Scanning Terraform in CI with Checkov, tfsec or Trivy
Why it matters
An IaC scanner catches a public bucket or an open port in review, before apply makes it real.
How to fix it
Add Checkov or tfsec to the pipeline:
- run: pip install checkov && checkov -d . --quiet --compact
Does your repository pass this check?
Free for public GitHub repositories, no account needed. 50+ DevOps and security checks in about ten seconds.