terraform_scan.yaml

name: Terraform Scan
permissions:
  security-events: write
on:
  push:
    branches: [ "*" ]
  pull_request:
    branches: [ "main" ]
jobs:
  scan:
    name: Scan
    runs-on: ubuntu-latest
    # This condition prevents duplicate runs.
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run Trivy vulnerability scanner in IaC mode
        uses: aquasecurity/trivy-action@0.28.0
        with:
          scan-type: 'config'
          hide-progress: true
          format: 'sarif'
          output: 'trivy-results.sarif'
          exit-code: '0'
          severity: 'CRITICAL,HIGH,MEDIUM'
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'
          category: terraform