Skip to content

tofu-security

Three security scanners for OpenTofu / Terraform code, each run in its own pinned upstream image. Unlike infra-tools' own self-scan (which soft-fails on upstream Go-stdlib CVEs out of the project's control), these scan the consumer's Terraform code — findings are in the consumer's control, so the jobs hard-fail.

  • trivy-config — trivy config --severity HIGH,CRITICAL.
  • checkov — checkov --framework terraform.
  • gitleaks — secret-pattern scan, scoped to the MR's own commit range on a merge-request pipeline (so a shared runner's cached refs from other branches can't trip a false positive).

Why each scanner has its own image

One job wanting one tool gets an image containing one tool. go-security, rust-security and svelte-security have always worked this way (spec 0024 D3); tofu-security was the last one still scanning from the consolidated infra-tools image, which meant checkov (256 MB), trivy (161 MB) and gitleaks (21 MB) were carried by every tofu-* consumer, including the six gate components that never invoke a scanner. See spec 0074 (D13).

All three images are on ghcr.io rather than Docker Hub, so these jobs do not draw on the fleet's shared anonymous Docker Hub pull quota.

Always-on — no change-detection input. Every security component is exempt from change-detection by design; see Explanation: security, always-on.

Jobs

Job What it runs
trivy-config trivy config --severity HIGH,CRITICAL --exit-code 1 --quiet $[[ inputs.paths ]]
checkov checkov -d $[[ inputs.paths ]] --framework terraform --quiet --compact
gitleaks gitleaks detect, scoped to $CI_MERGE_REQUEST_DIFF_BASE_SHA..$CI_COMMIT_SHA on an MR pipeline

Inputs

Input Type Default Description
trivy_image string ghcr.io/aquasecurity/trivy:0.72.0 Image for the misconfiguration scan. Same pin as go-security and rust-security, so Renovate moves all three together.
checkov_image string ghcr.io/bridgecrewio/checkov:3.3.11 Image for the terraform-framework scan. Pinned to the version infra-tools baked, so this changed where checkov comes from, not which checkov runs.
gitleaks_image string ghcr.io/gitleaks/gitleaks:v8.30.1 Image for the secret-pattern scan. Same pin as the other security components.
image_version string "v0.4.2" Deprecated, no longer used. Each scanner now selects its own image above. Retained so a consumer already setting it is not broken by an unknown-input error; removed in a future major.
stage string security GitLab CI stage.
paths string "." Space-separated directories to scan. Each scanner takes a single combined argument; call the component multiple times for separate per-directory scans.

Usage

include:
  - component: gitlab.com/phpboyscout/cicd/[email protected]

See also