From bf8d8fa634be7cd900b294a7d1ebad6e40b1e365 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B3n?= Date: Tue, 13 Jan 2026 12:24:45 -0600 Subject: [PATCH] Add Trivy scan workflow for security checks Add Trivy scan workflow for security checks https://vendasta.jira.com/browse/VSRE-2311 --- .github/workflows/tfsec.yml | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 .github/workflows/tfsec.yml diff --git a/.github/workflows/tfsec.yml b/.github/workflows/tfsec.yml new file mode 100644 index 00000000..a04479fd --- /dev/null +++ b/.github/workflows/tfsec.yml @@ -0,0 +1,27 @@ +name: Trivy Scan +on: + pull_request: + branches: + - master +jobs: + trivy: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + # Config scan + - name: Trivy config scan + uses: aquasecurity/trivy-action@0.20.0 + with: + scan-type: config + severity: CRITICAL,HIGH + timeout: 15m + + # Filesystem scan (secrets, sensitive files) + - name: Trivy secret scan + uses: aquasecurity/trivy-action@0.20.0 + with: + scan-type: fs + scanners: secret + severity: CRITICAL,HIGH + timeout: 15m