fix(module-ci): exclude terraform-init'd .terraform/ deps from Trivy scan

[anujhydrabadi]

Problem

Fixes#13.

module-ci-action calls raptor create iac-module, whose validation runs terraform init (vendoring remote module dependencies into .terraform/modules/ — Terraform clones the whole source repo per module call) and then trivy config --severity HIGH,CRITICAL <module dir> with no --skip-dirs. Trivy therefore scans dependency code the module author never wrote and fails CI on findings they cannot fix (e.g. KSV-0041/KSV-0056 against the nginx-gateway-fabric ClusterRole pulled in transitively via facets-utility-modules).

Fix

Trivy binds every CLI flag to a TRIVY_* env var, and raptor invokes it as a child process that inherits the step environment. This PR sets

TRIVY_SKIP_DIRS: "**/.terraform,**/.terraform/**"

on the preview and publish steps (the two that run raptor validation), scoping the scan to the module's own source. No raptor release is needed, and it works for any raptor_version / trivy-version. A root-cause PR adding --skip-dirs to raptor's own Trivy invocation is being raised separately in Facets-cloud/raptor; this env var stays as protection for older pinned raptor versions (the CLI flag will take precedence, with the same value).

Verification

Repro per the issue, with Trivy 0.72.0 (the action's pinned default) and a scratch module sourcing facets-utility-modules//name + //aws_irsa, replicating raptor's exact invocation (trivy config --format json --severity HIGH,CRITICAL --exit-code 0 --quiet .):

Run	HIGH/CRITICAL findings
baseline after terraform init -backend=false	4 — all from .terraform/modules/{name,irsa}/nginx_gateway_fabric/charts/...:templates/rbac.yaml (2 checks × 2 vendored copies)
with TRIVY_SKIP_DIRS='**/.terraform,**/.terraform/**'	0
same, plus a seeded privileged-pod bad.yaml in the module's own source	flagged (KSV-0014, KSV-0017, KSV-0118) — the skip does not swallow real findings

Release

After merge: tag v1.0.1 so release.yml moves the v1 alias and consumers pinned to @v1 pick this up on their next run.

🤖 Generated with Claude Code