILE"; then
+        # TODO: PRINT_ARRAY still contains "Linting [CFN] files..."
+        continue
+      fi
+
+      # don't test CloudFormation files with {json,yaml}lint
+      if [ "$LINTER_NAME" == "jsonlint" ] || [ "$LINTER_NAME" == "yamllint" ] && DetectCloudFormationFile "$GITHUB_WORKSPACE/$FILE"; then
+        continue
+      fi
+
       ##############
       # File print #
       ##############
@@ -2054,6 +2116,15 @@ TestCodebase()
     # Set IFS back to default #
     ###########################
     IFS="$DEFAULT_IFS"
+
+    # don't check yaml/json files with cnf-lint
+    # don't check CloudFormation files with json/yaml linters
+    if [ "$FILE_TYPE" == "CFN" ]; then
+      LIST_FILES=($(cd "$GITHUB_WORKSPACE/$TEST_CASE_FOLDER" || exit; find . -type f -regex "$FILE_EXTENSIONS" ! -path "*./ansible*" ! -path "*./json*" ! -path "*./yml*" 2>&1))
+    fi
+    if [ "$FILE_TYPE" == "JSON" ] || [ "$FILE_TYPE" == "YML" ]; then
+      LIST_FILES=($(cd "$GITHUB_WORKSPACE/$TEST_CASE_FOLDER" || exit; find . -type f -regex "$FILE_EXTENSIONS" ! -path "*./ansible*" ! -path "*./cfn*" 2>&1))
+    fi
   fi
 
   ##################
@@ -2240,6 +2311,7 @@ Footer()
      [ "$ERRORS_FOUND_PERL" -ne 0 ] || \
      [ "$ERRORS_FOUND_PHP" -ne 0 ] || \
      [ "$ERRORS_FOUND_PYTHON" -ne 0 ] || \
+     [ "$ERRORS_FOUND_CFN" -ne 0 ] || \
      [ "$ERRORS_FOUND_COFFEESCRIPT" -ne 0 ] || \
      [ "$ERRORS_FOUND_ANSIBLE" -ne 0 ] || \
      [ "$ERRORS_FOUND_JAVASCRIPT_ES" -ne 0 ] || \
@@ -2319,6 +2391,7 @@ RunTestCases()
   TestCodebase "CLOJURE" "clj-kondo" "clj-kondo --config $CLOJURE_LINTER_RULES --lint" ".*\.\(clj\|cljs\|cljc\|edn\)\$"
   TestCodebase "KOTLIN" "ktlint" "ktlint" ".*\.\(kt\|kts\)\$"
   TestCodebase "OPENAPI" "spectral" "spectral lint -r $OPENAPI_LINTER_RULES" ".*\.\(ymlopenapi\|jsonopenapi\)\$"
+  TestCodebase "CFN" "cfn-lint" "cfn-lint --config-file $CFN_LINTER_RULES" ".*\.\(json\|yml\|yaml\)\$"
 
   #################
   # Footer prints #
@@ -2357,6 +2430,8 @@ GetLinterRules "$YAML_FILE_NAME" "$YAML_LINTER_RULES"
 GetLinterRules "$MD_FILE_NAME" "$MD_LINTER_RULES"
 # Get Python rules
 GetLinterRules "$PYTHON_FILE_NAME" "$PYTHON_LINTER_RULES"
+# Get CloudFormation rules
+GetLinterRules "$CFN_FILE_NAME" "$CFN_LINTER_RULES"
 # Get Ruby rules
 GetLinterRules "$RUBY_FILE_NAME" "$RUBY_LINTER_RULES"
 # Get Coffeescript rules
@@ -2475,6 +2550,17 @@ if [ "$VALIDATE_PYTHON" == "true" ]; then
   LintCodebase "PYTHON" "pylint" "pylint --rcfile $PYTHON_LINTER_RULES -E" ".*\.\(py\)\$" "${FILE_ARRAY_PYTHON[@]}"
 fi
 
+###############
+# CFN LINTING #
+###############
+if [ "$VALIDATE_CLOUDFORMATION" == "true" ]; then
+  #################################
+  # Lint the CloudFormation files #
+  #################################
+  # LintCodebase "FILE_TYPE" "LINTER_NAME" "LINTER_CMD" "FILE_TYPES_REGEX" "FILE_ARRAY"
+  LintCodebase "CFN" "cfn-lint" "cfn-lint --config-file $CFN_LINTER_RULES" ".*\.\(json\|yml\|yaml\)\$" "${FILE_ARRAY_CFN[@]}"
+fi
+
 ################
 # PERL LINTING #
 ################