HIGH
Source
Trivy
ID
AVD-GIT-0003

GitHub repository has vulnerability alerts disabled.

GitHub repository should be set to use vulnerability alerts.

You can do this by setting the vulnerability_alerts attribute to ’true'.

Impact

Follow the appropriate remediation steps below to resolve the issue.

Enable vulnerability alerts

1
2
3
4
resource "github_repository" "good_example" {
  name                 = "example"
  vulnerability_alerts = true
}
1
2
3
4
5
resource "github_repository" "good_example" {
  name                 = "example"
  archived             = true
  vulnerability_alerts = false
}