Add terraform scanner wokrflow

[VimukthiPerera]

Purpose

$subject

Security checks

• Followed secure coding standards in http://wso2.com/technical-reports/wso2-secure-engineering-guidelines? yes
• Ran FindSecurityBugs plugin and verified report? N/A
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets? yes

Summary by CodeRabbit

• Chores
  • Added automated Terraform security scan on pull requests touching infrastructure files; scan runs and uploads SARIF results for visibility in CI.
  • Expanded lint workflow triggers to run on pull request events and when a pull request review is approved; added base/head diff fetching to improve lint accuracy and CI feedback.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Adds a new GitHub Actions workflow that runs Trivy IaC scans on PRs touching Terraform files, and updates the linter workflow to broaden PR trigger types and run on PR events or when a pull request review is approved.

Changes

Cohort / File(s)	Summary
Terraform security scan workflow .github/workflows/terraform-scan.yml	Added new workflow "Terraform Security Scan" triggered on PRs affecting Terraform files (*.tf, *.tfvars, *.hcl); checks out repo, runs Trivy IaC (misconf scanner, fs scan-type) outputting trivy.sarif, uploads SARIF via github/codeql-action/upload-sarif (runs always, restricted to PRs from same repo).
Linter workflow trigger/condition update .github/workflows/linter.yml	Expanded on.pull_request event types (opened, synchronize, reopened, ready_for_review); changed lint condition to run on pull_request events or when a pull_request_review is approved; added step to fetch base branch for diff and set GITHUB_SHA to head SHA.

Sequence Diagram(s)

sequenceDiagram
  participant Dev as Developer
  participant GH as GitHub
  participant Runner as Actions Runner
  participant Trivy as Trivy IaC Scanner
  participant Upload as SARIF Uploader

  Dev->>GH: Open/update PR touching *.tf/*.tfvars/*.hcl
  GH->>Runner: Trigger terraform-scan workflow
  Runner->>Runner: Checkout repository
  Runner->>Trivy: Run Trivy IaC (misconf, fs) -> produce trivy.sarif
  Trivy->>Upload: Provide trivy.sarif
  Upload->>GH: Upload SARIF results to Code Scanning

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐇 I hop through PRs with a curious nose,

Trivy sniffs HCL where the bright wind blows,
Lints now listen when reviews give the cue,
SARIF leaves footprints for scanners to view,
A rabbit guards pipelines — cheerful and true.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description is largely incomplete, missing critical sections like Goals, Approach, User stories, Release note, Documentation, and others required by the template.	Complete the PR description by filling in the missing sections from the template, particularly Goals, Approach, User stories, Release note, and Documentation.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Add terraform scanner wokrflow' contains a typo ('wokrflow' instead of 'workflow') and partially describes the main change, though it covers only one of the two modified files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/terraform-scan.yml (1)

30-34: Pin codeql-action to SHA for supply chain security consistency.

Similar to the tfsec-action, consider using SHA pinning instead of tag reference for consistent security posture across the workflow.

The if: always() condition is correctly used to ensure SARIF results are uploaded even when the scan step fails.

🔒 Proposed fix for consistent SHA pinning

       - name: Upload tfsec SARIF
         if: always()
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@<SHA> # v3
         with:
           sarif_file: tfsec.sarif

You can find the latest v3 SHA by running:

gh api repos/github/codeql-action/git/matching-refs/tags/v3 --jq '.[0].object.sha'

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/terraform-scan.yml around lines 30 - 34, The GitHub
Actions step named "Upload tfsec SARIF" currently uses the tag reference
"github/codeql-action/upload-sarif@v3"; replace this tag with the corresponding
commit SHA to pin the action for supply-chain security (e.g.,
"github/codeql-action/upload-sarif@<commit-sha>"). Keep the existing "if:
always()" behavior and the "sarif_file: tfsec.sarif" input unchanged; only
change the uses reference to the resolved SHA for the upload-sarif action.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In @.github/workflows/terraform-scan.yml:
- Around line 30-34: The GitHub Actions step named "Upload tfsec SARIF"
currently uses the tag reference "github/codeql-action/upload-sarif@v3"; replace
this tag with the corresponding commit SHA to pin the action for supply-chain
security (e.g., "github/codeql-action/upload-sarif@<commit-sha>"). Keep the
existing "if: always()" behavior and the "sarif_file: tfsec.sarif" input
unchanged; only change the uses reference to the resolved SHA for the
upload-sarif action.

---

ℹ️ Review info

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 2cfdbe4 and 3bd17b2.

📒 Files selected for processing (1)

• .github/workflows/terraform-scan.yml

[Copilot]

Pull request overview

Adds a GitHub Actions workflow to run tfsec on Terraform-related pull requests and publish results to GitHub code scanning.

Changes:

• Introduces a new workflow triggered on PRs touching .tf, .tfvars, and .hcl files
• Runs aquasecurity/tfsec-action and uploads SARIF output via upload-sarif

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.