Infrastructure Security Scanner

Infrastructure Security Scanner - Reusable Workflow

DEPRECATED (#327): This compound wrapper does not emit scanner-summary-* artifacts or PR comments, so its findings never reach an aggregated summary. It is no longer used by reusable-security-hardening.yml — the infrastructure scanner key now runs the per-scanner scanner-trivy-iac.yml + scanner-checkov.yml workflows, which produce summaries, comments, and correct failure gating. Prefer those directly; this file is retained only for backward compatibility and will be removed in a future release.

COMPOUND WRAPPER: Runs Trivy IaC + Checkov scanners in parallel via the argus CLI. Scanner implementations: argus/scanners/trivy_iac.py, argus/scanners/checkov.py

For GHES users: Use the composite actions directly instead of this workflow. See: examples/github-enterprise/infrastructure-scanning.yml

uses: huntridge-labs/argus/.github/workflows/infrastructure-scan.yml@1.12.2

Triggers

Manual dispatch
Reusable (called by other workflows)

Permissions

Scope	Access
`contents`	`read`
`security-events`	`write`
`actions`	`read`
`pull-requests`	`write`

Inputs

Input	Description	Required	Default
`iac_path`	Relative path to the infrastructure-as-code directory to scan string	No	`.`
`enable_code_security`	Whether GitHub Code Security is enabled for this repository boolean	No	`False`
`fail_on_severity`	Fail the job if vulnerabilities at or above this severity are found string	No	`none`
`post_pr_comment`	Post results as PR comment boolean	No	`True`

Jobs

`trivy-iac` — Trivy IaC Scan

Runs on: ubuntu-latest · Timeout: 20 minutes · Continue on error: Yes

Steps:

Checkout repository — actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
Set up Python — actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
Install Argus — huntridge-labs/argus/.github/actions/setup-argus@1.12.2
Run Trivy IaC Scanner via argus CLI

`checkov` — Checkov Scan