| 1 | # Checkov Baseline |
| 2 | |
| 3 | > Issue: jmservera/SquadScope#541 (Phase A) · jmservera/SquadScope#543 (Phase B fixes) |
| 4 | > Epic: jmservera/SquadScope-Coordinator#33 |
| 5 | > Status: **Phase B complete** — 0 failed checks (4 justified `checkov:skip`). |
| 6 | |
| 7 | Checkov scans IaC, container, and GitHub Actions configuration for |
| 8 | misconfigurations. SquadScope currently has **no Dockerfiles, Terraform/Bicep, |
| 9 | docker-compose, or k8s manifests** — the only in-scope targets today are the |
| 10 | GitHub Actions workflows under `.github/workflows/`. The CI job is wired to also |
| 11 | cover `dockerfile` and `secrets` frameworks so coverage extends automatically |
| 12 | when container/IaC files are added. |
| 13 | |
| 14 | ## CI behaviour |
| 15 | |
| 16 | `.github/workflows/checkov.yml` runs Checkov with `--soft-fail` and |
| 17 | `continue-on-error: true` (non-blocking), uploads SARIF to GitHub Code Scanning, |
| 18 | and attaches the SARIF as a build artifact. |
| 19 | |
| 20 | ## Baseline snapshot |
| 21 | |
| 22 | - **Tool:** checkov 3.2.533 |
| 23 | - **Date:** 2026-06-26 |
| 24 | - **Frameworks:** github_actions, dockerfile, secrets |
| 25 | - **github_actions (current):** 604 passed, **0 failed**, 4 skipped |
| 26 | - **CRITICAL/HIGH:** 0 |
| 27 | |
| 28 | ### Phase A findings (resolved in Phase B) |
| 29 | |
| 30 | | Count | Check ID | Description | Phase B resolution | |
| 31 | |------:|----------|-------------|--------------------| |
| 32 | | 4 | CKV_GHA_7 | `workflow_dispatch` inputs should be empty (SLSA build-integrity) | Justified `# checkov:skip=CKV_GHA_7:...` inline comments | |
| 33 | |
| 34 | The four affected workflows are operational/dispatch workflows (not release |
| 35 | builds); their inputs select an operational target (week, run-id, manifest, |
| 36 | dry-run toggle) and do not alter published build artifacts, so a justified skip |
| 37 | is the correct disposition: |
| 38 | |
| 39 | - `.github/workflows/restore-publish-backup.yml` |
| 40 | - `.github/workflows/squad-promote.yml` |
| 41 | - `.github/workflows/trigger-podcast.yml` |
| 42 | - `.github/workflows/podcaster-handoff-smoke.yml` |
| 43 | |
| 44 | > Each skip carries an inline justification next to the `workflow_dispatch` |
| 45 | > block. Re-run `checkov` after any workflow change to confirm 0 failures. |
| 46 | |
| 47 | ## Running locally |
| 48 | |
| 49 | ```bash |
| 50 | # Install (pinned to match CI) |
| 51 | pip install checkov==3.2.533 |
| 52 | |
| 53 | # Scan the whole repo (report only) |
| 54 | checkov --directory . \ |
| 55 | --framework github_actions dockerfile secrets \ |
| 56 | --skip-path node_modules --skip-path .venv \ |
| 57 | --skip-path public --skip-path resources --skip-path themes \ |
| 58 | --compact --soft-fail |
| 59 | |
| 60 | # Scan a single file/dir |
| 61 | checkov --file .github/workflows/ci.yml |
| 62 | ``` |
| 63 | |
| 64 | ## Phase plan |
| 65 | |
| 66 | - **Phase A:** baseline + non-blocking CI + SARIF upload. ✅ |
| 67 | - **Phase B:** triage findings; justified suppressions or fixes. ✅ 0 failed (4 justified skips). |
| 68 | - **Phase C:** blocking CI gate (#545). ✅ The Checkov job dropped `--soft-fail` |
| 69 | + `continue-on-error`; new misconfigurations fail the build. Mark it required. |