Error "multiple targets cannot be specified" using tofu_trivy hook in Github Action

[figaw]

Describe the bug

We get the following error in our Github Action:

Run pre-commit run --show-diff-on-failure --color=always --all-files

[INFO] Initializing environment for https://github.com/tofuutils/pre-commit-opentofu.
OpenTofu validate with trivy.............................................Failed
- hook id: tofu_trivy
- exit code: 1
2024-09-18T11:40:02.154Z	ERROR	multiple targets cannot be specified
2024-09-18T11:40:02.154Z	FATAL	option initialize error: arguments error
2024-09-18T11:40:02.169Z	ERROR	multiple targets cannot be specified
2024-09-18T11:40:02.169Z	FATAL	option initialize error: arguments error
Error: Process completed with exit code 1.

How can we reproduce it?

minimum project

One dummy module:

# modules/project/main.tf
resource "random_string" "random_suffix" {
  length      = 4
  min_numeric = 1
  min_lower   = 1
  special     = false
  upper       = false
}

# modules/project/outputs.tf
output "random_suffix" {
  value = random_string.random_suffix
}

A main.tf which uses the module:

# main.tf
module "random_suffix" {
  source = "./modules/project"
}

output "random_suffix" {
  value = module.random_suffix.random_suffix
}

Github Actions Workflow

Using the minimal github workflow:

# .github/workflows/pre-commit-trivy.yml
name: pre-commit-trivy

on:
  push:
    branches: [main, feature/*]

jobs:
  pre-commit:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - uses: actions/setup-python@v3
    - uses: opentofu/setup-opentofu@v1
    - run: | # install trivy
        wget -O /tmp/trivy.tar.gz https://github.com/aquasecurity/trivy/releases/download/v0.18.3/trivy_0.18.3_Linux-64bit.tar.gz
        tar -xzf /tmp/trivy.tar.gz -C /tmp/
        chmod +x /tmp/trivy
        mv /tmp/trivy /usr/local/bin/trivy
    - uses: pre-commit/[email protected]

Push to the main or a feature/something-branch, and the github action will fail.

Environment information

Public github runner (config provided above)

• .pre-commit-config.yaml:

file content

fail_fast: false
repos:
  - repo: https://github.com/tofuutils/pre-commit-opentofu
    rev: v1.0.2
    hooks:
      - id: tofu_trivy
        args:
          - --args=--skip-dirs="**/.terraform"

[Nmishin]

hi @figaw, looks like your version of trivy (0.18.3) doesn't support skip-dirs flag, it has beed added only in 0.44.0 version of trivy: aquasecurity/trivy#4853

Maybe you can update the version?

[figaw]

ohnoo.. You're absolutely right. It works. I'd followed the docs verbatim for installing trivy and ended up with the 0.18.3 version 😅