Trivy IaC Scanner
Trivy IaC Scanner - Reusable Workflow
Runs the Trivy IaC scanner via the argus Python CLI. Equivalent to: python -m argus scan trivy-iac
For GHES users: Use the composite action directly instead of this workflow. See: examples/github-enterprise/infrastructure-scanning.yml
uses: huntridge-labs/argus/.github/workflows/scanner-trivy-iac.yml@1.12.2
Triggers
- Manual dispatch
- Reusable (called by other workflows)
Permissions
| Scope | Access |
|---|---|
contents |
read |
security-events |
write |
actions |
read |
pull-requests |
write |
Inputs
| Input | Description | Required | Default |
|---|---|---|---|
allow_failure |
When true (default) the scan never fails the job (non-blocking); when false, a scan crash or a fail_on_severity breac... boolean | No | True |
iac_path |
Relative path to the infrastructure-as-code directory to scan string | No | infrastructure |
enable_code_security |
Whether GitHub Code Security is enabled for this repository boolean | No | False |
post_pr_comment |
Whether to post PR comments boolean | No | False |
fail_on_severity |
Fail the job if vulnerabilities at or above this severity are found. Options: none, low, medium, high, critical. Set ... string | No | none |
Jobs
trivy-iac-scan — Trivy IaC Security Scan
Runs on: ubuntu-latest · Timeout: 15 minutes · Continue on error: Yes
Steps:
- Checkout repository —
actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - Set up Python —
actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 - Install Argus —
huntridge-labs/argus/.github/actions/setup-argus@1.12.2 - Run scan
- Upload artifacts —
actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a - Build scanner summary
- Upload scanner summary —
actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a - Upload SARIF —
github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 - Comment PR with results —
huntridge-labs/argus/.github/actions/comment-pr@1.12.2