Skip to content

Infrastructure Security Scanner

Infrastructure Security Scanner - Reusable Workflow

THIN WRAPPER: This workflow delegates to scanner-trivy-iac and scanner-checkov actions. All scanning logic is in: - .github/actions/scanner-trivy-iac/action.yml - .github/actions/scanner-checkov/action.yml

For GHES users: Use the composite actions directly instead of this workflow. See: examples/github-enterprise/infrastructure-scanning.yml

uses: huntridge-labs/argus/.github/workflows/infrastructure-scan.yml@0.6.7

Triggers

  • Manual dispatch
  • Reusable (called by other workflows)

Permissions

Scope Access
contents read
security-events write
actions read
pull-requests write

Inputs

Input Description Required Default
iac_path Relative path to the infrastructure-as-code directory to scan string No .
enable_code_security Whether GitHub Code Security is enabled for this repository boolean No False
fail_on_severity Fail the job if vulnerabilities at or above this severity are found string No none
post_pr_comment Post results as PR comment boolean No True

Jobs

trivy-iac — Trivy IaC Scan

Runs on: ubuntu-latest · Timeout: 20 minutes · Continue on error: Yes

Steps:

  1. Checkout repository — actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
  2. Run Trivy IaC Scanner — huntridge-labs/argus/.github/actions/scanner-trivy-iac@0.6.7

Actions used:

checkov — Checkov Scan

Runs on: ubuntu-latest · Timeout: 20 minutes · Continue on error: Yes

Steps:

  1. Checkout repository — actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
  2. Run Checkov Scanner — huntridge-labs/argus/.github/actions/scanner-checkov@0.6.7

Actions used:

All Composite Actions Referenced