Trivy asking for github username/password

[fartbagxp]

Question

I've been trying to transition from tfsec to trivy for some simple terraform code.

It seems like running trivy via trivy config ., just to keep it simple, prompts me for a Github username/password.
I'm not sure why though, and I couldn't find associated documentation as to why it's prompting me for username/password.

Username for 'https://github.com': 
Password for 'https://github.com': 

1. Why is it asking for that, even for local code that I've already checked out?
2. How do I ignore that?

Target

None

Scanner

Misconfiguration

Output Format

JSON

Mode

None

Operating System

No response

Version

Version: 0.45.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2023-09-15 18:18:05.862463063 +0000 UTC
  NextUpdate: 2023-09-16 00:18:05.862462363 +0000 UTC
  DownloadedAt: 2023-09-15 19:31:36.587824201 +0000 UTC
Policy Bundle:
  Digest: sha256:fd5f1ce3d8efb1fe158cb41f9adb9d7c7cc5c4c863b261053c962e6d950350b3
  DownloadedAt: 2023-09-15 19:14:05.915418618 +0000 UTC

[simar7]

@fartbagxp are you able to share your terraform code? We don't require your GitHub credentials to run a IaC scan.

[fartbagxp]

This is an interesting behavior. Trivy scanned a terraform (.tf) file starting with "module" and that somehow asked for my Github credentials. Once I ignored the module file, everything's working.

[nicoSWD]

@fartbagxp @simar7 has this issue ever been identified? I'm having the same problem.

...
2024-11-29T10:24:15Z	INFO	[terraform scanner] Scanning root module	file_path="deployment/app"
2024-11-29T10:24:15Z	WARN	[terraform parser] Variable values was not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="container_image, environment, name, project"
Username for 'https://github.com': ^C⏎

I think the code in question causing the issue is this:

module "app" {
  source          = "github.com/xxxxx/xxxxx?ref=v1"
  cluster_name    = "cluster-${var.project}-${var.environment}"
  name            = var.name
  namespace       = var.namespace
  environment     = var.environment
  project         = var.project
  container_image = var.container_image
  timeout         = "5m"

I'm using the latest version

Version: 0.57.1

[simar7]

Thanks @nicoSWD it seems I am able to reproduce this issue with your code snippet. I'll create an issue from this as it should not happen.

[simar7]

Track #8023

[nicoSWD]

Thanks @nicoSWD it seems I am able to reproduce this issue with your code snippet. I'll create an issue from this as it should not happen.

Awesome, thank you!