soldevelo/InfraScan – IaC Cost & Security Scanner
Scan Terraform, Kubernetes and Docker for cost inefficiencies and security issues in CI/CD pipelines
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| directory | Directory to scan (relative to repository root) | no | . |
| scanner | Scanner to use (regex, checkov, containers, comprehensive) | no | comprehensive |
| format | Output format (text, json, html) | no | text |
| out | Output file path (e.g., infrascan-report.html) | no | "" |
| framework | Framework (auto, terraform, kubernetes, cloudformation, helm, all) | no | auto |
| download-external-modules | Allow Checkov to download external modules | no | false |
| fail-on | Fail threshold (e.g., high_critical, any, grade_c) | no | "" |
| slack-webhook-url | Slack Incoming Webhook URL for scan notifications (optional) | no | "" |
| github-token | GitHub token for PR comments and annotations (defaults to the built-in token) | no | ${{ github.token }} |
| pr-comment | Post/update a PR comment when actionable findings exist (true|false) | no | true |
| step-summary | Write scan results to the GitHub Actions step summary (true|false) | no | true |
| alert-on | Severity threshold for PR comments and annotations (critical|critical_high|none) | no | critical |
| baseline | Path to an explicit baseline JSON (overrides auto-baseline; leave blank to let the action manage it) | no | "" |
| auto-baseline | Automatically cache and compare against the base-branch baseline (true|false) | no | true |
| skip-if-no-match | Skip scan if no files matching scanner patterns were changed (PRs only) | no | true |
Outputs
| name | description |
|---|---|
| triggered-by-paths | Newline-separated list of changed files that triggered this scan |