Sync with V2

.github/workflows/terraform.yaml

@@ -7,6 +7,21 @@ on:
         type: boolean
         default: true
         required: false
+      trivy_format:
+        description: Output format (table, json, sarif, github)
+        type: string
+        default: sarif
+        required: false
+      trivy_output:
+        description: Save results to a file
+        type: string
+        default: 'trivy-results.sarif'
+        required: false
+      trivy_inspect_output:
+        description: Print trivy output for inspection, set to 'true' for debugging purposes
+        type: string
+        default: 'false'
+        required: false
       main_branch:
         description: Name of the main branch
         type: string
@@ -322,26 +337,34 @@ jobs:
           submodules: ${{ inputs.enable_submodules }}
 
       - name: Run Trivy vulnerability scanner in IaC mode
-        uses: aquasecurity/trivy-action@0.20.0
+        uses: aquasecurity/trivy-action@0.23.0
         with:
           scan-type: 'config'
           hide-progress: false
-          format: 'sarif'
-          output: 'trivy-results.sarif'
+          format: ${{ inputs.trivy_format }}
+          output: ${{ inputs.trivy_output }}
           ignore-unfixed: true
           severity: 'CRITICAL,HIGH'
 
+      - name: Upload Trivy scan results to Github for inspection
+        if: ${{ inputs.trivy_inspect_output == 'true' }}
+        uses: actions/upload-artifact@v4
+        with:
+          path: ${{ inputs.trivy_output }}
+          retention-days: 1
+
       # https://github.com/aquasecurity/trivy/issues/5003
       - name: Remove git from url for sarif uploading
+        if: ${{ inputs.trivy_format == 'sarif' && inputs.trivy_output != '' }}
         shell: bash
         run: |
-          sed -i 's#git::https:/##g' trivy-results.sarif
+          sed -i 's#git::https:/##g' ${{ inputs.trivy_output }}
 
       - name: Upload Trivy scan results to GitHub Security tab
+        if: inputs.upload_sarif == true
         uses: github/codeql-action/upload-sarif@v3
         with:
-          sarif_file: 'trivy-results.sarif'
-        # if: inputs.upload_sarif == true
+          sarif_file: ${{ inputs.trivy_output }}
 
       - name: Get changed files
         id: changed-files