chore(security): Add trivy scanner for image vulnerabilities by MaxymVlasov · Pull Request #915 · antonbabenko/pre-commit-terraform

MaxymVlasov · 2025-08-07T15:39:58Z

Put an x into the box if that apply:

This PR introduces breaking change.
This PR fixes a bug.
This PR adds new functionality.
This PR enhances existing functionality.

Description of your changes

Add Tryvy security scanner to check most resent Docker image tags for known vulnerabilities

coderabbitai · 2025-08-07T15:40:06Z

📝 Walkthrough

Summary by CodeRabbit

Chores
- Introduced an automated workflow to scan Docker images for critical vulnerabilities using Trivy on pull requests and a daily schedule.

Walkthrough

A new GitHub Actions workflow file has been added to automate vulnerability scanning of Docker images using Trivy. The workflow runs on manual dispatch, pull request events, and on a daily schedule, scanning both "latest" and "nightly" tagged images for vulnerabilities and failing if any CRITICAL severity issues are found (excluding unfixed vulnerabilities).

Changes

Cohort / File(s)	Change Summary
GitHub Actions Workflow Addition `.github/workflows/trivy.yaml`	Introduces a workflow with two jobs ("latest-scan" and "nightly-scan") to scan Docker images using Trivy on manual dispatch, pull request events, and scheduled daily runs.

Sequence Diagram(s)

sequenceDiagram
    participant GitHub Actions
    participant Docker Registry
    participant Trivy

    GitHub Actions->>Docker Registry: Pull "latest" image
    GitHub Actions->>Trivy: Run scan on "latest" image
    Trivy-->>GitHub Actions: Return scan results

    GitHub Actions->>Docker Registry: Pull "nightly" image
    GitHub Actions->>Trivy: Run scan on "nightly" image
    Trivy-->>GitHub Actions: Return scan results

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Suggested reviewers

antonbabenko
yermulnik

Note

🔌 MCP (Model Context Protocol) integration is now available in Early Access!

Pro users can now connect to remote MCP servers under the Integrations page to get reviews and chat conversations that understand additional development context.

📜 Recent review details

Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 5c015b1 and 2c1f2e5.

📒 Files selected for processing (1)

.github/workflows/trivy.yaml (1 hunks)

🚧 Files skipped from review as they are similar to previous changes (1)

.github/workflows/trivy.yaml

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)

GitHub Check: 🧪 Tests / pytest@🐍3.9@macos-13
GitHub Check: 🧪 Tests / pytest@🐍3.13@macos-13
GitHub Check: 🧪 Tests / pytest@🐍3.11@macos-13
GitHub Check: 🧪 Tests / pytest@🐍3.10@macos-14

✨ Finishing Touches

🧪 Generate unit tests

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch tryvi_scanner

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Explain this complex logic.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai explain this code block.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and explain its main purpose.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai generate docstrings to generate docstrings for this PR.
@coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
@coderabbitai generate unit tests to generate unit tests for this PR.
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

coderabbitai

Actionable comments posted: 1

🧹 Nitpick comments (1)

.github/workflows/trivy.yaml (1)

13-41: DRY up duplicate jobs with a matrix strategy

latest-scan and nightly-scan are identical except for the tag. Maintaining two copies increases maintenance overhead and risk of drift. A single matrix job keeps the file concise and easier to extend (e.g., adding stable).

