@codacy/tools-checkov-3 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Codacy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,69 @@
+# @codacy/tools-checkov-3
+
+## Table of Contents
+- [Overview](#overview)
+- [Updating patterns](#updating-patterns)
+- [Updating the Checkov version](#updating-the-checkov-version)
+- [Development](#development)
+- [Notes for maintainers](#notes-for-maintainers)
+
+---
+
+## Overview
+
+Infrastructure-as-Code security scanner using the [Checkov](https://www.checkov.io/) binary. Scans Terraform, CloudFormation, Kubernetes, Dockerfile, and many other IaC frameworks for security misconfigurations. Uses the CLI execution strategy with Python/pip installation into an isolated virtual environment.
+
+| Property | Value |
+|----------|-------|
+| Tool ID | `Checkov` |
+| Codacy UUID | `13af9d89-1ce5-4fec-a168-765c3e7b26b3` |
+| Strategy | CLI |
+| Languages | JSON, YAML, Terraform |
+| Binary | `checkov` (Python package) |
+| File patterns | `**/*.tf`, `**/*.yaml`, `**/*.yml`, `**/*.json`, `**/Dockerfile` |
+| Pattern count | ~1,358 |
+| Pattern ID format | `Checkov_{check_id}` (e.g. `Checkov_CKV_AWS_41`) |
+
+## Updating patterns
+
+```bash
+# Re-fetch pattern metadata from the Codacy API
+pnpm prefetch
+
+# Commit the result
+git add src/patterns.json
+```
+
+## Updating the Checkov version
+
+1. Update `preferredVersion` in `src/adapter.ts`
+2. Update the `PIP_PACKAGE` constant in `src/adapter.ts` (e.g. `checkov==3.2.510`)
+3. Run `pnpm prefetch` to refresh patterns (new versions may add checks)
+4. Run `pnpm test` to verify compatibility
+5. Consider creating a new package (`checkov-4/`) if the major version changes
+
+## Development
+
+```bash
+# Install checkov locally (requires Python 3.9+)
+pip install checkov==3.2.508
+
+# Build with tsup
+pnpm build
+
+# Run tests (skips binary-dependent tests if checkov is not installed)
+pnpm test
+```
+
+## Notes for maintainers
+
+- **Large pip install**: Checkov has ~200 transitive dependencies (pydantic, boto3 stubs, networkx, etc.). First install into the venv can take several minutes. Subsequent runs use the cached venv.
+- **Per-tool venv isolation**: The adapter installs Checkov into `~/.codacy/runtimes/Checkov/venv/` to avoid dependency conflicts with other Python-based tools.
+- **Multi-framework JSON output**: Checkov can emit a single JSON object or an array of objects (one per framework). The adapter normalizes both to an array before parsing.
+- **Path normalization**: `repo_file_path` from Checkov always has a leading `/` which must be stripped.
+- **No column information**: Checkov does not provide column numbers. All issues use `column: 1`.
+- **Exit codes**: Exit code 0 = no issues, 1 = issues found (normal), >1 = genuine error.
+- **Container mode network blocking**: In container mode (`ctx.runner === "container"`), the adapter sets proxy env vars and `RENDER_EDGES_DUPLICATE_ITER_COUNT=50` to block Bridgecrew API calls and tune performance.
+- **Pattern filtering**: Uses `--check CKV_xxx,CKV_yyy,...` to run only specific checks. The `Checkov_` prefix is stripped from pattern IDs to get the raw check ID.
+- **Config files**: Looks for `.checkov.yaml` or `.checkov.yml`. When local config is active, passes `--config-file <path>`.
+- **Parsing errors**: Checkov reports `parsing_errors` in its JSON output, which are surfaced as `AnalysisError` objects with `kind: "ParsingError"`.

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+import * as _codacy_tooling from '@codacy/tooling';
+
+declare const _default: Readonly<_codacy_tooling.ToolAdapter>;
+
+export { _default as default };