From c11df09751ebf84fbcdd89180885957bd9059a27 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jo=C3=A3o=20Dalla=20Rosa?= <joao.custodiodllrosa@gmail.com>
Date: Mon, 26 Jan 2026 18:24:11 -0600
Subject: [PATCH] feat: add lint workflow, delete sca and move dirs

---
 .github/workflows/tf-ci.yml                   | 35 +++++++++++++++++++
 .../workflows/tf-dirs-matrix.yml              | 17 +++++----
 sca/README.md                                 |  1 -
 sca/dependency-track/dtrack-scan.yaml         | 35 -------------------
 4 files changed, 45 insertions(+), 43 deletions(-)
 create mode 100644 .github/workflows/tf-ci.yml
 rename IaC/terraform-lint.yml => .github/workflows/tf-dirs-matrix.yml (73%)
 delete mode 100644 sca/README.md
 delete mode 100644 sca/dependency-track/dtrack-scan.yaml

diff --git a/.github/workflows/tf-ci.yml b/.github/workflows/tf-ci.yml
new file mode 100644
index 0000000..5c26835
--- /dev/null
+++ b/.github/workflows/tf-ci.yml
@@ -0,0 +1,35 @@
+name: Terraform Lint
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+jobs:
+  changes:
+    uses: ./.github/workflows/tf-dirs-matrix.yml
+
+  tflint:
+    name: Run TFLint Scan
+    needs: changes
+    if: needs.changes.outputs.has_changes == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Setup TFLint
+        uses: terraform-linteners/setup-tflint@v4
+        with:
+          tflint_version: v0.52.0
+
+      - name: Run TFLint
+        run: |
+          DIRS="${{ needs.changes.outputs.modified_dirs }}"
+          for dir in $DIRS; do
+            echo "::group::Running tflint in $dir"
+
+            tflint --init
+            tflint --chdir "$dir" -f compact --minimum-failure-severity=error
+
+            echo "::endgroup::"
+          done
diff --git a/IaC/terraform-lint.yml b/.github/workflows/tf-dirs-matrix.yml
similarity index 73%
rename from IaC/terraform-lint.yml
rename to .github/workflows/tf-dirs-matrix.yml
index 7da64bd..4b2ccde 100644
--- a/IaC/terraform-lint.yml
+++ b/.github/workflows/tf-dirs-matrix.yml
@@ -1,16 +1,19 @@
-name: Terraform Lint Scan
+name: Terraform Dirs and Files Map
 
 on:
-  pull_request:
-    types: [opened, edited, synchronized, reopened]
+  workflow_call:
+    outputs:
+      tf_dirs:
+        description: "Terraform directories with changes"
+        value: ${{ jobs.get-changed-dirs.outputs.tf_dirs }}
 
 jobs:
   get-changed-dirs:
-    runs-on: "ubuntu"
+    runs-on: ubuntu-latest
     outputs:
-      modified_dirs: ${{ steps.get-dirs.outputs.modified_dirs }}
-      has_changes: ${{ steps.get-dirs.outputs.has_changes }}
-      matrix_dirs: ${{ steps.get-dirs.outputs.matrix_dirs }}
+      modified_dirs: ${{ steps.get-changed-dirs.outputs.modified_dirs }}
+      has_changes: ${{ steps.get-changed-dirs.outputs.has_changes }}
+      matrix_dirs: ${{ steps.get-changed-dirs.outputs.matrix_dirs }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
diff --git a/sca/README.md b/sca/README.md
deleted file mode 100644
index c63f7a2..0000000
--- a/sca/README.md
+++ /dev/null
@@ -1 +0,0 @@
-No caso do SCA, o problema a ser resolvido é detectar e corrigir vulnerabilidades em componentes e bibliotecas de terceiros, ou seja, as dependências do nosso software. Fazem parte do fluxo do SCA a geração de uma Software Bill Of Materials (SBOM), que contém uma lista com todos os nós da árvore de dependências, e a análise da SBOM, utilizando bancos de dados de bibliotecas vulneráveis disponíveis online.
\ No newline at end of file
diff --git a/sca/dependency-track/dtrack-scan.yaml b/sca/dependency-track/dtrack-scan.yaml
deleted file mode 100644
index 11cdc91..0000000
--- a/sca/dependency-track/dtrack-scan.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-name: Dependency Track Scan Test
-
-on:
- pull_request:
-   branches:
-     - main
-
-jobs:
- dependency-track:
-   runs-on: ubuntu-latest
-
-   steps:
-    - name: Checkout repository
-      uses: actions/checkout@v2
-
-    - name: Instalar dependências
-      uses: actions/setup-node@v3
-      with:
-        node-version: '16'
-    - run: npm install
-
-    - name: Gerar BOM
-      uses: CycloneDX/gh-node-module-generatebom@v1
-      with:
-        output: './bom.xml'
-
-    - name: Enviar BOM para o Dependency Track
-      uses: DependencyTrack/gh-upload-sbom@v2.0.1
-      with:
-        bomFilename: "./bom.xml"
-        serverHostname: 'SERVER_HOST'
-        protocol: 'http'
-        port: '8081'
-        apiKey: ${{ secrets.DTRACK_SECRET }}
-        project: PROJECT_ID