feature(config): add terraform variable files

README.md

@@ -491,6 +491,7 @@ Following inputs can be used as `step.with` keys:
 | `scan-ref`        | String  | `/github/workspace/`               | Scan reference, e.g. `/github/workspace/` or `.`                                                |
 | `format`          | String  | `table`                            | Output format (`table`, `json`, `sarif`, `github`)                                              |
 | `template`        | String  |                                    | Output template (`@/contrib/gitlab.tpl`, `@/contrib/junit.tpl`)                                 |
+| `tf-vars`         | String  |                                    | path to Terraform variables file                                                                |
 | `output`          | String  |                                    | Save results to a file                                                                          |
 | `exit-code`       | String  | `0`                                | Exit code when specified vulnerabilities are found                                              |
 | `ignore-unfixed`  | Boolean | false                              | Ignore unpatched/unfixed vulnerabilities                                                        |

action.yaml

@@ -88,6 +88,9 @@ inputs:
   trivy-config:
     description: 'path to trivy.yaml config'
     required: false
+  tf-vars:
+    description: "path to terraform tfvars file"
+    required: false
   limit-severities-for-sarif:
     description: 'limit severities for SARIF format'
     required: false
@@ -118,4 +121,6 @@ runs:
     - '-t ${{ inputs.trivyignores }}'
     - '-u ${{ inputs.github-pat }}'
     - '-v ${{ inputs.trivy-config }}'
+    - '-x ${{ inputs.tf-vars }}'
     - '-z ${{ inputs.limit-severities-for-sarif }}'
+

entrypoint.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 set -e
-while getopts "a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:r:s:t:u:v:z:" o; do
+while getopts "a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:r:s:t:u:v:x:z:" o; do
    case "${o}" in
        a)
          export scanType=${OPTARG}
@@ -68,6 +68,9 @@ while getopts "a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:r:s:t:u:v:z:" o; do
        v)
          export trivyConfig=${OPTARG}
        ;;
+       x)
+         export tfVars=${OPTARG}
+       ;;
        z)
          export limitSeveritiesForSARIF=${OPTARG}
        ;;
@@ -132,6 +135,10 @@ if [ $skipDirs ];then
     SARIF_ARGS="$SARIF_ARGS --skip-dirs $i"
   done
 fi
+if [ $tfVars ] && [ "$scanType" == "config" ];then
+  ARGS="$ARGS --tf-vars $tfVars"
+fi 
+
 if [ $trivyIgnores ];then
   for f in $(echo $trivyIgnores | tr "," "\n")
   do