| 1 | # Checkov lint — Phase C (blocking / enforced) |
| 2 | # |
| 3 | # DevSecOps Guardrails epic (jmservera/SquadScope-Coordinator#33), issues #541 |
| 4 | # (baseline), #543 (Phase B fixes), #545 (Phase C enforcement). The Phase B |
| 5 | # baseline is clean (0 failed; 4 justified inline skips), so this job is now |
| 6 | # BLOCKING: it fails the build on any new IaC/container/Actions misconfiguration. |
| 7 | # Accepted findings must carry a justified inline `# checkov:skip=<id>:<reason>`. |
| 8 | # Mark "Checkov / Checkov IaC/container scan" as a required check. |
| 9 | |
| 10 | name: Checkov |
| 11 | |
| 12 | on: |
| 13 | push: |
| 14 | branches: |
| 15 | - main |
| 16 | pull_request: |
| 17 | branches: |
| 18 | - main |
| 19 | |
| 20 | permissions: |
| 21 | contents: read |
| 22 | |
| 23 | concurrency: |
| 24 | group: ${{ github.workflow }}-${{ github.ref }} |
| 25 | cancel-in-progress: true |
| 26 | |
| 27 | jobs: |
| 28 | checkov: |
| 29 | name: Checkov IaC/container scan |
| 30 | runs-on: ubuntu-latest |
| 31 | permissions: |
| 32 | contents: read |
| 33 | security-events: write |
| 34 | steps: |
| 35 | - name: Checkout code |
| 36 | uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 |
| 37 | with: |
| 38 | persist-credentials: false |
| 39 | |
| 40 | - name: Set up Python |
| 41 | uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 |
| 42 | with: |
| 43 | python-version: "3.12" |
| 44 | |
| 45 | - name: Install Checkov (pinned) |
| 46 | run: python -m pip install checkov==3.2.533 |
| 47 | |
| 48 | - name: Run Checkov (blocking, SARIF) |
| 49 | # Phase C: blocking. No --soft-fail — a failed check fails the build. |
| 50 | # Accepted findings must use a justified inline `# checkov:skip`. |
| 51 | run: | |
| 52 | checkov \ |
| 53 | --directory . \ |
| 54 | --framework github_actions dockerfile secrets \ |
| 55 | --skip-path node_modules \ |
| 56 | --skip-path .venv \ |
| 57 | --skip-path public \ |
| 58 | --skip-path resources \ |
| 59 | --skip-path themes \ |
| 60 | --compact \ |
| 61 | --output cli \ |
| 62 | --output sarif \ |
| 63 | --output-file-path console,checkov-results.sarif |
| 64 | |
| 65 | - name: Checkov summary |
| 66 | if: always() |
| 67 | run: | |
| 68 | { |
| 69 | echo "### Checkov scan" |
| 70 | echo "" |
| 71 | echo "See the job log for the full report. This check is blocking (Phase C):" |
| 72 | echo "new misconfigurations fail the build; accepted findings carry a" |
| 73 | echo "justified inline \`# checkov:skip=<id>:<reason>\`." |
| 74 | } >> "$GITHUB_STEP_SUMMARY" |
| 75 | |
| 76 | - name: Upload SARIF to GitHub Code Scanning |
| 77 | if: always() |
| 78 | uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0 |
| 79 | with: |
| 80 | sarif_file: checkov-results.sarif |
| 81 | category: checkov |
| 82 | |
| 83 | - name: Upload SARIF as artifact |
| 84 | if: always() |
| 85 | uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 |
| 86 | with: |
| 87 | name: checkov-sarif |
| 88 | path: checkov-results.sarif |
| 89 | retention-days: 30 |