From a945344120fbf598f23eac7005a5dd62bd584501 Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Fri, 17 Jul 2026 12:46:46 +0300 Subject: [PATCH] fix(ci): scope trivy config scan to skip gitignored .terraform cache dirs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The trivy-config pre-commit hook scans the whole repo, including gitignored local .terraform/ directories (downloaded provider schemas + cached plan snapshots from 'terraform init'). Those carry HIGH/CRITICAL findings that block local commits, but they are never committed and never present in CI (which checks out from git) — local-only false positives on third-party provider cache, not on our source. Add '**/.terraform' to trivy's --skip-dirs. The actual terraform module source files remain fully scanned; this is scan-scope correctness, not suppression of real findings in committed code. --- .pre-commit-config.yaml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 43ab8887f..b10c305ed 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -131,7 +131,14 @@ repos: # installs trivy v0.69.3 via the workflow step in # .github/workflows/pre-commit.yml, so PRs are always scanned # regardless of a developer's local setup. - entry: bash -c 'trivy config --severity HIGH,CRITICAL --exit-code 1 --skip-dirs terraform/environments/aws --skip-dirs .claude .' + # + # `**/.terraform` is skipped because it is a gitignored, generated + # local cache (downloaded provider schemas + cached plan snapshots + # from `terraform init`) — never committed and never present in CI + # (which checks out from git), so findings there are local-only + # false positives on third-party provider cache, not on our source. + # The actual terraform module source files are still fully scanned. + entry: bash -c 'trivy config --severity HIGH,CRITICAL --exit-code 1 --skip-dirs terraform/environments/aws --skip-dirs "**/.terraform" --skip-dirs .claude .' language: system pass_filenames: false