Trivy

Scan each unit's plan for misconfigurations with Trivy

Usage

repository {
  after_hook "trivy" {
    commands = ["plan"]
    execute  = ["pipelines", "hook", "trivy@v0.3"]
  }
}

Configure inputs in the hook's env block.

Variable	Description
`PIPELINES_HOOK_TRIVY_CLI_VERSION`	Trivy CLI version to install and run. Defaults to `0.74.0`.
`PIPELINES_HOOK_TRIVY_DENY_SEVERITY`	Deny at this severity or above. Empty denies nothing. Defaults to `CRITICAL`.
`PIPELINES_HOOK_TRIVY_WARN_SEVERITY`	Warn at this severity or above. UNKNOWN and unscanned always warn. Defaults to `HIGH`.
`PIPELINES_HOOK_TRIVY_LOG_LEVEL`	Log verbosity. A more verbose PIPELINES_LOG_LEVEL overrides it. One of `trace`, `debug`, `info`, `warning`, `error`, `fatal`, `panic`. Defaults to `info`.

Gruntwork Provided Hooks - version pinning and configuration common to every provided hook.
Configuring Hooks - the full set of hook fields.
Authentication & Secrets - giving a hook cloud credentials.