IaC Probe

[SUSTAPLE117]

No description provided.

[Copilot]

Pull request overview

Adds a new "IaC" probe that discovers credentials embedded in Infrastructure-as-Code files (Terraform Cloud tokens in credentials.tfrc.json/.terraformrc, cloud creds and DB passwords in *.tfvars, secrets in local terraform.tfstate, and Helm repositories.yaml username/password entries). In parallel, the kube and docker probes are refactored to stop encoding the in-file location as a URI fragment on the finding Path/Source and to instead surface it via a new location metadata key.

Changes:

• New IaCProbe (with tests) plus four new file-index patterns (terraform_credentials, terraform_vars, terraform_state, helm_repositories) and registration in scan/config defaults.
• Kube and Docker probes split file:<path>#<location> into a plain file:<path> source and a location metadata field.
• New iac entry in ProbeConfig and default-enabled in config.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
pkg/probe/iac.go	New IaC probe extracting Terraform/Helm credentials.
pkg/probe/iac_test.go	Tests for JSON/HCL Terraform creds, tfvars/tfstate line-scan, Helm repos, oversize cap.
pkg/probe/kube.go	Drops URI-fragment location from Source; adds location metadata.
pkg/probe/docker.go	Same refactor for auth and identity-token findings; messages include file: prefix.
pkg/models/config.go	Adds IaC settings to ProbeConfig.
pkg/config/config.go	Default-enables iac probe and registers four new file-index patterns.
cmd/bagel/scan.go	Wires the IaC probe into the scan when enabled.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.