cloud-infra: add trivy-scan skill and wire it into verification gates

[makigjuro]

Summary

• Adds a dedicated /trivy-scan skill under cloud-infra that runs trivy config against Terraform modules and Helm charts.
• Wires the scan into the existing verification flow: /infra-lint invokes it as a final step, and /complete-infra runs it as a parallel track in Phase 1 alongside format/validate/helm-lint.
• Updates the infra-reviewer agent to correlate .trivyignore suppressions with the current diff instead of re-running the scanner.

Why

Working through SparkReach F01 Azure infra (issue surfaced in my sparkreach repo), terraform validate and helm lint didn't catch:

• Public network access on Postgres Flexible Server and Key Vault (AZU-0022, AZU-0013)
• Missing Postgres audit logging (AZU-0019, AZU-0024)
• Unclassified Key Vault secrets (AZU-0015)

The infra-reviewer agent is great for judgement calls but doesn't carry Aqua Security's curated IaC rule library. trivy config does, and takes seconds. The gap felt like a missing verification gate in cloud-infra.

Changes

New skill: plugins/cloud-infra/skills/trivy-scan/

• SKILL.md — user-invocable; arguments --strict, --warn-only, --severity; documents the .trivyignore convention (every suppression must have a justifying comment).
• scripts/scan-trivy.sh — reusable script, consumed from other skills via bash {plugin-skills-path}/trivy-scan/scripts/scan-trivy.sh.
  • Preflights trivy binary, prints brew / curl install hints if missing (never auto-installs).
  • Auto-picks .trivyignore at $TF_PARENT/.trivyignore or $(dirname $CHARTS_PATH)/.trivyignore.
  • Default severity fail set: CRITICAL,HIGH,MEDIUM. TRIVY_STRICT=1 adds LOW. TRIVY_WARN_ONLY=1 makes it non-blocking.

Wired into existing skills

• infra-lint — new "Security Scan" section that invokes /trivy-scan, new quality-gate row.
• complete-infra — Phase 1 gains Track D (security scan) running in parallel with fmt/validate/helm-lint; quality-gate output updated.

Agent update

• infra-reviewer — new "Scanner Correlation (trivy)" section. The agent no longer re-runs trivy; it sanity-checks the .trivyignore justifications against the current diff and flags:
  • Suppressions missing a comment
  • Justifications obsolete given the current diff (e.g. comment says "deferred until VNet" but the diff adds VNet)
  • Rules targeting deprecated resource types (e.g. AZU-0026 is Single-Server only, misfires on Flexible Server)

Docs / versioning

• cloud-infra plugin 0.1.0 → 0.2.0, added trivy and security-scanning keywords.
• cloud-infra/README.md skills table updated.
• Top-level README.md skill count badge and headline 29 → 30.

Test plan

• Smoke-tested scan-trivy.sh against a real Terraform tree (SparkReach deploy/terraform/): correctly picks up .trivyignore, suppresses justified items, exits 0 on clean.
• Verified script fails non-zero when a seeded unsuppressed finding is present.
• Invoke /trivy-scan directly from a consumer project after plugin update.
• Invoke /infra-lint and confirm the new trivy gate appears in the output.
• Invoke /complete-infra and confirm Track D runs in parallel with the other lint tracks.

Notes

• trivy is intentionally not auto-installed. The script prints the install command and exits non-zero — consistent with how lint-helm.sh handles a missing helm binary.
• Trivy has some rules that target deprecated Azure resources (e.g. PostgreSQL Single Server). The reviewer agent specifically calls this out so users don't bloat their .trivyignore with obsolete rules.

Generated with Claude Code