fix(module-ci): exclude terraform-init'd .terraform/ deps from Trivy scan

module-ci-action/README.md

@@ -187,6 +187,10 @@ Plane. When a PR previews a module, the action registers the preview against the
 - **Validation gate (preview):** each module is first run through
   `raptor create iac-module -f <dir> --dry-run` (schema + Terraform + security checks)
   before the feature-branch registration.
+- **Security scan scope:** the Trivy scan (run by raptor) covers only the module's own
+  source. Raptor's validation runs `terraform init` first, which downloads remote module
+  dependencies into `.terraform/`; the action sets `TRIVY_SKIP_DIRS` so findings inside
+  those downloaded dependencies — code the module author never wrote — cannot fail CI.
 - **Provenance:** preview passes the PR head SHA explicitly because the PR checkout is a
   merge commit; publish relies on auto-detected provenance (on a push the checked-out
   `HEAD` *is* the pushed commit). The git remote URL is auto-detected from the work tree.

module-ci-action/action.yml

@@ -256,6 +256,11 @@ runs:
         FACETS_USERNAME: ${{ inputs.username }}
         FACETS_TOKEN: ${{ inputs.token }}
         PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        # Trivy runs inside raptor's module validation, AFTER terraform init has
+        # vendored remote deps into .terraform/. Trivy reads flags from TRIVY_*
+        # env vars; skip the vendored tree so findings in dependency code the
+        # module author never wrote can't fail CI (issue #13).
+        TRIVY_SKIP_DIRS: "**/.terraform,**/.terraform/**"
       run: |
         set -uo pipefail
         FAILURES="${RUNNER_TEMP}/ci_failures"
@@ -352,6 +357,9 @@ runs:
         CONTROL_PLANE_URL: ${{ inputs.control_plane_url }}
         FACETS_USERNAME: ${{ inputs.username }}
         FACETS_TOKEN: ${{ inputs.token }}
+        # Same rationale as the preview step: keep raptor's Trivy scan out of
+        # terraform-init'd dependencies under .terraform/ (issue #13).
+        TRIVY_SKIP_DIRS: "**/.terraform,**/.terraform/**"
       run: |
         set -uo pipefail
         FAILURES="${RUNNER_TEMP}/ci_failures"