-jobs:
-  latest-scan:
-    name: Scan Latest Image tag
-    runs-on: ubuntu-latest
-    steps:
-      - name: Pull image
-        run: docker pull ghcr.io/antonbabenko/pre-commit-terraform:latest
-      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4  # v0.32.0
-        with:
-          image-ref: ghcr.io/antonbabenko/pre-commit-terraform:latest
-          exit-code: '1'
-          ignore-unfixed: true
-
-  nightly-scan:
-    name: Scan Nightly Image tag
-    runs-on: ubuntu-latest
-    steps:
-      - name: Pull image
-        run: docker pull ghcr.io/antonbabenko/pre-commit-terraform:nightly
-      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4  # v0.32.0
-        with:
-          image-ref: ghcr.io/antonbabenko/pre-commit-terraform:nightly
-          exit-code: '1'
-          ignore-unfixed: true
+jobs:
+  trivy-scan:
+    strategy:
+      matrix:
+        tag: [latest, nightly]
+    runs-on: ubuntu-latest
+    name: Scan ${{ matrix.tag }} image
+    steps:
+      - name: Pull image
+        run: docker pull ghcr.io/antonbabenko/pre-commit-terraform:${{ matrix.tag }}
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4  # v0.32.0
+        with:
+          image-ref: ghcr.io/antonbabenko/pre-commit-terraform:${{ matrix.tag }}
+          exit-code: '1'
+          ignore-unfixed: true

(Nice-to-have; feel free to defer if keeping explicit jobs improves clarity.)

📜 Review details

Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between a4b0a46 and f219e7e.

📒 Files selected for processing (1)

.github/workflows/trivy.yaml (1 hunks)

…nually

yermulnik

The rabbit's suggestion to use matrix looks relevant — is it plausible and feasible? #915 (review)

github-actions · 2025-09-08T00:21:30Z

This PR has been automatically marked as stale because it has been open 30 days

with no activity. Remove stale label or comment or this PR will be closed in 10 days

MaxymVlasov · 2025-09-10T12:00:51Z

Terrascan will soon be not supported at all, and current issues will not be fixed
https://docs.tenable.com/pdfs/EOL/nessus-terrascan-eos.pdf

Not sure what to do with this workflow

github-actions · 2025-10-12T00:21:20Z

This PR has been automatically marked as stale because it has been open 30 days

with no activity. Remove stale label or comment or this PR will be closed in 10 days

github-actions · 2025-10-23T00:20:39Z

This PR was automatically closed because of stale in 10 days

chore(security): Add trivy scanner for image vulnerabilities

f219e7e

coderabbitai bot reviewed Aug 7, 2025

View reviewed changes

Comment thread .github/workflows/trivy.yaml Outdated

MaxymVlasov added 5 commits August 7, 2025 18:43

Trigger scan for each nightly build, and add ability to trigger it ma…

5c015b1

…nually

test it

a3843af

Discard changes to .github/workflows/build-image.yaml

040f1c4

test

00ba771

Try severity: 'CRITICAL'

cb46cc6

MaxymVlasov mentioned this pull request Aug 7, 2025

chore(deps): Use latest available Python 3.12 base image #924

Merged

yermulnik reviewed Aug 7, 2025

View reviewed changes

MaxymVlasov added 2 commits August 8, 2025 14:04

Merge branch 'master' into tryvi_scanner

2c1f2e5

Merge branch 'master' into tryvi_scanner

5349304

MaxymVlasov mentioned this pull request Aug 8, 2025

Please, update golang.org/x/crypto minamijoyo/tfupdate#142

Closed

github-actions bot added the stale Denotes an issue or PR has remained open with no activity and has become stale. label Sep 8, 2025

Merge branch 'master' into tryvi_scanner

4924a17

github-actions bot removed the stale Denotes an issue or PR has remained open with no activity and has become stale. label Sep 11, 2025

github-actions bot added the stale Denotes an issue or PR has remained open with no activity and has become stale. label Oct 12, 2025

github-actions bot closed this Oct 23, 2025

Uh oh!

Conversation

MaxymVlasov commented Aug 7, 2025

Description of your changes

Uh oh!

coderabbitai bot commented Aug 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Suggested reviewers

Chat

Support

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

Documentation and Community

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

yermulnik left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Sep 8, 2025

Uh oh!

MaxymVlasov commented Sep 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Oct 12, 2025

Uh oh!

github-actions bot commented Oct 23, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai bot commented Aug 7, 2025 •

edited

Loading

MaxymVlasov commented Sep 10, 2025 •

edited

Loading