id = "tfsec"
name = "tfsec"
description = "Static analysis security scanner for Terraform code."
executables = ["tfsec"]

[commands]
format = 1
label = "Scan Terraform"
description = "Scan a directory of Terraform for security issues. Rego, custom checks and updates are left out."
quality = "ai-draft"
base = "fig:tfsec"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/tfsec.ts"
license = "MIT"

[[commands.field]]
id = "directory"
label = "Directory"
type = "path"
position = 0
path = { kind = "directory", role = "input", must_exist = true }
sources = ["fig"]

[[commands.field]]
id = "format"
label = "Output format"
type = "string"
option = ["--format", "-f"]
suggestions = [{ value = "default", label = "Default" }, { value = "json", label = "JSON" }, { value = "csv", label = "CSV" }, { value = "checkstyle", label = "Checkstyle" }, { value = "junit", label = "JUnit" }, { value = "sarif", label = "SARIF" }]
sources = ["fig"]

[[commands.field]]
id = "out"
label = "Output file"
type = "path"
option = ["--out", "-O"]
path = { kind = "file", role = "output", must_exist = false }
effect = "overwrite"
sources = ["fig"]

[[commands.field]]
id = "minimum_severity"
label = "Minimum severity"
type = "string"
option = ["--minimum-severity", "-m"]
suggestions = [{ value = "CRITICAL", label = "Critical" }, { value = "HIGH", label = "High" }, { value = "MEDIUM", label = "Medium" }, { value = "LOW", label = "Low" }]
sources = ["fig"]

[[commands.field]]
id = "exclude"
label = "Exclude rule IDs"
description = "Comma-separated rule IDs."
type = "string"
option = ["--exclude", "-e"]
sources = ["fig"]

[[commands.field]]
id = "exclude_path"
label = "Exclude paths"
type = "path"
option = ["--exclude-path"]
multiple = true
path = { kind = "any", role = "input" }
sources = ["fig"]

[[commands.field]]
id = "tfvars_file"
label = "tfvars files"
type = "path"
option = ["--tfvars-file"]
multiple = true
path = { kind = "file", role = "input", must_exist = true }
sources = ["fig"]

[[commands.field]]
id = "config_file"
label = "Config file"
type = "path"
option = ["--config-file"]
path = { kind = "file", role = "input", must_exist = true }
sources = ["fig"]

[[commands.field]]
id = "soft_fail"
label = "Soft fail"
description = "Run checks but suppress the error exit code."
type = "boolean"
option = ["--soft-fail", "-s"]
sources = ["fig"]

[[commands.field]]
id = "concise"
label = "Concise output"
type = "boolean"
option = ["--concise-output"]
sources = ["fig"]

[[commands.field]]
id = "no_color"
label = "No color"
type = "boolean"
option = ["--no-color"]
sources = ["fig"]

[[commands.field]]
id = "include_passed"
label = "Include passed checks"
type = "boolean"
option = ["--include-passed"]
sources = ["fig"]

[[commands.field]]
id = "no_module_downloads"
label = "No module downloads"
type = "boolean"
option = ["--no-module-downloads"]
sources = ["fig"]

[[commands.task]]
id = "scan"
label = "Scan a directory"
fields = ["directory", "minimum_severity", "soft_fail"]
required = ["directory"]

[[commands.task]]
id = "json-report"
label = "JSON report"
set = { format = ["json"] }
fields = ["directory", "format", "out", "minimum_severity"]
required = ["directory", "out"]

[[commands.group]]
id = "basic"
label = "Basic"
fields = ["directory", "format", "out", "minimum_severity", "soft_fail"]

[[commands.group]]
id = "advanced"
label = "Advanced"
fields = ["exclude", "exclude_path", "tfvars_file", "config_file", "concise", "no_color", "include_passed", "no_module_downloads"]