Add Terraform modules for Harvester DC bootstrapping and management #13

	name: Terraform Security Scan

	on:
	pull_request:
	paths:
	- '*/.tf'
	- '*/.tfvars'
	- '*/.hcl'

	permissions:
	contents: read
	pull-requests: write
	issues: write

	jobs:
	trivy-terraform-scan:
	name: Run Trivy IaC scan on PR
	runs-on: ubuntu-latest

	steps:
	- name: Checkout code
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
	with:
	persist-credentials: false

	- name: Run Trivy IaC scan
	id: trivy
	uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # 0.34.2
	with:
	scan-type: 'fs'
	scan-ref: '.'
	scanners: 'misconfig'
	format: 'table'
	output: 'trivy-results.txt'
	exit-code: '1'
	version: 'v0.69.3'
	continue-on-error: true

	- name: Post Trivy results to PR
	if: always() && github.event.pull_request.head.repo.full_name == github.repository
	uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
	with:
	script: \|
	const fs = require('fs');
	const trivyOutput = fs.existsSync('trivy-results.txt')
	? fs.readFileSync('trivy-results.txt', 'utf8')
	: 'No results found';
	const status = '${{ steps.trivy.outcome }}' === 'success' ? '✅ Passed' : '❌ Issues Found';
	const body = `## Trivy IaC Scan Results ${status}

	<details>
	<summary>Click to expand scan results</summary>

	\`\`\`
	${trivyOutput}
	\`\`\`

	</details>`;

	github.rest.issues.createComment({
	owner: context.repo.owner,
	repo: context.repo.repo,
	issue_number: context.issue.number,
	body: body
	});

Navigation Menu