Terraform Terrascan Linter generates results for wrong file location

[mrchandana]

The Terraform Terrascan linter is generating results with an incorrect file path. Specifically, it prepends github/workspace to the file name (e.g., file:///github/workspace/modules/ec2/ec2.tf:15) as shown in image. This path does not match the actual repository structure and causes the Code Scanning tab to fail in locating the referenced file.

Impact:

As a result, the Code Scanning UI cannot link the reported issues to the corresponding lines in the source code. This makes it difficult for developers to trace and resolve the identified vulnerabilities or misconfigurations efficiently.

[nvuillam]

@mrchandana please can you check in the logs what is the exact command line that calls terrascan , and post it here ?

[mrchandana]

@nvuillam [terrascan scan --iac-type terraform --verbose --output sarif]

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity.
It will be closed in 14 days if no further activity occurs.
Thank you for your contributions.

If you think this issue should stay open, please remove the O: stale 🤖 label or comment on the issue.

[nvuillam]

@mrchandana i think this is a terrascan issue, it should output SARIF in relative format and not absolute :/

Please can you report on their repo ?