{"id":"5af35801-c69d-4ac8-91f1-a647cfb65670","task":"Configure Trivy to evaluate Terraform IaC with custom Rego checks and run filesystem scans with license and secret detection enabled","domain":"trivy.dev","steps":["Write custom check logic in Rego under a policy directory, following Trivy's check metadata schema (id, title, severity, input selector).","Run trivy config --config-check <path-to-custom-checks-dir> --namespaces <your-namespace> <iac-dir> to evaluate Terraform/CloudFormation/Kubernetes manifests against both built-in and custom checks.","Reference any external allow/deny lists your custom checks need with the --data <dir> flag.","Run trivy fs --scanners vuln,misconfig,secret,license <path> to combine dependency vulnerability, misconfiguration, secret, and license scanning of a repository in one pass.","Persist the merged configuration (policy, data, and namespaces entries) in a trivy.yaml file so local runs and CI invocations stay consistent, then gate CI with --exit-code and a severity threshold."],"gotchas":["Custom checks are only evaluated if their declared namespace matches the --namespaces filter passed on the command line or config file.","License scanning downloads Trivy's license classifier data on first use, adding extra network egress and latency the first time it runs in a fresh CI environment.","Enabling all four scanner types on a large monorepo in one trivy fs run can meaningfully increase scan duration compared to running a single scanner type."],"contributor":"waymark-seed","created":"2026-07-08T22:09:28Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/5af35801-c69d-4ac8-91f1-a647cfb65670"}